Skip to main content

Checkov

Latest release checkov 0.1.1

Scan each unit's plan for policy violations with Checkov

Usage​

repository {
  after_hook "checkov" {
    commands = ["plan"]
    execute  = ["pipelines", "hook", "checkov@v0.1"]
  }
}

Inputs​

Configure inputs in the hook's env block.

Optional

VariableDescription
PIPELINES_HOOK_CHECKOV_CLI_VERSIONCheckov version to install and run. Defaults to 3.3.16.
PIPELINES_HOOK_CHECKOV_DENY_CHECKSCheck ids that deny the change, as in CKV_AWS_23. Globs allowed, as in CKV_AWS_*. Every id is listed in the Checkov policy index at https://www.checkov.io/5.Policy%20Index/all.html, and each finding this hook reports names the id it failed.
PIPELINES_HOOK_CHECKOV_WARN_CHECKSCheck ids that warn about the change, as in CKV_AWS_23. Globs allowed, as in CKV_AWS_*. Every id is listed in the Checkov policy index at https://www.checkov.io/5.Policy%20Index/all.html, and each finding this hook reports names the id it failed.
PIPELINES_HOOK_CHECKOV_LOG_LEVELLog verbosity. A more verbose PIPELINES_LOG_LEVEL overrides it. One of trace, debug, info, warning, error, fatal, panic. Defaults to info.