{
  "id": "checkov",
  "name": "Checkov",
  "homepage": "https://www.checkov.io",
  "description": "A static code analysis tool for infrastructure as code (IaC), and a software composition analysis (SCA) tool for images and open source packages.",
  "icon": "https://www.checkov.io/assets/img/favicon.png",
  "executables": [
    "checkov"
  ],
  "dotfiles": {
    "paths": [
      "~/.checkov.yaml",
      "~/.checkov.yml"
    ],
    "exclude": [],
    "secret": [
      "~/.bridgecrew/credentials"
    ],
    "side_effect": false,
    "secret_paths": [
      {
        "file": [
          "~/.checkov.yaml",
          "~/.checkov.yml"
        ],
        "match": {
          "key_path": [
            "bc-api-key"
          ]
        }
      }
    ]
  },
  "commands": {
    "format": 1,
    "label": "Scan infrastructure code",
    "description": "Scan a directory or file of infrastructure-as-code for misconfigurations. Platform (Bridgecrew/Prisma) API options and secrets scanning are left out.",
    "quality": "ai-draft",
    "base": "fig:checkov",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "source": [
      {
        "id": "fig",
        "kind": "completion",
        "url": "https://github.com/withfig/autocomplete/blob/master/src/checkov.ts",
        "license": "MIT"
      }
    ],
    "field": [
      {
        "id": "directory",
        "label": "Directory",
        "description": "IaC root directory (cannot be used together with --file).",
        "type": "path",
        "option": [
          "--directory",
          "-d"
        ],
        "path": {
          "kind": "directory",
          "role": "input",
          "must_exist": true
        },
        "sources": [
          "fig"
        ]
      },
      {
        "id": "file",
        "label": "File",
        "description": "IaC file (cannot be used together with --directory).",
        "type": "path",
        "option": [
          "--file",
          "-f"
        ],
        "path": {
          "kind": "file",
          "role": "input",
          "must_exist": true
        },
        "sources": [
          "fig"
        ]
      },
      {
        "id": "framework",
        "label": "Framework",
        "description": "Frameworks to scan, e.g. terraform, kubernetes.",
        "type": "string",
        "option": [
          "--framework"
        ],
        "multiple": true,
        "suggestions": [
          {
            "value": "arm",
            "label": "arm"
          },
          {
            "value": "cloudformation",
            "label": "cloudformation"
          },
          {
            "value": "dockerfile",
            "label": "dockerfile"
          },
          {
            "value": "github_configuration",
            "label": "github_configuration"
          },
          {
            "value": "gitlab_configuration",
            "label": "gitlab_configuration"
          },
          {
            "value": "helm",
            "label": "helm"
          },
          {
            "value": "json",
            "label": "json"
          },
          {
            "value": "kubernetes",
            "label": "kubernetes"
          },
          {
            "value": "kustomize",
            "label": "kustomize"
          }
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "output",
        "label": "Output format",
        "description": "Report output format.",
        "type": "string",
        "option": [
          "--output",
          "-o"
        ],
        "suggestions": [
          {
            "value": "cli",
            "label": "cli"
          },
          {
            "value": "cyclonedx",
            "label": "cyclonedx"
          },
          {
            "value": "json",
            "label": "json"
          },
          {
            "value": "junitxml",
            "label": "junitxml"
          },
          {
            "value": "github_failed_only",
            "label": "github_failed_only"
          },
          {
            "value": "sarif",
            "label": "sarif"
          }
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "check",
        "label": "Only these checks",
        "description": "Run only specific check IDs, comma separated.",
        "type": "string",
        "option": [
          "--check",
          "-c"
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "skip_check",
        "label": "Skip checks",
        "description": "Run all checks except these IDs, comma separated.",
        "type": "string",
        "option": [
          "--skip-check"
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "skip_path",
        "label": "Skip path",
        "description": "Path (file or directory) to skip, using regular expression logic.",
        "type": "string",
        "option": [
          "--skip-path"
        ],
        "multiple": true,
        "sources": [
          "fig"
        ]
      },
      {
        "id": "quiet",
        "label": "Failed checks only",
        "description": "CLI output, display only failed checks.",
        "type": "boolean",
        "option": [
          "--quiet"
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "compact",
        "label": "No code blocks",
        "description": "CLI output, do not display code blocks.",
        "type": "boolean",
        "option": [
          "--compact"
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "soft_fail",
        "label": "Soft fail",
        "description": "Runs checks but suppresses the error code.",
        "type": "boolean",
        "option": [
          "--soft-fail",
          "-s"
        ],
        "sources": [
          "fig"
        ]
      },
      {
        "id": "baseline",
        "label": "Baseline",
        "description": "Use a .checkov.baseline file to report only new failures.",
        "type": "path",
        "option": [
          "--baseline"
        ],
        "path": {
          "kind": "file",
          "role": "input",
          "must_exist": true
        },
        "sources": [
          "fig"
        ]
      },
      {
        "id": "list",
        "label": "List checks",
        "description": "List checks instead of scanning.",
        "type": "boolean",
        "option": [
          "--list",
          "-l"
        ],
        "sources": [
          "fig"
        ]
      }
    ],
    "task": [
      {
        "id": "dir",
        "label": "Scan a directory",
        "fields": [
          "directory",
          "framework",
          "quiet"
        ],
        "required": [
          "directory"
        ]
      },
      {
        "id": "file",
        "label": "Scan one file",
        "fields": [
          "file",
          "output"
        ],
        "required": [
          "file"
        ]
      },
      {
        "id": "ci",
        "label": "CI JSON report",
        "set": {
          "output": [
            "json"
          ],
          "quiet": [
            true
          ]
        },
        "fields": [
          "directory",
          "output",
          "quiet",
          "soft_fail"
        ],
        "required": [
          "directory"
        ]
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "directory",
          "file",
          "framework",
          "output",
          "check",
          "quiet"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "skip_path",
          "soft_fail",
          "baseline",
          "list",
          "compact",
          "skip_check"
        ]
      }
    ]
  }
}