id = "checkov"
name = "Checkov"
homepage = "https://www.checkov.io"
description = "A static code analysis tool for infrastructure as code (IaC), and a software composition analysis (SCA) tool for images and open source packages."
icon = "https://www.checkov.io/assets/img/favicon.png"
executables = ["checkov"]
[dotfiles]
paths = ["~/.checkov.yaml", "~/.checkov.yml"]
exclude = []
secret = ["~/.bridgecrew/credentials"]
side_effect = false
[[dotfiles.secret_paths]]
file = ["~/.checkov.yaml", "~/.checkov.yml"]
match = { key_path = ["bc-api-key"] }
[commands]
format = 1
label = "Scan infrastructure code"
description = "Scan a directory or file of infrastructure-as-code for misconfigurations. Platform (Bridgecrew/Prisma) API options and secrets scanning are left out."
quality = "ai-draft"
base = "fig:checkov"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }
[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/checkov.ts"
license = "MIT"
[[commands.field]]
id = "directory"
label = "Directory"
description = "IaC root directory (cannot be used together with --file)."
type = "path"
option = ["--directory", "-d"]
path = { kind = "directory", role = "input", must_exist = true }
sources = ["fig"]
[[commands.field]]
id = "file"
label = "File"
description = "IaC file (cannot be used together with --directory)."
type = "path"
option = ["--file", "-f"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]
[[commands.field]]
id = "framework"
label = "Framework"
description = "Frameworks to scan, e.g. terraform, kubernetes."
type = "string"
option = ["--framework"]
multiple = true
suggestions = [{ value = "arm", label = "arm" }, { value = "cloudformation", label = "cloudformation" }, { value = "dockerfile", label = "dockerfile" }, { value = "github_configuration", label = "github_configuration" }, { value = "gitlab_configuration", label = "gitlab_configuration" }, { value = "helm", label = "helm" }, { value = "json", label = "json" }, { value = "kubernetes", label = "kubernetes" }, { value = "kustomize", label = "kustomize" }]
sources = ["fig"]
[[commands.field]]
id = "output"
label = "Output format"
description = "Report output format."
type = "string"
option = ["--output", "-o"]
suggestions = [{ value = "cli", label = "cli" }, { value = "cyclonedx", label = "cyclonedx" }, { value = "json", label = "json" }, { value = "junitxml", label = "junitxml" }, { value = "github_failed_only", label = "github_failed_only" }, { value = "sarif", label = "sarif" }]
sources = ["fig"]
[[commands.field]]
id = "check"
label = "Only these checks"
description = "Run only specific check IDs, comma separated."
type = "string"
option = ["--check", "-c"]
sources = ["fig"]
[[commands.field]]
id = "skip_check"
label = "Skip checks"
description = "Run all checks except these IDs, comma separated."
type = "string"
option = ["--skip-check"]
sources = ["fig"]
[[commands.field]]
id = "skip_path"
label = "Skip path"
description = "Path (file or directory) to skip, using regular expression logic."
type = "string"
option = ["--skip-path"]
multiple = true
sources = ["fig"]
[[commands.field]]
id = "quiet"
label = "Failed checks only"
description = "CLI output, display only failed checks."
type = "boolean"
option = ["--quiet"]
sources = ["fig"]
[[commands.field]]
id = "compact"
label = "No code blocks"
description = "CLI output, do not display code blocks."
type = "boolean"
option = ["--compact"]
sources = ["fig"]
[[commands.field]]
id = "soft_fail"
label = "Soft fail"
description = "Runs checks but suppresses the error code."
type = "boolean"
option = ["--soft-fail", "-s"]
sources = ["fig"]
[[commands.field]]
id = "baseline"
label = "Baseline"
description = "Use a .checkov.baseline file to report only new failures."
type = "path"
option = ["--baseline"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]
[[commands.field]]
id = "list"
label = "List checks"
description = "List checks instead of scanning."
type = "boolean"
option = ["--list", "-l"]
sources = ["fig"]
[[commands.task]]
id = "dir"
label = "Scan a directory"
fields = ["directory", "framework", "quiet"]
required = ["directory"]
[[commands.task]]
id = "file"
label = "Scan one file"
fields = ["file", "output"]
required = ["file"]
[[commands.task]]
id = "ci"
label = "CI JSON report"
set = { output = ["json"], quiet = [true] }
fields = ["directory", "output", "quiet", "soft_fail"]
required = ["directory"]
[[commands.group]]
id = "basic"
label = "Basic"
fields = ["directory", "file", "framework", "output", "check", "quiet"]
[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["skip_path", "soft_fail", "baseline", "list", "compact", "skip_check"]
