@codacy/tools-checkov-3

Table of Contents

• Overview
• Updating patterns
• Updating the Checkov version
• Development
• Notes for maintainers

Overview

Infrastructure-as-Code security scanner using the Checkov binary. Scans Terraform, CloudFormation, Kubernetes, Dockerfile, and many other IaC frameworks for security misconfigurations. Uses the CLI execution strategy with Python/pip installation into an isolated virtual environment.

| Property | Value | |----------|-------| | Tool ID | Checkov | | Codacy UUID | 13af9d89-1ce5-4fec-a168-765c3e7b26b3 | | Strategy | CLI | | Languages | JSON, YAML, Terraform | | Binary | checkov (Python package) | | File patterns | **/*.tf, **/*.yaml, **/*.yml, **/*.json, **/Dockerfile | | Pattern count | ~1,358 | | Pattern ID format | Checkov_{check_id} (e.g. Checkov_CKV_AWS_41) |

Updating patterns

# Re-fetch pattern metadata from the Codacy API
pnpm prefetch

# Commit the result
git add src/patterns.json

Updating the Checkov version

1. Update preferredVersion in src/adapter.ts
2. Update the PIP_PACKAGE constant in src/adapter.ts (e.g. checkov==3.2.510)
3. Run pnpm prefetch to refresh patterns (new versions may add checks)
4. Run pnpm test to verify compatibility
5. Consider creating a new package (checkov-4/) if the major version changes

Development

# Install checkov locally (requires Python 3.9+)
pip install checkov==3.2.508

# Build with tsup
pnpm build

# Run tests (skips binary-dependent tests if checkov is not installed)
pnpm test

Notes for maintainers

• Large pip install: Checkov has ~200 transitive dependencies (pydantic, boto3 stubs, networkx, etc.). First install into the venv can take several minutes. Subsequent runs use the cached venv.
• Per-tool venv isolation: The adapter installs Checkov into ~/.codacy/runtimes/Checkov/venv/ to avoid dependency conflicts with other Python-based tools.
• Multi-framework JSON output: Checkov can emit a single JSON object or an array of objects (one per framework). The adapter normalizes both to an array before parsing.
• Path normalization: repo_file_path from Checkov always has a leading / which must be stripped.
• No column information: Checkov does not provide column numbers. All issues use column: 1.
• Exit codes: Exit code 0 = no issues, 1 = issues found (normal), >1 = genuine error.
• Container mode network blocking: In container mode (ctx.runner === "container"), the adapter sets proxy env vars and RENDER_EDGES_DUPLICATE_ITER_COUNT=50 to block Bridgecrew API calls and tune performance.
• Pattern filtering: Uses --check CKV_xxx,CKV_yyy,... to run only specific checks. The Checkov_ prefix is stripped from pattern IDs to get the raw check ID.
• Config files: Looks for .checkov.yaml or .checkov.yml. When local config is active, passes --config-file <path>.
• Parsing errors: Checkov reports parsing_errors in its JSON output, which are surfaced as AnalysisError objects with kind: "ParsingError".