@codacy/tools-checkov-3 0.20.0 → 0.22.0

package/README.md

@@ -22,7 +22,7 @@ Infrastructure-as-Code security scanner using the [Checkov](https://www.checkov.
 | Languages         | JSON, YAML, Terraform, Dockerfile                                |
 | Binary            | `checkov` (Python package)                                       |
 | File patterns     | `**/*.tf`, `**/*.yaml`, `**/*.yml`, `**/*.json`, `**/Dockerfile` |
-| Pattern count     | ~1,358                                                           |
+| Pattern count     | ~1,359                                                           |
 | Pattern ID format | `Checkov_{check_id}` (e.g. `Checkov_CKV_AWS_41`)                 |
 
 ## Updating patterns
@@ -47,7 +47,7 @@ git add src/patterns.json
 
 ```bash
 # Install checkov locally (requires Python 3.9+)
-pip install checkov==3.2.508
+pip install checkov==3.3.8
 
 # Build with tsup
 pnpm build
@@ -68,7 +68,7 @@ pnpm test
 - **Pattern filtering**: Uses `--check CKV_xxx,CKV_yyy,...` to run only specific checks. The `Checkov_` prefix is stripped from pattern IDs to get the raw check ID.
 - **Config files**: Looks for `.checkov.yaml` or `.checkov.yml`. When local config is active, passes `--config-file <path>`.
 - **Parsing errors**: Checkov reports `parsing_errors` in its JSON output, which are surfaced as `AnalysisError` objects with `kind: "ParsingError"`.
-- **Preset mappings (`src/pattern-mappings.json`)**: gates 1,278 of the 1,358 patterns on a detected IaC framework, so `init --auto` doesn't enable AWS resource policy in a repo with no infrastructure. Measured effect: a repo with only a `package.json` went from 1,225 enabled Checkov patterns to 80.
+- **Preset mappings (`src/pattern-mappings.json`)**: gates 1,279 of the 1,359 patterns on a detected IaC framework, so `init --auto` doesn't enable AWS resource policy in a repo with no infrastructure. Measured effect: a repo with only a `package.json` went from 1,225 enabled Checkov patterns to 80.
 
   The gate is **per IaC framework, not per cloud**, because a cloud resource can be declared several ways — the same bucket is an `aws_s3_bucket` in Terraform, an `AWS::S3::Bucket` in CloudFormation and a `resources:` block under Serverless. `filterAutoPatterns` enables a framework pattern when **any** of its keys was detected, so the same prefix is listed under several keys to mean "AWS resources, however they are declared". That OR is what makes gating safe here; an earlier revision left all ~1,091 cloud-provider checks universal precisely because gating them on `.tf` alone would have dropped every cloud check for a CloudFormation-only repo.
   - `"lang:Terraform"` maps `CKV_TF_` plus every cloud-provider family (`CKV_AWS_`, `CKV_AZURE_`, `CKV_GCP_`, and the 10 smaller clouds). No file signal is needed: `.tf` **is** the `Terraform` language, so `lang:Terraform` already means "this repo has Terraform".