id       = "checkov"
name     = "Checkov"
homepage = "https://www.checkov.io"
description = "A static code analysis tool for infrastructure as code (IaC), and a software composition analysis (SCA) tool for images and open source packages."
# The mark from checkov.io's favicon; the logos in the repository are wordmarks.
icon     = "https://www.checkov.io/assets/img/favicon.png"
executables   = ["checkov"]

[dotfiles]

# checkov/common/util/config_utils.py returns
# `[dir/.checkov.yaml, dir/.checkov.yml]` for the --directory argument, the
# current working directory and `Path.home()`, in that order. The home copy is
# the user-level one.
paths = ["~/.checkov.yaml", "~/.checkov.yml"]

exclude = []

# checkov/common/bridgecrew/platform_key.py: `bridgecrew_file =
# f"{home}/.bridgecrew/credentials"`, and persist_key() writes the raw API key
# into it. The whole file is the key.
secret = ["~/.bridgecrew/credentials"]

side_effect = false

# `--create-config` writes the current flags out as YAML, so a run that passed
# --bc-api-key leaves the platform key in the config file. Keys are the long
# option names without the dashes, as configargparse's YAMLConfigFileParser
# reads them.
[[dotfiles.secret_paths]]
file  = ["~/.checkov.yaml", "~/.checkov.yml"]
match = { key_path = ["bc-api-key"] }

[commands]
format = 1
label = "Scan infrastructure code"
description = "Scan a directory or file of infrastructure-as-code for misconfigurations. Platform (Bridgecrew/Prisma) API options and secrets scanning are left out."
quality = "ai-draft"
base = "fig:checkov"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/checkov.ts"
license = "MIT"

[[commands.field]]
id = "directory"
label = "Directory"
description = "IaC root directory (cannot be used together with --file)."
type = "path"
option = ["--directory", "-d"]
path = { kind = "directory", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "file"
label = "File"
description = "IaC file (cannot be used together with --directory)."
type = "path"
option = ["--file", "-f"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "framework"
label = "Framework"
description = "Frameworks to scan, e.g. terraform, kubernetes."
type = "string"
option = ["--framework"]
multiple = true
suggestions = [{ value = "arm", label = "arm" }, { value = "cloudformation", label = "cloudformation" }, { value = "dockerfile", label = "dockerfile" }, { value = "github_configuration", label = "github_configuration" }, { value = "gitlab_configuration", label = "gitlab_configuration" }, { value = "helm", label = "helm" }, { value = "json", label = "json" }, { value = "kubernetes", label = "kubernetes" }, { value = "kustomize", label = "kustomize" }]
sources = ["fig"]

[[commands.field]]
id = "output"
label = "Output format"
description = "Report output format."
type = "string"
option = ["--output", "-o"]
suggestions = [{ value = "cli", label = "cli" }, { value = "cyclonedx", label = "cyclonedx" }, { value = "json", label = "json" }, { value = "junitxml", label = "junitxml" }, { value = "github_failed_only", label = "github_failed_only" }, { value = "sarif", label = "sarif" }]
sources = ["fig"]

[[commands.field]]
id = "check"
label = "Only these checks"
description = "Run only specific check IDs, comma separated."
type = "string"
option = ["--check", "-c"]
sources = ["fig"]

[[commands.field]]
id = "skip_check"
label = "Skip checks"
description = "Run all checks except these IDs, comma separated."
type = "string"
option = ["--skip-check"]
sources = ["fig"]

[[commands.field]]
id = "skip_path"
label = "Skip path"
description = "Path (file or directory) to skip, using regular expression logic."
type = "string"
option = ["--skip-path"]
multiple = true
sources = ["fig"]

[[commands.field]]
id = "quiet"
label = "Failed checks only"
description = "CLI output, display only failed checks."
type = "boolean"
option = ["--quiet"]
sources = ["fig"]

[[commands.field]]
id = "compact"
label = "No code blocks"
description = "CLI output, do not display code blocks."
type = "boolean"
option = ["--compact"]
sources = ["fig"]

[[commands.field]]
id = "soft_fail"
label = "Soft fail"
description = "Runs checks but suppresses the error code."
type = "boolean"
option = ["--soft-fail", "-s"]
sources = ["fig"]

[[commands.field]]
id = "baseline"
label = "Baseline"
description = "Use a .checkov.baseline file to report only new failures."
type = "path"
option = ["--baseline"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["fig"]

[[commands.field]]
id = "list"
label = "List checks"
description = "List checks instead of scanning."
type = "boolean"
option = ["--list", "-l"]
sources = ["fig"]

[[commands.task]]
id = "dir"
label = "Scan a directory"
fields = ["directory", "framework", "quiet"]
required = ["directory"]

[[commands.task]]
id = "file"
label = "Scan one file"
fields = ["file", "output"]
required = ["file"]

[[commands.task]]
id = "ci"
label = "CI JSON report"
set = { output = ["json"], quiet = [true] }
fields = ["directory", "output", "quiet", "soft_fail"]
required = ["directory"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["directory", "file", "framework", "output", "check", "quiet"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["skip_path", "soft_fail", "baseline", "list", "compact", "skip_check"]