@codacy/tools-checkov-3 0.18.0 → 0.19.0

package/README.md

@@ -19,7 +19,7 @@ Infrastructure-as-Code security scanner using the [Checkov](https://www.checkov.
 | Tool ID           | `Checkov`                                                        |
 | Codacy UUID       | `13af9d89-1ce5-4fec-a168-765c3e7b26b3`                           |
 | Strategy          | CLI                                                              |
-| Languages         | JSON, YAML, Terraform                                            |
+| Languages         | JSON, YAML, Terraform, Dockerfile                                |
 | Binary            | `checkov` (Python package)                                       |
 | File patterns     | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
 | Pattern count     | ~1,358                                                           |
@@ -68,9 +68,16 @@ pnpm test
 - **Pattern filtering**: Uses `--check CKV_xxx,CKV_yyy,...` to run only specific checks. The `Checkov_` prefix is stripped from pattern IDs to get the raw check ID.
 - **Config files**: Looks for `.checkov.yaml` or `.checkov.yml`. When local config is active, passes `--config-file <path>`.
 - **Parsing errors**: Checkov reports `parsing_errors` in its JSON output, which are surfaced as `AnalysisError` objects with `kind: "ParsingError"`.
-- **Preset mappings (`src/pattern-mappings.json`)**: gates 54 of the 1,358 patterns on a detected preset (Dockerfile, Terraform, GitHub Actions, CircleCI, GitLab CI, Bitbucket Pipelines, Azure Pipelines), so `init --auto` doesn't enable e.g. GitHub Actions checks in a repo with no `.github/workflows/`. The remaining 1,304 patterns stay universal (enabled everywhere) until their detection story is solved — this is deliberately conservative rather than approximate:
-  - `"Terraform"` maps **only** `CKV_TF_` (2 patterns — Terraform module-source hygiene, e.g. "use a commit hash"). The much larger cloud-provider families (`CKV_AWS_` 384, `CKV_AZURE_` 247, `CKV_GCP_` 124, and 12 smaller clouds — ~1,091 patterns total) are **not** Terraform-specific: Checkov evaluates the same resource-policy checks against CloudFormation/ARM/Bicep/Serverless Framework templates too (plain YAML/JSON, no `.tf` file involved) — confirmed by Codacy's own pattern metadata, where every single pattern carries the identical `languages: ["JSON", "YAML", "Terraform"]`. Gating them on `.tf` presence would silently drop all cloud checks for a CloudFormation/ARM/Serverless-only repo — a real false negative, not just noise the old universal behavior already had. They stay universal until discovery can recognize those other IaC formats too.
-  - Each CI platform also has a **second**, easily-confused prefix family for that platform's repo/org governance settings as managed via its own Terraform provider (e.g. `CKV_GIT_`/`CKV_GITHUB_` vs. the mapped `CKV_GHA_`; `CKV_GLB_`/`CKV_GITLAB_` vs. the mapped `CKV_GITLABCI_`). Those governance patterns need Terraform-provider-content parsing, not file presence, so they're intentionally left out of the mapping (40 patterns, universal for now).
-  - `CKV_K8S_`/`CKV2_K8S_`/`CKV_ARGO_` (121 patterns) are also left out — a bare Kubernetes manifest needs YAML content-sniffing (`apiVersion`/`kind`), not just a `.yaml` extension.
-  - `CKV_ANSIBLE_`/`CKV2_ANSIBLE_` (12) and `CKV_OPENAPI_` (21) are left out too — there's no Ansible-playbook or OpenAPI/AsyncAPI-spec detector in `discover()` at all yet.
-  - `CKV_SECRET_` (18) and `CKV_BCW_` (1) are excluded from every preset by design and stay universal — secret-scanning shouldn't be suppressed by any framework gate.
+- **Preset mappings (`src/pattern-mappings.json`)**: gates 1,278 of the 1,358 patterns on a detected IaC framework, so `init --auto` doesn't enable AWS resource policy in a repo with no infrastructure. Measured effect: a repo with only a `package.json` went from 1,225 enabled Checkov patterns to 80.
+
+  The gate is **per IaC framework, not per cloud**, because a cloud resource can be declared several ways — the same bucket is an `aws_s3_bucket` in Terraform, an `AWS::S3::Bucket` in CloudFormation and a `resources:` block under Serverless. `filterAutoPatterns` enables a framework pattern when **any** of its keys was detected, so the same prefix is listed under several keys to mean "AWS resources, however they are declared". That OR is what makes gating safe here; an earlier revision left all ~1,091 cloud-provider checks universal precisely because gating them on `.tf` alone would have dropped every cloud check for a CloudFormation-only repo.
+  - `"lang:Terraform"` maps `CKV_TF_` plus every cloud-provider family (`CKV_AWS_`, `CKV_AZURE_`, `CKV_GCP_`, and the 10 smaller clouds). No file signal is needed: `.tf` **is** the `Terraform` language, so `lang:Terraform` already means "this repo has Terraform".
+  - `cloudformation` and `serverless-framework` also claim `CKV_AWS_`/`CKV2_AWS_`; `bicep` also claims `CKV_AZURE_`/`CKV2_AZURE_`. Detected by file signal (`samconfig.*`, a root `template.yaml`, a `cloudformation/` directory, `serverless.yml`, `*.bicep`).
+  - `kubernetes` and `helm` both claim `CKV_K8S_`/`CKV2_K8S_`/`CKV_ARGO_` — a chart's templates render to manifests, so either is evidence. Detected from `kustomization.yaml` / `Chart.yaml`.
+  - `ansible` claims `CKV_ANSIBLE_`/`CKV2_ANSIBLE_`, from `ansible.cfg` or the `roles/<name>/tasks/main.yml` layout.
+  - **Still universal (80 patterns), each for a stated reason:**
+    - `CKV_SECRET_` (18) and `CKV_BCW_` (1) by design — secret scanning must not be suppressed by any framework gate.
+    - `CKV_OPENAPI_` (21) — an OpenAPI/AsyncAPI document identifies itself by its `openapi:`/`swagger:` key, which a path-only signal cannot see. Needs the content probe.
+    - The VCS governance families `CKV_GITHUB_` (26), `CKV_GIT_` (7), `CKV_GLB_` (4), `CKV_GITLAB_`, `CKV_BITBUCKET_`, `CKV2_ADO_` (1 each). These are **unresolved, not deferred**: their titles read as platform/API settings (Checkov's `github_configuration` framework, which reads API data and cannot fire on a filesystem scan), while an earlier reading of this file recorded them as governance resources managed through each platform's _Terraform provider_ — in which case they belong under `lang:Terraform`. The two readings imply opposite fixes (prune vs. gate), so they are left untouched until checked against Checkov's own framework declarations.
+  - **Known gap:** a bare Kubernetes manifest (`k8s/deployment.yaml`) or a bare CloudFormation template is still not detected — only the conventional shells around them are. Both declare themselves in their content, so closing this needs a bounded content probe (`apiVersion:`, `AWSTemplateFormatVersion`), which is not implemented.
+  - **Known gap (upstream):** most patterns carry `languages: ["JSON", "YAML", "Terraform"]`, which is the _tool-level fallback_ Codacy's API returns for a pattern with no per-pattern languages — not a claim about the check. It over-declares (JSON is why Checkov is selected almost everywhere) and under-declares (only 6 of 28 `CKV_DOCKER_` checks list `Dockerfile`, so 22 are dropped by the language filter in a Dockerfile-only repo). The durable fix is in the cloud tool definition; see `todo-checkov-languages.md`.

package/dist/index.js

@@ -12367,25 +12367,62 @@ var patterns_default = [
 
 // src/pattern-mappings.json
 var pattern_mappings_default = {
-  Dockerfile: {
+  "lang:Dockerfile": {
     prefixes: ["Checkov_CKV_DOCKER_", "Checkov_CKV2_DOCKER_"]
   },
-  Terraform: {
-    prefixes: ["Checkov_CKV_TF_"]
-  },
-  "GitHub Actions": {
+  "lang:Terraform": {
+    prefixes: [
+      "Checkov_CKV_TF_",
+      "Checkov_CKV_AWS_",
+      "Checkov_CKV2_AWS_",
+      "Checkov_CKV_AZURE_",
+      "Checkov_CKV2_AZURE_",
+      "Checkov_CKV_GCP_",
+      "Checkov_CKV2_GCP_",
+      "Checkov_CKV_ALI_",
+      "Checkov_CKV_OCI_",
+      "Checkov_CKV2_OCI_",
+      "Checkov_CKV2_IBM_",
+      "Checkov_CKV_NCP_",
+      "Checkov_CKV_YC_",
+      "Checkov_CKV_TC_",
+      "Checkov_CKV_PAN_",
+      "Checkov_CKV_LIN_",
+      "Checkov_CKV_DIO_",
+      "Checkov_CKV_OPENSTACK_"
+    ]
+  },
+  cloudformation: {
+    prefixes: ["Checkov_CKV_AWS_", "Checkov_CKV2_AWS_"]
+  },
+  "serverless-framework": {
+    prefixes: ["Checkov_CKV_AWS_", "Checkov_CKV2_AWS_"]
+  },
+  bicep: {
+    prefixes: ["Checkov_CKV_AZURE_", "Checkov_CKV2_AZURE_"]
+  },
+  kubernetes: {
+    prefixes: ["Checkov_CKV_K8S_", "Checkov_CKV2_K8S_", "Checkov_CKV_ARGO_"]
+  },
+  helm: {
+    prefixes: ["Checkov_CKV_K8S_", "Checkov_CKV2_K8S_", "Checkov_CKV_ARGO_"]
+  },
+  ansible: {
+    prefixes: ["Checkov_CKV_ANSIBLE_", "Checkov_CKV2_ANSIBLE_"]
+  },
+  "github-actions": {
     prefixes: ["Checkov_CKV_GHA_", "Checkov_CKV2_GHA_"]
   },
-  CircleCI: {
+  circleci: {
     prefixes: ["Checkov_CKV_CIRCLECIPIPELINES_"]
   },
-  "GitLab CI": {
+  "gitlab-ci": {
     prefixes: ["Checkov_CKV_GITLABCI_"]
   },
-  "Bitbucket Pipelines": {
+  "bitbucket-pipelines": {
     prefixes: ["Checkov_CKV_BITBUCKETPIPELINES_"]
   },
-  "Azure Pipelines": {
+  "azure-pipelines": {
     prefixes: ["Checkov_CKV_AZUREPIPELINES_"]
   }
 };
@@ -12395,7 +12432,13 @@ var descriptor = {
   id: "Checkov",
   displayName: "Checkov",
   preferredVersion: "3.2.508",
-  languages: ["JSON", "YAML", "Terraform"],
+  // `Dockerfile` is not in the tool-level language list Codacy's API reports, but
+  // Checkov ships 28 `CKV_DOCKER_` checks and `filePatterns` already routes
+  // Dockerfiles here. Without it, a Dockerfile-only repo detects only the
+  // `Dockerfile` language, the language gate finds no overlap, and Checkov is not
+  // selected at all — so the entire Docker ruleset is dropped from exactly the
+  // repo it was written for.
+  languages: ["JSON", "YAML", "Terraform", "Dockerfile"],
   filePatterns: ["**/*.tf", "**/*.yaml", "**/*.yml", "**/*.json", "**/Dockerfile"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],

package/dist/metadata.js

@@ -26,25 +26,62 @@ module.exports = __toCommonJS(metadata_exports);
 
 // src/pattern-mappings.json
 var pattern_mappings_default = {
-  Dockerfile: {
+  "lang:Dockerfile": {
     prefixes: ["Checkov_CKV_DOCKER_", "Checkov_CKV2_DOCKER_"]
   },
-  Terraform: {
-    prefixes: ["Checkov_CKV_TF_"]
+  "lang:Terraform": {
+    prefixes: [
+      "Checkov_CKV_TF_",
+      "Checkov_CKV_AWS_",
+      "Checkov_CKV2_AWS_",
+      "Checkov_CKV_AZURE_",
+      "Checkov_CKV2_AZURE_",
+      "Checkov_CKV_GCP_",
+      "Checkov_CKV2_GCP_",
+      "Checkov_CKV_ALI_",
+      "Checkov_CKV_OCI_",
+      "Checkov_CKV2_OCI_",
+      "Checkov_CKV2_IBM_",
+      "Checkov_CKV_NCP_",
+      "Checkov_CKV_YC_",
+      "Checkov_CKV_TC_",
+      "Checkov_CKV_PAN_",
+      "Checkov_CKV_LIN_",
+      "Checkov_CKV_DIO_",
+      "Checkov_CKV_OPENSTACK_"
+    ]
   },
-  "GitHub Actions": {
+  cloudformation: {
+    prefixes: ["Checkov_CKV_AWS_", "Checkov_CKV2_AWS_"]
+  },
+  "serverless-framework": {
+    prefixes: ["Checkov_CKV_AWS_", "Checkov_CKV2_AWS_"]
+  },
+  bicep: {
+    prefixes: ["Checkov_CKV_AZURE_", "Checkov_CKV2_AZURE_"]
+  },
+  kubernetes: {
+    prefixes: ["Checkov_CKV_K8S_", "Checkov_CKV2_K8S_", "Checkov_CKV_ARGO_"]
+  },
+  helm: {
+    prefixes: ["Checkov_CKV_K8S_", "Checkov_CKV2_K8S_", "Checkov_CKV_ARGO_"]
+  },
+  ansible: {
+    prefixes: ["Checkov_CKV_ANSIBLE_", "Checkov_CKV2_ANSIBLE_"]
+  },
+  "github-actions": {
     prefixes: ["Checkov_CKV_GHA_", "Checkov_CKV2_GHA_"]
   },
-  CircleCI: {
+  circleci: {
     prefixes: ["Checkov_CKV_CIRCLECIPIPELINES_"]
   },
-  "GitLab CI": {
+  "gitlab-ci": {
     prefixes: ["Checkov_CKV_GITLABCI_"]
   },
-  "Bitbucket Pipelines": {
+  "bitbucket-pipelines": {
     prefixes: ["Checkov_CKV_BITBUCKETPIPELINES_"]
   },
-  "Azure Pipelines": {
+  "azure-pipelines": {
     prefixes: ["Checkov_CKV_AZUREPIPELINES_"]
   }
 };
@@ -54,7 +91,13 @@ var descriptor = {
   id: "Checkov",
   displayName: "Checkov",
   preferredVersion: "3.2.508",
-  languages: ["JSON", "YAML", "Terraform"],
+  // `Dockerfile` is not in the tool-level language list Codacy's API reports, but
+  // Checkov ships 28 `CKV_DOCKER_` checks and `filePatterns` already routes
+  // Dockerfiles here. Without it, a Dockerfile-only repo detects only the
+  // `Dockerfile` language, the language gate finds no overlap, and Checkov is not
+  // selected at all — so the entire Docker ruleset is dropped from exactly the
+  // repo it was written for.
+  languages: ["JSON", "YAML", "Terraform", "Dockerfile"],
   filePatterns: ["**/*.tf", "**/*.yaml", "**/*.yml", "**/*.json", "**/Dockerfile"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-checkov-3",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Checkov adapter — CLI-mode IaC security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.18.0"
+    "@codacy/tooling": "0.19.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",