@codacy/tools-checkov-3 0.13.0 → 0.15.0

package/README.md

@@ -1,6 +1,7 @@
 # @codacy/tools-checkov-3
 
 ## Table of Contents
+
 - [Overview](#overview)
 - [Updating patterns](#updating-patterns)
 - [Updating the Checkov version](#updating-the-checkov-version)
@@ -13,16 +14,16 @@
 
 Infrastructure-as-Code security scanner using the [Checkov](https://www.checkov.io/) binary. Scans Terraform, CloudFormation, Kubernetes, Dockerfile, and many other IaC frameworks for security misconfigurations. Uses the CLI execution strategy with Python/pip installation into an isolated virtual environment.
 
-| Property | Value |
-|----------|-------|
-| Tool ID | `Checkov` |
-| Codacy UUID | `13af9d89-1ce5-4fec-a168-765c3e7b26b3` |
-| Strategy | CLI |
-| Languages | JSON, YAML, Terraform |
-| Binary | `checkov` (Python package) |
-| File patterns | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
-| Pattern count | ~1,358 |
-| Pattern ID format | `Checkov_{check_id}` (e.g. `Checkov_CKV_AWS_41`) |
+| Property          | Value                                                            |
+| ----------------- | ---------------------------------------------------------------- |
+| Tool ID           | `Checkov`                                                        |
+| Codacy UUID       | `13af9d89-1ce5-4fec-a168-765c3e7b26b3`                           |
+| Strategy          | CLI                                                              |
+| Languages         | JSON, YAML, Terraform                                            |
+| Binary            | `checkov` (Python package)                                       |
+| File patterns     | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
+| Pattern count     | ~1,358                                                           |
+| Pattern ID format | `Checkov_{check_id}` (e.g. `Checkov_CKV_AWS_41`)                 |
 
 ## Updating patterns
 
@@ -67,3 +68,9 @@ pnpm test
 - **Pattern filtering**: Uses `--check CKV_xxx,CKV_yyy,...` to run only specific checks. The `Checkov_` prefix is stripped from pattern IDs to get the raw check ID.
 - **Config files**: Looks for `.checkov.yaml` or `.checkov.yml`. When local config is active, passes `--config-file <path>`.
 - **Parsing errors**: Checkov reports `parsing_errors` in its JSON output, which are surfaced as `AnalysisError` objects with `kind: "ParsingError"`.
+- **Preset mappings (`src/pattern-mappings.json`)**: gates 54 of the 1,358 patterns on a detected preset (Dockerfile, Terraform, GitHub Actions, CircleCI, GitLab CI, Bitbucket Pipelines, Azure Pipelines), so `init --auto` doesn't enable e.g. GitHub Actions checks in a repo with no `.github/workflows/`. The remaining 1,304 patterns stay universal (enabled everywhere) until their detection story is solved — this is deliberately conservative rather than approximate:
+  - `"Terraform"` maps **only** `CKV_TF_` (2 patterns — Terraform module-source hygiene, e.g. "use a commit hash"). The much larger cloud-provider families (`CKV_AWS_` 384, `CKV_AZURE_` 247, `CKV_GCP_` 124, and 12 smaller clouds — ~1,091 patterns total) are **not** Terraform-specific: Checkov evaluates the same resource-policy checks against CloudFormation/ARM/Bicep/Serverless Framework templates too (plain YAML/JSON, no `.tf` file involved) — confirmed by Codacy's own pattern metadata, where every single pattern carries the identical `languages: ["JSON", "YAML", "Terraform"]`. Gating them on `.tf` presence would silently drop all cloud checks for a CloudFormation/ARM/Serverless-only repo — a real false negative, not just noise the old universal behavior already had. They stay universal until discovery can recognize those other IaC formats too.
+  - Each CI platform also has a **second**, easily-confused prefix family for that platform's repo/org governance settings as managed via its own Terraform provider (e.g. `CKV_GIT_`/`CKV_GITHUB_` vs. the mapped `CKV_GHA_`; `CKV_GLB_`/`CKV_GITLAB_` vs. the mapped `CKV_GITLABCI_`). Those governance patterns need Terraform-provider-content parsing, not file presence, so they're intentionally left out of the mapping (40 patterns, universal for now).
+  - `CKV_K8S_`/`CKV2_K8S_`/`CKV_ARGO_` (121 patterns) are also left out — a bare Kubernetes manifest needs YAML content-sniffing (`apiVersion`/`kind`), not just a `.yaml` extension.
+  - `CKV_ANSIBLE_`/`CKV2_ANSIBLE_` (12) and `CKV_OPENAPI_` (21) are left out too — there's no Ansible-playbook or OpenAPI/AsyncAPI-spec detector in `discover()` at all yet.
+  - `CKV_SECRET_` (18) and `CKV_BCW_` (1) are excluded from every preset by design and stay universal — secret-scanning shouldn't be suppressed by any framework gate.

package/dist/index.js

@@ -57,7 +57,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure HTTPS URL usage with uri module",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML", "JSON", "Terraform"],
     parameters: []
   },
   {
@@ -66,7 +66,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure HTTPS URL is used with get_url",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML", "JSON", "Terraform"],
     parameters: []
   },
   {
@@ -156,7 +156,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Auto Scaling Groups Associated with Load Balancers Use Elastic Load Balancing Health Checks",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -166,7 +166,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Auto Scaling is Enabled on DynamoDB Tables",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -230,7 +230,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Route53 A Record Has Attached Resource",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -555,7 +555,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Dedicated Master Node is Enabled for ElasticSearch/OpenSearch",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -574,7 +574,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure RDS Instance Has Copy Tags to Snapshots Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -584,7 +584,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure S3 Bucket Has Lifecycle Configuration",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -1261,7 +1261,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Virtual Machines Utilize Managed Disks",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: []
   },
   {
@@ -1459,7 +1459,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL Database Flag 'log_duration' Is Set to 'on'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["SQL"],
     parameters: [],
     tags: ["gcp"]
   },
@@ -1478,7 +1478,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL Database Flag 'log_parser_stats' Is Set to 'off'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["SQL"],
     parameters: [],
     tags: ["gcp"]
   },
@@ -1488,7 +1488,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL Database Flag 'log_planner_stats' Is Set to 'off'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["googlecloudplatform"]
   },
@@ -1498,7 +1498,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL Database Flag 'log_statement_stats' Is Set to 'off'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["SQL", "Terraform"],
     parameters: [],
     tags: ["gcp"]
   },
@@ -1970,7 +1970,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure OSS Bucket Has Transfer Acceleration Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["alibabacloud", "oss"]
   },
@@ -2169,7 +2169,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Kubernetes Node Pools Are Set to Auto Repair",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform", "YAML"],
     parameters: [],
     tags: ["alibabacloud", "kubernetes"]
   },
@@ -2197,7 +2197,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure RDS Instance Has log_duration Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["alibabacloud", "rds"]
   },
@@ -2333,7 +2333,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Certificate Validation Is Enabled with get_url",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML", "JSON", "Terraform"],
     parameters: []
   },
   {
@@ -2558,7 +2558,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure AWS Lambda Function Has Function-Level Concurrent Execution Limit Configured",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws", "lambda"]
   },
@@ -2568,7 +2568,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure AWS Lambda Function is Configured with a Dead Letter Queue (DLQ)",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -2614,7 +2614,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure API Gateway Caching Is Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -2660,7 +2660,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Detailed Monitoring is Enabled for EC2 Instances",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -2733,7 +2733,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure EC2 Instances Are EBS Optimized",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -2761,7 +2761,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure ELB Cross-Zone Load Balancing Is Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -2897,7 +2897,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Load Balancer Has Cross-Zone Load Balancing Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -2907,7 +2907,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Tags on Autoscaling Group Launch Configurations",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -3530,7 +3530,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure CloudFront Distribution Is Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -3540,7 +3540,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Create Before Destroy for API Deployments",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -3622,7 +3622,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure API Gateway Method Setting Caching is Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -3704,7 +3704,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Create Before Destroy for ACM Certificates",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -3741,7 +3741,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Create Before Destroy for API Gateway",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -3985,7 +3985,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure HTTP/HTTPS Target Group Defines Healthcheck",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4373,7 +4373,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure S3 Lifecycle Configuration Sets Period for Aborting Failed Uploads",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4419,7 +4419,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure CloudFront Distribution Has a Default Root Object Configured",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4474,7 +4474,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure CloudFront Distributions Have Origin Failover Configured",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4502,7 +4502,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure RDS Cluster Copies Tags to Snapshots",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4521,7 +4521,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure EC2 Auto Scaling Groups Use EC2 Launch Templates",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4549,7 +4549,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Elasticsearch domains have at least three dedicated master nodes for high availability",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4631,7 +4631,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure RDS Aurora Clusters Have Backtracking Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4902,7 +4902,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure RDS Instances Have Performance Insights Enabled",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -4993,7 +4993,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Neptune DB Clusters to Copy Tags to Snapshots",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -5543,7 +5543,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure CloudWatch Log Group Specifies Retention Days",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["aws"]
   },
@@ -5922,7 +5922,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Azure Data Factory Uses Git Repository for Source Control",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6249,7 +6249,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL Flexible Server Enables Geo-Redundant Backups",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure", "postgresql"]
   },
@@ -6396,7 +6396,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6541,7 +6541,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Geo-Replicated Container Registries for Multi-Region Deployments",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6560,7 +6560,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Retention Policy Is Set to Cleanup Untagged Manifests",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6570,7 +6570,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Minimum Pod Count of 50 on Azure Kubernetes Cluster Nodes",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure", "kubernetes", "aks"]
   },
@@ -6580,7 +6580,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Azure Kubernetes Cluster (AKS) Nodes Use Scale Sets",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure", "kubernetes", "aks"]
   },
@@ -6599,7 +6599,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure AKS Uses the Paid SKU for SLA",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6609,7 +6609,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure AKS Cluster Upgrade Channel Is Chosen",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6646,7 +6646,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Web PubSub Uses a SKU with an SLA",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6701,7 +6701,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Data Explorer Uses SKU with SLA",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6774,7 +6774,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Configuration SKU is Standard",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: []
   },
   {
@@ -6792,7 +6792,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Selection of Standard Pricing Tier",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6982,7 +6982,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Azure Cognitive Search SLA for Index Updates",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -6992,7 +6992,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Azure Cognitive Search SLA for Search Index Queries",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7020,7 +7020,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Service Plan Suitable for Production Use",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7030,7 +7030,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure App Service Has Minimum Number of Instances for Failover",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7040,7 +7040,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Service Configures Health Check",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7050,7 +7050,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Service Is Set To Be Always On",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7159,7 +7159,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure the App Service Plan is zone redundant",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7187,7 +7187,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Azure Event Hub Namespace is Zone Redundant",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7197,7 +7197,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Azure SQL Database Namespace is Zone Redundant",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7225,7 +7225,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Service Environment is Zone Redundant",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7244,7 +7244,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Azure Container Registry (ACR) is Zone Redundant",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7605,7 +7605,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Storage Accounts Adhere to the Naming Rules",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7795,7 +7795,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Service Enables Detailed Error Messages",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -7814,7 +7814,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure HTTP Version Is the Latest When Running Azure Function App",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -8022,7 +8022,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure App Services Use Azure Files",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: [],
     tags: ["azure"]
   },
@@ -8311,7 +8311,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure WORKDIR values are absolute paths",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Dockerfile"],
     parameters: []
   },
   {
@@ -8320,7 +8320,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Unique From Aliases in Multistage Docker Builds",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Dockerfile"],
     parameters: []
   },
   {
@@ -8329,7 +8329,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure HEALTHCHECK Instructions Are Added to Container Images",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Dockerfile"],
     parameters: []
   },
   {
@@ -8347,7 +8347,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure COPY is Used Instead of ADD in Dockerfiles",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Dockerfile"],
     parameters: []
   },
   {
@@ -8356,7 +8356,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Avoid Using Update Instructions Alone in Dockerfile",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Dockerfile"],
     parameters: [],
     tags: ["docker"]
   },
@@ -8366,7 +8366,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce use of LABEL maintainer instead of deprecated MAINTAINER",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Dockerfile"],
     parameters: [],
     tags: ["docker"]
   },
@@ -8763,7 +8763,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Kubernetes Clusters are Configured with Labels",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML", "JSON"],
     parameters: [],
     tags: ["kubernetes", "googlecloud"]
   },
@@ -9053,7 +9053,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL Database 'log_checkpoints' Flag Is Set to 'on'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["SQL"],
     parameters: [],
     tags: ["gcp", "postgresql"]
   },
@@ -9081,7 +9081,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL 'log_lock_waits' Flag Is Set To 'on'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["SQL", "Terraform"],
     parameters: [],
     tags: ["gcp"]
   },
@@ -9100,7 +9100,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure PostgreSQL 'log_temp_files' Flag Is Set to '0'",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["SQL"],
     parameters: [],
     tags: ["gcp", "cloudsql", "postgresql"]
   },
@@ -9173,7 +9173,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Avoid Configuring a Bucket to Log to Itself",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform", "YAML", "JSON"],
     parameters: [],
     tags: ["gcp", "googlecloudstorage"]
   },
@@ -9427,7 +9427,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure 'Automatic node repair' is enabled for Kubernetes Clusters",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform", "YAML"],
     parameters: [],
     tags: ["gcp", "kubernetes"]
   },
@@ -9961,7 +9961,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce CPU Requests in Kubernetes Pods",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10007,7 +10007,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Proper Setting of --terminated-pod-gc-threshold Argument",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10035,7 +10035,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce CPU Limits Are Set",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10135,7 +10135,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Memory Requests in Kubernetes Pods",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10154,7 +10154,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Memory Limits Are Set",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10465,7 +10465,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Avoid Specifying hostPort Unless Absolutely Necessary",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10799,7 +10799,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Liveness Probe Configuration in Kubernetes Pods",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -10890,7 +10890,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Enforce Readiness Probe Configuration",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: [],
     tags: ["kubernetes"]
   },
@@ -11144,7 +11144,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure NKS Control Plane Logging is Enabled for All Log Types",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform", "JSON", "YAML"],
     parameters: []
   },
   {
@@ -11829,7 +11829,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Description Is Populated Within Security Policies",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["YAML"],
     parameters: []
   },
   {
@@ -12135,7 +12135,7 @@ var patterns_default = [
     severityLevel: "High",
     title: "Ensure Terraform Module Sources Use Commit Hash",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform", "JSON", "YAML"],
     parameters: []
   },
   {
@@ -12144,7 +12144,7 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Ensure Terraform Module Sources Use a Version Tag",
     enabled: true,
-    languages: ["JSON", "YAML", "Terraform"],
+    languages: ["Terraform"],
     parameters: []
   },
   {
@@ -12366,7 +12366,29 @@ var patterns_default = [
 ];
 
 // src/pattern-mappings.json
-var pattern_mappings_default = {};
+var pattern_mappings_default = {
+  Dockerfile: {
+    prefixes: ["Checkov_CKV_DOCKER_", "Checkov_CKV2_DOCKER_"]
+  },
+  Terraform: {
+    prefixes: ["Checkov_CKV_TF_"]
+  },
+  "GitHub Actions": {
+    prefixes: ["Checkov_CKV_GHA_", "Checkov_CKV2_GHA_"]
+  },
+  CircleCI: {
+    prefixes: ["Checkov_CKV_CIRCLECIPIPELINES_"]
+  },
+  "GitLab CI": {
+    prefixes: ["Checkov_CKV_GITLABCI_"]
+  },
+  "Bitbucket Pipelines": {
+    prefixes: ["Checkov_CKV_BITBUCKETPIPELINES_"]
+  },
+  "Azure Pipelines": {
+    prefixes: ["Checkov_CKV_AZUREPIPELINES_"]
+  }
+};
 
 // src/metadata.ts
 var descriptor = {
@@ -12375,7 +12397,7 @@ var descriptor = {
   preferredVersion: "3.2.508",
   languages: ["JSON", "YAML", "Terraform"],
   filePatterns: ["**/*.tf", "**/*.yaml", "**/*.yml", "**/*.json", "**/Dockerfile"],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default
@@ -12399,16 +12421,35 @@ var CONFIG_FILE_CANDIDATES = [".checkov.yaml", ".checkov.yml"];
 var PIP_PACKAGE = "checkov==3.2.508";
 var BINARY = "checkov";
 var VERSION_REGEX = /(\d+\.\d+\.\d+)/;
-async function resolveBinaryPath(ctx) {
+var PYTHON_VERSION_RANGE = ">=3.9.0 <3.14.0";
+var MODULE_ARGS = ["-m", "checkov.main"];
+async function resolveCheckovInvocation(ctx) {
   const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, TOOL_ID);
+  const venvPython = (0, import_tooling.getVenvPaths)(venvDir).python;
+  if (await pathExists(venvPython)) {
+    return { command: venvPython, prefixArgs: MODULE_ARGS };
+  }
+  return { command: BINARY, prefixArgs: [] };
+}
+async function probeCheckovVersion(command, prefixArgs, logger) {
   try {
-    const venv = await (0, import_tooling.ensureVenv)((await (0, import_tooling.findPython)())?.path ?? "python3", venvDir);
-    const venvBin = (0, import_tooling.resolveVenvBinary)(venv, BINARY);
-    await import_promises.default.access(venvBin);
-    return venvBin;
+    const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(command, [...prefixArgs, "--version"], {
+      cwd: process.cwd(),
+      timeoutMs: 6e4,
+      logger
+    });
+    if (exitCode !== 0) return null;
+    const match = (stdout || stderr).match(VERSION_REGEX);
+    return match ? match[1] : null;
   } catch {
+    return null;
   }
-  return BINARY;
+}
+async function listDirSafe(dir) {
+  return import_promises.default.readdir(dir).catch(() => []);
+}
+async function pathExists(p) {
+  return import_promises.default.access(p).then(() => true).catch(() => false);
 }
 function buildEnv(ctx) {
   if (ctx.runner !== "container") return void 0;
@@ -12434,25 +12475,25 @@ var adapter = {
   prerequisites: [
     {
       name: "Python",
-      versionRange: ">=3.9.0",
+      versionRange: PYTHON_VERSION_RANGE,
       preferredVersion: "3.12.0",
       checkCommand: "python3 --version"
     }
   ],
   /**
-   * Checks whether the `checkov` binary is present and runnable.
+   * Checks whether checkov is present and runnable.
    *
    * Checks in order:
-   * 1. Codacy-managed venv (`~/.codacy/runtimes/Checkov/venv/bin/checkov`) -> installation: "codacy"
-   * 2. Global PATH (`checkov`) -> installation: "global"
+   * 1. Codacy-managed venv — `<venv>/python -m checkov.main --version` -> "codacy"
+   * 2. Global PATH — `checkov --version` -> "global"
    *
-   * Parses the version from `checkov --version` output using a version regex.
-   * Returns `available: false` (rather than throwing) if the binary is not
-   * found or returns a non-zero exit code.
+   * checkov is always invoked as a module (see {@link MODULE_ARGS}); its wheel
+   * ships no console-script, so on Windows there is no `checkov.exe` to probe.
+   * Returns `available: false` (rather than throwing) if checkov cannot be run.
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
-    const pythonInfo = await (0, import_tooling.findPython)(void 0, ctx.logger).catch(() => null);
+    const pythonInfo = await (0, import_tooling.findPython)(PYTHON_VERSION_RANGE, ctx.logger).catch(() => null);
     const dependencies = pythonInfo ? [
       {
         name: "Python",
@@ -12462,46 +12503,36 @@ var adapter = {
       }
     ] : [{ name: "Python", available: false, reason: "Python 3 not found" }];
     const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, TOOL_ID);
-    try {
-      if (pythonInfo) {
-        const venv = await (0, import_tooling.ensureVenv)(pythonInfo.path, venvDir, ctx.logger);
-        const version = await (0, import_tooling.checkVenvTool)(venv, BINARY, "--version", VERSION_REGEX, ctx.logger);
-        if (version) {
-          ctx.logger.debug("Checkov found in codacy venv", { toolId: TOOL_ID, version });
-          return {
-            available: true,
-            version,
-            path: (0, import_tooling.resolveVenvBinary)(venv, BINARY),
-            installation: "codacy",
-            dependencies
-          };
-        }
+    const venvPython = (0, import_tooling.getVenvPaths)(venvDir).python;
+    const venvPythonExists = await pathExists(venvPython);
+    if (venvPythonExists) {
+      const version = await probeCheckovVersion(venvPython, MODULE_ARGS, ctx.logger);
+      if (version) {
+        ctx.logger.debug("Checkov found in codacy venv", { toolId: TOOL_ID, version });
+        return {
+          available: true,
+          version,
+          path: venvPython,
+          installation: "codacy",
+          dependencies
+        };
       }
-    } catch {
     }
-    try {
-      const { stdout, exitCode } = await (0, import_tooling.spawnTool)(BINARY, ["--version"], {
-        cwd: process.cwd(),
-        logger: ctx.logger
-      });
-      if (exitCode === 0) {
-        const match = stdout.match(VERSION_REGEX);
-        if (match) {
-          ctx.logger.debug("Checkov found on global PATH", { toolId: TOOL_ID, version: match[1] });
-          return {
-            available: true,
-            version: match[1],
-            installation: "global",
-            dependencies
-          };
-        }
-      }
-    } catch {
+    const globalVersion = await probeCheckovVersion(BINARY, [], ctx.logger);
+    if (globalVersion) {
+      ctx.logger.debug("Checkov found on global PATH", { toolId: TOOL_ID, version: globalVersion });
+      return {
+        available: true,
+        version: globalVersion,
+        installation: "global",
+        dependencies
+      };
     }
-    ctx.logger.debug("Checkov not found", { toolId: TOOL_ID });
+    const reason = venvPythonExists ? `checkov could not be run via '${venvPython} -m checkov.main --version' (see debug logs); it may not be installed in the venv or the venv's Python may be incompatible` : "checkov not found in the Codacy venv or on PATH";
+    ctx.logger.debug("Checkov not found", { toolId: TOOL_ID, venvPython, venvPythonExists });
     return {
       available: false,
-      reason: "checkov binary not found in PATH or Codacy venv directory",
+      reason,
       installHint: "pip install checkov  # or\ncodacy-analysis analyze . --install-dependencies  # auto-install",
       dependencies
     };
@@ -12515,7 +12546,7 @@ var adapter = {
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
-    const pythonInfo = await (0, import_tooling.ensurePython)(ctx.globalDir, void 0, ctx.logger);
+    const pythonInfo = await (0, import_tooling.ensurePython)(ctx.globalDir, PYTHON_VERSION_RANGE, ctx.logger);
     if (!pythonInfo) {
       return {
         success: false,
@@ -12523,24 +12554,50 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "toolInstall",
           kind: "MissingPrerequisite",
-          message: "Python 3 could not be found or downloaded. Install Python 3.9+ or enable auto-install.",
+          message: "Python (>=3.9.0 <3.14.0) could not be found or downloaded. Checkov 3.2.x does not support Python 3.14+.",
           level: "error"
         }
       };
     }
     const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, TOOL_ID);
-    try {
-      ctx.logger.info(`Creating venv for Checkov at ${venvDir}...`);
+    const venvPython = (0, import_tooling.getVenvPaths)(venvDir).python;
+    const installIntoVenv = async () => {
       const venv = await (0, import_tooling.ensureVenv)(pythonInfo.path, venvDir, ctx.logger);
       ctx.logger.info(
         `Installing ${PIP_PACKAGE} (this may take several minutes due to ~200 transitive dependencies)...`
       );
       await (0, import_tooling.pipInstall)(venv, [PIP_PACKAGE], ctx.logger);
-      const installedPath = (0, import_tooling.resolveVenvBinary)(venv, BINARY);
-      ctx.logger.info(`Installed Checkov to ${installedPath}`);
+      return probeCheckovVersion(venv.python, MODULE_ARGS, ctx.logger);
+    };
+    try {
+      ctx.logger.info(`Creating venv for Checkov at ${venvDir}...`);
+      let version = await installIntoVenv();
+      if (!version) {
+        ctx.logger.warn(
+          `Checkov installed but 'python -m checkov.main' did not run; rebuilding the venv`,
+          { venvDir, binDirContents: await listDirSafe((0, import_tooling.getVenvPaths)(venvDir).binDir) }
+        );
+        await import_promises.default.rm(venvDir, { recursive: true, force: true }).catch(() => {
+        });
+        version = await installIntoVenv();
+      }
+      if (!version) {
+        const contents = await listDirSafe((0, import_tooling.getVenvPaths)(venvDir).binDir);
+        return {
+          success: false,
+          error: {
+            toolId: TOOL_ID,
+            phase: "toolInstall",
+            kind: "InstallError",
+            message: `Checkov install completed but 'python -m checkov.main --version' did not run in the venv (bin dir contains: ${contents.join(", ") || "nothing"}). The venv's Python may be incompatible with Checkov 3.2.x.`,
+            level: "error"
+          }
+        };
+      }
+      ctx.logger.info(`Installed Checkov ${version} to ${venvPython}`);
       return {
         success: true,
-        installedPath,
+        installedPath: venvPython,
         installedVersion: adapter.preferredVersion
       };
     } catch (err) {
@@ -12615,54 +12672,87 @@ var adapter = {
     if (ctx.targetFiles.length === 0) {
       return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
     }
-    let binary;
+    let command;
+    let prefixArgs;
     try {
-      binary = await resolveBinaryPath(ctx);
+      ({ command, prefixArgs } = await resolveCheckovInvocation(ctx));
     } catch {
-      binary = BINARY;
+      command = BINARY;
+      prefixArgs = [];
     }
-    const args = ["-o", "json", "--quiet"];
+    const baseArgs = [...prefixArgs, "-o", "json", "--quiet"];
     const useLocal = codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile;
     if (useLocal) {
-      args.push("--config-file", codacyConfig.localConfigurationFile);
-    }
-    for (const file of ctx.targetFiles) {
-      args.push("-f", import_path.default.resolve(ctx.repositoryRoot, file));
+      baseArgs.push("--config-file", codacyConfig.localConfigurationFile);
     }
+    const absoluteFiles = ctx.targetFiles.map((f) => import_path.default.resolve(ctx.repositoryRoot, f));
+    const fileChunks = (0, import_tooling.chunkFilesForArgv)(absoluteFiles);
     const env = buildEnv(ctx);
+    const frameworks = [];
     try {
-      const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
-        cwd: ctx.repositoryRoot,
-        env,
-        logger: ctx.logger
-      });
-      if (exitCode > 1) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "toolInvoke",
-          kind: "NonZeroExit",
-          message: `checkov exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
-          level: "error"
-        });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      if (!stdout.trim()) {
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(stdout);
-      } catch (err) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "outputParse",
-          kind: "MalformedOutput",
-          message: `Failed to parse checkov JSON output: ${err instanceof Error ? err.message : String(err)}`,
-          level: "error"
+      for (const chunk of fileChunks) {
+        const fileArgs = [];
+        for (const file of chunk) {
+          fileArgs.push("-f", file);
+        }
+        const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(command, [...baseArgs, ...fileArgs], {
+          cwd: ctx.repositoryRoot,
+          env,
+          logger: ctx.logger
         });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+        if (exitCode > 1) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "toolInvoke",
+            kind: "NonZeroExit",
+            message: `checkov exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+            level: "error"
+          });
+          return (0, import_tooling.buildResult)(
+            TOOL_ID,
+            startedAt,
+            /* @__PURE__ */ new Date(),
+            issues,
+            errors,
+            ctx.targetFiles.length
+          );
+        }
+        if (stderr && stderr.trim()) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "toolInvoke",
+            kind: "StderrWarning",
+            message: `checkov stderr: ${stderr.trim()}`,
+            level: "warning"
+          });
+        }
+        if (!stdout.trim()) continue;
+        let parsed;
+        try {
+          parsed = JSON.parse(stdout);
+        } catch (err) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "outputParse",
+            kind: "MalformedOutput",
+            message: `Failed to parse checkov JSON output: ${err instanceof Error ? err.message : String(err)}`,
+            level: "error"
+          });
+          return (0, import_tooling.buildResult)(
+            TOOL_ID,
+            startedAt,
+            /* @__PURE__ */ new Date(),
+            issues,
+            errors,
+            ctx.targetFiles.length
+          );
+        }
+        if (Array.isArray(parsed)) {
+          frameworks.push(...parsed);
+        } else {
+          frameworks.push(parsed);
+        }
       }
-      const frameworks = Array.isArray(parsed) ? parsed : [parsed];
       const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
       const targetFilesSet = new Set(ctx.targetFiles);
       const linesCache = /* @__PURE__ */ new Map();
@@ -12716,15 +12806,6 @@ var adapter = {
           issues.push(issue);
         }
       }
-      if (stderr && stderr.trim()) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "toolInvoke",
-          kind: "StderrWarning",
-          message: `checkov stderr: ${stderr.trim()}`,
-          level: "warning"
-        });
-      }
     } catch (err) {
       errors.push({
         toolId: TOOL_ID,

package/dist/metadata.js

@@ -25,7 +25,29 @@ __export(metadata_exports, {
 module.exports = __toCommonJS(metadata_exports);
 
 // src/pattern-mappings.json
-var pattern_mappings_default = {};
+var pattern_mappings_default = {
+  Dockerfile: {
+    prefixes: ["Checkov_CKV_DOCKER_", "Checkov_CKV2_DOCKER_"]
+  },
+  Terraform: {
+    prefixes: ["Checkov_CKV_TF_"]
+  },
+  "GitHub Actions": {
+    prefixes: ["Checkov_CKV_GHA_", "Checkov_CKV2_GHA_"]
+  },
+  CircleCI: {
+    prefixes: ["Checkov_CKV_CIRCLECIPIPELINES_"]
+  },
+  "GitLab CI": {
+    prefixes: ["Checkov_CKV_GITLABCI_"]
+  },
+  "Bitbucket Pipelines": {
+    prefixes: ["Checkov_CKV_BITBUCKETPIPELINES_"]
+  },
+  "Azure Pipelines": {
+    prefixes: ["Checkov_CKV_AZUREPIPELINES_"]
+  }
+};
 
 // src/metadata.ts
 var descriptor = {
@@ -34,7 +56,7 @@ var descriptor = {
   preferredVersion: "3.2.508",
   languages: ["JSON", "YAML", "Terraform"],
   filePatterns: ["**/*.tf", "**/*.yaml", "**/*.yml", "**/*.json", "**/Dockerfile"],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-checkov-3",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Checkov adapter — CLI-mode IaC security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.13.0"
+    "@codacy/tooling": "0.15.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",