@codacy/tools-checkov-3 0.14.0 → 0.16.0

package/README.md

@@ -1,6 +1,7 @@
 # @codacy/tools-checkov-3
 
 ## Table of Contents
+
 - [Overview](#overview)
 - [Updating patterns](#updating-patterns)
 - [Updating the Checkov version](#updating-the-checkov-version)
@@ -13,16 +14,16 @@
 
 Infrastructure-as-Code security scanner using the [Checkov](https://www.checkov.io/) binary. Scans Terraform, CloudFormation, Kubernetes, Dockerfile, and many other IaC frameworks for security misconfigurations. Uses the CLI execution strategy with Python/pip installation into an isolated virtual environment.
 
-| Property | Value |
-|----------|-------|
-| Tool ID | `Checkov` |
-| Codacy UUID | `13af9d89-1ce5-4fec-a168-765c3e7b26b3` |
-| Strategy | CLI |
-| Languages | JSON, YAML, Terraform |
-| Binary | `checkov` (Python package) |
-| File patterns | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
-| Pattern count | ~1,358 |
-| Pattern ID format | `Checkov_{check_id}` (e.g. `Checkov_CKV_AWS_41`) |
+| Property          | Value                                                            |
+| ----------------- | ---------------------------------------------------------------- |
+| Tool ID           | `Checkov`                                                        |
+| Codacy UUID       | `13af9d89-1ce5-4fec-a168-765c3e7b26b3`                           |
+| Strategy          | CLI                                                              |
+| Languages         | JSON, YAML, Terraform                                            |
+| Binary            | `checkov` (Python package)                                       |
+| File patterns     | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
+| Pattern count     | ~1,358                                                           |
+| Pattern ID format | `Checkov_{check_id}` (e.g. `Checkov_CKV_AWS_41`)                 |
 
 ## Updating patterns
 
@@ -67,3 +68,9 @@ pnpm test
 - **Pattern filtering**: Uses `--check CKV_xxx,CKV_yyy,...` to run only specific checks. The `Checkov_` prefix is stripped from pattern IDs to get the raw check ID.
 - **Config files**: Looks for `.checkov.yaml` or `.checkov.yml`. When local config is active, passes `--config-file <path>`.
 - **Parsing errors**: Checkov reports `parsing_errors` in its JSON output, which are surfaced as `AnalysisError` objects with `kind: "ParsingError"`.
+- **Preset mappings (`src/pattern-mappings.json`)**: gates 54 of the 1,358 patterns on a detected preset (Dockerfile, Terraform, GitHub Actions, CircleCI, GitLab CI, Bitbucket Pipelines, Azure Pipelines), so `init --auto` doesn't enable e.g. GitHub Actions checks in a repo with no `.github/workflows/`. The remaining 1,304 patterns stay universal (enabled everywhere) until their detection story is solved — this is deliberately conservative rather than approximate:
+  - `"Terraform"` maps **only** `CKV_TF_` (2 patterns — Terraform module-source hygiene, e.g. "use a commit hash"). The much larger cloud-provider families (`CKV_AWS_` 384, `CKV_AZURE_` 247, `CKV_GCP_` 124, and 12 smaller clouds — ~1,091 patterns total) are **not** Terraform-specific: Checkov evaluates the same resource-policy checks against CloudFormation/ARM/Bicep/Serverless Framework templates too (plain YAML/JSON, no `.tf` file involved) — confirmed by Codacy's own pattern metadata, where every single pattern carries the identical `languages: ["JSON", "YAML", "Terraform"]`. Gating them on `.tf` presence would silently drop all cloud checks for a CloudFormation/ARM/Serverless-only repo — a real false negative, not just noise the old universal behavior already had. They stay universal until discovery can recognize those other IaC formats too.
+  - Each CI platform also has a **second**, easily-confused prefix family for that platform's repo/org governance settings as managed via its own Terraform provider (e.g. `CKV_GIT_`/`CKV_GITHUB_` vs. the mapped `CKV_GHA_`; `CKV_GLB_`/`CKV_GITLAB_` vs. the mapped `CKV_GITLABCI_`). Those governance patterns need Terraform-provider-content parsing, not file presence, so they're intentionally left out of the mapping (40 patterns, universal for now).
+  - `CKV_K8S_`/`CKV2_K8S_`/`CKV_ARGO_` (121 patterns) are also left out — a bare Kubernetes manifest needs YAML content-sniffing (`apiVersion`/`kind`), not just a `.yaml` extension.
+  - `CKV_ANSIBLE_`/`CKV2_ANSIBLE_` (12) and `CKV_OPENAPI_` (21) are left out too — there's no Ansible-playbook or OpenAPI/AsyncAPI-spec detector in `discover()` at all yet.
+  - `CKV_SECRET_` (18) and `CKV_BCW_` (1) are excluded from every preset by design and stay universal — secret-scanning shouldn't be suppressed by any framework gate.

package/dist/index.js

@@ -12366,7 +12366,29 @@ var patterns_default = [
 ];
 
 // src/pattern-mappings.json
-var pattern_mappings_default = {};
+var pattern_mappings_default = {
+  Dockerfile: {
+    prefixes: ["Checkov_CKV_DOCKER_", "Checkov_CKV2_DOCKER_"]
+  },
+  Terraform: {
+    prefixes: ["Checkov_CKV_TF_"]
+  },
+  "GitHub Actions": {
+    prefixes: ["Checkov_CKV_GHA_", "Checkov_CKV2_GHA_"]
+  },
+  CircleCI: {
+    prefixes: ["Checkov_CKV_CIRCLECIPIPELINES_"]
+  },
+  "GitLab CI": {
+    prefixes: ["Checkov_CKV_GITLABCI_"]
+  },
+  "Bitbucket Pipelines": {
+    prefixes: ["Checkov_CKV_BITBUCKETPIPELINES_"]
+  },
+  "Azure Pipelines": {
+    prefixes: ["Checkov_CKV_AZUREPIPELINES_"]
+  }
+};
 
 // src/metadata.ts
 var descriptor = {
@@ -12375,7 +12397,7 @@ var descriptor = {
   preferredVersion: "3.2.508",
   languages: ["JSON", "YAML", "Terraform"],
   filePatterns: ["**/*.tf", "**/*.yaml", "**/*.yml", "**/*.json", "**/Dockerfile"],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default
@@ -12399,16 +12421,35 @@ var CONFIG_FILE_CANDIDATES = [".checkov.yaml", ".checkov.yml"];
 var PIP_PACKAGE = "checkov==3.2.508";
 var BINARY = "checkov";
 var VERSION_REGEX = /(\d+\.\d+\.\d+)/;
-async function resolveBinaryPath(ctx) {
+var PYTHON_VERSION_RANGE = ">=3.9.0 <3.14.0";
+var MODULE_ARGS = ["-m", "checkov.main"];
+async function resolveCheckovInvocation(ctx) {
   const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, TOOL_ID);
+  const venvPython = (0, import_tooling.getVenvPaths)(venvDir).python;
+  if (await pathExists(venvPython)) {
+    return { command: venvPython, prefixArgs: MODULE_ARGS };
+  }
+  return { command: BINARY, prefixArgs: [] };
+}
+async function probeCheckovVersion(command, prefixArgs, logger) {
   try {
-    const venv = await (0, import_tooling.ensureVenv)((await (0, import_tooling.findPython)())?.path ?? "python3", venvDir);
-    const venvBin = (0, import_tooling.resolveVenvBinary)(venv, BINARY);
-    await import_promises.default.access(venvBin);
-    return venvBin;
+    const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(command, [...prefixArgs, "--version"], {
+      cwd: process.cwd(),
+      timeoutMs: 6e4,
+      logger
+    });
+    if (exitCode !== 0) return null;
+    const match = (stdout || stderr).match(VERSION_REGEX);
+    return match ? match[1] : null;
   } catch {
+    return null;
   }
-  return BINARY;
+}
+async function listDirSafe(dir) {
+  return import_promises.default.readdir(dir).catch(() => []);
+}
+async function pathExists(p) {
+  return import_promises.default.access(p).then(() => true).catch(() => false);
 }
 function buildEnv(ctx) {
   if (ctx.runner !== "container") return void 0;
@@ -12434,25 +12475,25 @@ var adapter = {
   prerequisites: [
     {
       name: "Python",
-      versionRange: ">=3.9.0",
+      versionRange: PYTHON_VERSION_RANGE,
       preferredVersion: "3.12.0",
       checkCommand: "python3 --version"
     }
   ],
   /**
-   * Checks whether the `checkov` binary is present and runnable.
+   * Checks whether checkov is present and runnable.
    *
    * Checks in order:
-   * 1. Codacy-managed venv (`~/.codacy/runtimes/Checkov/venv/bin/checkov`) -> installation: "codacy"
-   * 2. Global PATH (`checkov`) -> installation: "global"
+   * 1. Codacy-managed venv — `<venv>/python -m checkov.main --version` -> "codacy"
+   * 2. Global PATH — `checkov --version` -> "global"
    *
-   * Parses the version from `checkov --version` output using a version regex.
-   * Returns `available: false` (rather than throwing) if the binary is not
-   * found or returns a non-zero exit code.
+   * checkov is always invoked as a module (see {@link MODULE_ARGS}); its wheel
+   * ships no console-script, so on Windows there is no `checkov.exe` to probe.
+   * Returns `available: false` (rather than throwing) if checkov cannot be run.
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
-    const pythonInfo = await (0, import_tooling.findPython)(void 0, ctx.logger).catch(() => null);
+    const pythonInfo = await (0, import_tooling.findPython)(PYTHON_VERSION_RANGE, ctx.logger).catch(() => null);
     const dependencies = pythonInfo ? [
       {
         name: "Python",
@@ -12462,46 +12503,36 @@ var adapter = {
       }
     ] : [{ name: "Python", available: false, reason: "Python 3 not found" }];
     const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, TOOL_ID);
-    try {
-      if (pythonInfo) {
-        const venv = await (0, import_tooling.ensureVenv)(pythonInfo.path, venvDir, ctx.logger);
-        const version = await (0, import_tooling.checkVenvTool)(venv, BINARY, "--version", VERSION_REGEX, ctx.logger);
-        if (version) {
-          ctx.logger.debug("Checkov found in codacy venv", { toolId: TOOL_ID, version });
-          return {
-            available: true,
-            version,
-            path: (0, import_tooling.resolveVenvBinary)(venv, BINARY),
-            installation: "codacy",
-            dependencies
-          };
-        }
+    const venvPython = (0, import_tooling.getVenvPaths)(venvDir).python;
+    const venvPythonExists = await pathExists(venvPython);
+    if (venvPythonExists) {
+      const version = await probeCheckovVersion(venvPython, MODULE_ARGS, ctx.logger);
+      if (version) {
+        ctx.logger.debug("Checkov found in codacy venv", { toolId: TOOL_ID, version });
+        return {
+          available: true,
+          version,
+          path: venvPython,
+          installation: "codacy",
+          dependencies
+        };
       }
-    } catch {
     }
-    try {
-      const { stdout, exitCode } = await (0, import_tooling.spawnTool)(BINARY, ["--version"], {
-        cwd: process.cwd(),
-        logger: ctx.logger
-      });
-      if (exitCode === 0) {
-        const match = stdout.match(VERSION_REGEX);
-        if (match) {
-          ctx.logger.debug("Checkov found on global PATH", { toolId: TOOL_ID, version: match[1] });
-          return {
-            available: true,
-            version: match[1],
-            installation: "global",
-            dependencies
-          };
-        }
-      }
-    } catch {
+    const globalVersion = await probeCheckovVersion(BINARY, [], ctx.logger);
+    if (globalVersion) {
+      ctx.logger.debug("Checkov found on global PATH", { toolId: TOOL_ID, version: globalVersion });
+      return {
+        available: true,
+        version: globalVersion,
+        installation: "global",
+        dependencies
+      };
     }
-    ctx.logger.debug("Checkov not found", { toolId: TOOL_ID });
+    const reason = venvPythonExists ? `checkov could not be run via '${venvPython} -m checkov.main --version' (see debug logs); it may not be installed in the venv or the venv's Python may be incompatible` : "checkov not found in the Codacy venv or on PATH";
+    ctx.logger.debug("Checkov not found", { toolId: TOOL_ID, venvPython, venvPythonExists });
     return {
       available: false,
-      reason: "checkov binary not found in PATH or Codacy venv directory",
+      reason,
       installHint: "pip install checkov  # or\ncodacy-analysis analyze . --install-dependencies  # auto-install",
       dependencies
     };
@@ -12515,7 +12546,7 @@ var adapter = {
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
-    const pythonInfo = await (0, import_tooling.ensurePython)(ctx.globalDir, void 0, ctx.logger);
+    const pythonInfo = await (0, import_tooling.ensurePython)(ctx.globalDir, PYTHON_VERSION_RANGE, ctx.logger);
     if (!pythonInfo) {
       return {
         success: false,
@@ -12523,24 +12554,50 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "toolInstall",
           kind: "MissingPrerequisite",
-          message: "Python 3 could not be found or downloaded. Install Python 3.9+ or enable auto-install.",
+          message: "Python (>=3.9.0 <3.14.0) could not be found or downloaded. Checkov 3.2.x does not support Python 3.14+.",
           level: "error"
         }
       };
     }
     const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, TOOL_ID);
-    try {
-      ctx.logger.info(`Creating venv for Checkov at ${venvDir}...`);
+    const venvPython = (0, import_tooling.getVenvPaths)(venvDir).python;
+    const installIntoVenv = async () => {
       const venv = await (0, import_tooling.ensureVenv)(pythonInfo.path, venvDir, ctx.logger);
       ctx.logger.info(
         `Installing ${PIP_PACKAGE} (this may take several minutes due to ~200 transitive dependencies)...`
       );
       await (0, import_tooling.pipInstall)(venv, [PIP_PACKAGE], ctx.logger);
-      const installedPath = (0, import_tooling.resolveVenvBinary)(venv, BINARY);
-      ctx.logger.info(`Installed Checkov to ${installedPath}`);
+      return probeCheckovVersion(venv.python, MODULE_ARGS, ctx.logger);
+    };
+    try {
+      ctx.logger.info(`Creating venv for Checkov at ${venvDir}...`);
+      let version = await installIntoVenv();
+      if (!version) {
+        ctx.logger.warn(
+          `Checkov installed but 'python -m checkov.main' did not run; rebuilding the venv`,
+          { venvDir, binDirContents: await listDirSafe((0, import_tooling.getVenvPaths)(venvDir).binDir) }
+        );
+        await import_promises.default.rm(venvDir, { recursive: true, force: true }).catch(() => {
+        });
+        version = await installIntoVenv();
+      }
+      if (!version) {
+        const contents = await listDirSafe((0, import_tooling.getVenvPaths)(venvDir).binDir);
+        return {
+          success: false,
+          error: {
+            toolId: TOOL_ID,
+            phase: "toolInstall",
+            kind: "InstallError",
+            message: `Checkov install completed but 'python -m checkov.main --version' did not run in the venv (bin dir contains: ${contents.join(", ") || "nothing"}). The venv's Python may be incompatible with Checkov 3.2.x.`,
+            level: "error"
+          }
+        };
+      }
+      ctx.logger.info(`Installed Checkov ${version} to ${venvPython}`);
       return {
         success: true,
-        installedPath,
+        installedPath: venvPython,
         installedVersion: adapter.preferredVersion
       };
     } catch (err) {
@@ -12615,54 +12672,87 @@ var adapter = {
     if (ctx.targetFiles.length === 0) {
       return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
     }
-    let binary;
+    let command;
+    let prefixArgs;
     try {
-      binary = await resolveBinaryPath(ctx);
+      ({ command, prefixArgs } = await resolveCheckovInvocation(ctx));
     } catch {
-      binary = BINARY;
+      command = BINARY;
+      prefixArgs = [];
     }
-    const args = ["-o", "json", "--quiet"];
+    const baseArgs = [...prefixArgs, "-o", "json", "--quiet"];
     const useLocal = codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile;
     if (useLocal) {
-      args.push("--config-file", codacyConfig.localConfigurationFile);
-    }
-    for (const file of ctx.targetFiles) {
-      args.push("-f", import_path.default.resolve(ctx.repositoryRoot, file));
+      baseArgs.push("--config-file", codacyConfig.localConfigurationFile);
     }
+    const absoluteFiles = ctx.targetFiles.map((f) => import_path.default.resolve(ctx.repositoryRoot, f));
+    const fileChunks = (0, import_tooling.chunkFilesForArgv)(absoluteFiles);
     const env = buildEnv(ctx);
+    const frameworks = [];
     try {
-      const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
-        cwd: ctx.repositoryRoot,
-        env,
-        logger: ctx.logger
-      });
-      if (exitCode > 1) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "toolInvoke",
-          kind: "NonZeroExit",
-          message: `checkov exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
-          level: "error"
-        });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      if (!stdout.trim()) {
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(stdout);
-      } catch (err) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "outputParse",
-          kind: "MalformedOutput",
-          message: `Failed to parse checkov JSON output: ${err instanceof Error ? err.message : String(err)}`,
-          level: "error"
+      for (const chunk of fileChunks) {
+        const fileArgs = [];
+        for (const file of chunk) {
+          fileArgs.push("-f", file);
+        }
+        const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(command, [...baseArgs, ...fileArgs], {
+          cwd: ctx.repositoryRoot,
+          env,
+          logger: ctx.logger
         });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+        if (exitCode > 1) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "toolInvoke",
+            kind: "NonZeroExit",
+            message: `checkov exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+            level: "error"
+          });
+          return (0, import_tooling.buildResult)(
+            TOOL_ID,
+            startedAt,
+            /* @__PURE__ */ new Date(),
+            issues,
+            errors,
+            ctx.targetFiles.length
+          );
+        }
+        if (stderr && stderr.trim()) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "toolInvoke",
+            kind: "StderrWarning",
+            message: `checkov stderr: ${stderr.trim()}`,
+            level: "warning"
+          });
+        }
+        if (!stdout.trim()) continue;
+        let parsed;
+        try {
+          parsed = JSON.parse(stdout);
+        } catch (err) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "outputParse",
+            kind: "MalformedOutput",
+            message: `Failed to parse checkov JSON output: ${err instanceof Error ? err.message : String(err)}`,
+            level: "error"
+          });
+          return (0, import_tooling.buildResult)(
+            TOOL_ID,
+            startedAt,
+            /* @__PURE__ */ new Date(),
+            issues,
+            errors,
+            ctx.targetFiles.length
+          );
+        }
+        if (Array.isArray(parsed)) {
+          frameworks.push(...parsed);
+        } else {
+          frameworks.push(parsed);
+        }
       }
-      const frameworks = Array.isArray(parsed) ? parsed : [parsed];
       const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
       const targetFilesSet = new Set(ctx.targetFiles);
       const linesCache = /* @__PURE__ */ new Map();
@@ -12716,15 +12806,6 @@ var adapter = {
           issues.push(issue);
         }
       }
-      if (stderr && stderr.trim()) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "toolInvoke",
-          kind: "StderrWarning",
-          message: `checkov stderr: ${stderr.trim()}`,
-          level: "warning"
-        });
-      }
     } catch (err) {
       errors.push({
         toolId: TOOL_ID,

package/dist/metadata.js

@@ -25,7 +25,29 @@ __export(metadata_exports, {
 module.exports = __toCommonJS(metadata_exports);
 
 // src/pattern-mappings.json
-var pattern_mappings_default = {};
+var pattern_mappings_default = {
+  Dockerfile: {
+    prefixes: ["Checkov_CKV_DOCKER_", "Checkov_CKV2_DOCKER_"]
+  },
+  Terraform: {
+    prefixes: ["Checkov_CKV_TF_"]
+  },
+  "GitHub Actions": {
+    prefixes: ["Checkov_CKV_GHA_", "Checkov_CKV2_GHA_"]
+  },
+  CircleCI: {
+    prefixes: ["Checkov_CKV_CIRCLECIPIPELINES_"]
+  },
+  "GitLab CI": {
+    prefixes: ["Checkov_CKV_GITLABCI_"]
+  },
+  "Bitbucket Pipelines": {
+    prefixes: ["Checkov_CKV_BITBUCKETPIPELINES_"]
+  },
+  "Azure Pipelines": {
+    prefixes: ["Checkov_CKV_AZUREPIPELINES_"]
+  }
+};
 
 // src/metadata.ts
 var descriptor = {
@@ -34,7 +56,7 @@ var descriptor = {
   preferredVersion: "3.2.508",
   languages: ["JSON", "YAML", "Terraform"],
   filePatterns: ["**/*.tf", "**/*.yaml", "**/*.yml", "**/*.json", "**/Dockerfile"],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-checkov-3",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Checkov adapter — CLI-mode IaC security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.14.0"
+    "@codacy/tooling": "0.16.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",