[jiparis]

Add a root .checkov.yaml so that the managed IaC scan stops reporting false positives for this repository.

The iac-misconfiguration policy reported 55 violations. None is a real issue:

• Checkov secret checks found development configs, vendored charts and test data. The secret scans (secret-scan and pr-validation) already cover secret detection.
• OpenAPI checks found validator test data and the spec that the build generates from the protos.
• CKV_DOCKER_2 (HEALTHCHECK) found the FROM scratch release images. These images have no shell. The Helm chart sets liveness and readiness probes.

The config skips the secrets and openapi frameworks and the CKV_DOCKER_2 check. The Dockerfile and GitHub Actions checks still run. The config uses skip-framework and skip-check only, because PR validation passes files with -f and skip-path has no effect there.

Refs PFM-8051.

AI disclosure: Claude Code helped to triage the findings and to write this change.

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 88% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 88%	1	⚠️ 1	100% AI / 0% Human	1	+21 / -0	1h58m21s

🟢 88% — 100% AI — ⚠️ 1 policies failing

Oct 28, 2026 09:50 UTC · 1h58m21s · $35.44 · 912 in / 436.8k out · claude-code 2.1.312 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Adds a root .checkov.yaml that skips Checkov secrets, openapi, and CKV_DOCKER_2.
• Uses the repo-level config path that managed IaC scans and -f PR-validation mode read.
• Re-runs Checkov on a clean export and re-evaluates the real iac-misconfiguration policy to confirm 55→0 violations.

AI Session Overall Score

🟢 88% — Clean IaC remediation run with strong local validation and no substantive drift.

AI Session Analysis Breakdown

🟢 93% · scope-discipline

🟢 Once the work narrowed to IaC, the session stayed on .checkov.yaml and scan commands. · _ Impact_

🟢 92% · verification

🟢 Clean-tree before/after rescans gave a concrete 60→0 validation loop. · _ Impact_

🟢 89% · alignment

No notes.

🟢 86% · context-and-planning

No notes.

🟢 85% · solution-quality

🟢 The fix used the real auto-discovered Checkov config path, not an ad-hoc suppression. · _ Impact_

🟢 84% · user-trust-signal

🟡 The user had to stop an early fixing attempt and ask for the full picture first. · Low Severity

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	.checkov.yaml	+21 / -0

---

Policies (4, 1 failing)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-82aee0	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-82aee0	-
⚠️ Failed	ai-config-no-secrets	ai-coding-session-82aee0	Secret (generic-password) detected in session content [turn=36, source=tool_result, line=1]: {"violations":[{"message":"Secret (generic-password) detected in session content [turn=2728, source=assistant-tool_use:Bash, line=19]: r = op.open(urllib.parse.urljoin(url, action), urllib.parse.urlen... Secret (generic-password) detected in session content [turn=782, source=queue-operation, line=11]: | G1: turn 44, tool_result (Read of a Go CLI file) | 1-6 (6) | A Go identifier, not a secret. The rule matched RegistryPassword: [CHAINLOOP_TRACE_REDACTED:generic-password], (line 112) and took t... Secret (generic-password) detected in session content [turn=785, source=user-message, line=12]: | G1: turn 44, tool_result (Read of a Go CLI file) | 1-6 (6) | A Go identifier, not a secret. The rule matched RegistryPassword: [CHAINLOOP_TRACE_REDACTED:generic-password], (line 112) and took t... Secret (generic-password) detected in session content [turn=803, source=assistant-text, line=10]: | The Go variable [CHAINLOOP_TRACE_REDACTED:generic-password] was taken as a password and replaced everywhere | 6 | False positive (the CLI redacts too much) | Chainloop repo: allowlist bare identif... Secret (generic-password) detected in session content [turn=803, source=assistant-text, line=2]: - The generic-password allowlist in internal/redaction/betterleaks.toml:42-56 covers dotted property access only, such as e.password. It does not cover bare identifiers such as [CHAINLOOP_TRACE...</li><li>Secret (generic-password) detected in session content [turn=803, source=assistant-text, line=3]: - redaction.go:580usesstrings.ReplaceAllwithout word boundaries, so it also changes longer names such as[CHAINLOOP_TRACE_REDACTED:generic-password]EnvVarName.</li><li>Secret (generic-password) detected in session content [turn=831, source=assistant-tool_use:Write, line=1]: {"content":"## Triage of policy violations in v1.128.1+next\\n\\nThis comment adds the failures of v1.128.1+next (58967a46-bf29-47c8-b15d-77950188b174). It records the findings only. It changes no cod...</li><li>Secret (generic-password) detected in session content [turn=857, source=assistant-text, line=9]: | ai-config-no-secrets(14) | 6 come from the CLI redacting the Go variable[CHAINLOOP_TRACE_REDACTED:generic-password]. 7 come from a Rego bug: the session read its own violation messages back. |...</li><li>Secret (generic-password) detected in session content [turn=900, source=tool_result, line=179]: 179 | Turn 44, Read of a Go CLI file | 6 | The Go identifier [CHAINLOOP_TRACE_REDACTED:generic-password]inRegistryPassword: [CHAINLOOP_TRACE_REDACTED:generic-password],. The CLI then replaced th...</li><li>Secret (generic-password) detected in session content [turn=900, source=tool_result, line=185]: 185 * Chainloop repository: in internal/redaction/betterleaks.toml:42-56, add a generic-passwordallowlist for bare code identifiers (for example[CHAINLOOP_TRACE_REDACTED:generic-password]). To...</li><li>Secret (jwt) detected in session content [turn=42, source=tool_result, line=23]: 229:# Placeholders without the annotation prove nothing — [CHAINLOOP_TRACE_REDACTED:jwt] is a</li><li>Secret (jwt) detected in session content [turn=42, source=tool_result, line=80]: 367:# line=1]: [CHAINLOOP_TRACE_REDACTED:jwt]. When a later session reads that text back — a Secret (jwt) detected in session content [turn=45, source=tool_result, line=4]: # line=1]: [CHAINLOOP_TRACE_REDACTED:jwt]`. When a later session reads that text back — a Secret (jwt) detected in session content [turn=63, source=tool_result, line=1]: {"digest":"sha256:be6eca16734dfcf2f7917f65ae8f7dfe4c7c5f3c683637a3e2eb521587edfcc1","name":"","content":"https://cas.chainloop.dev/download/sha256:be6eca16734dfcf2f7917f65ae8f7dfe4c7c5f3c683637a3e2eb5... Secret (jwt) detected in session content [turn=65, source=assistant-tool_use:Bash, line=1]: D=/private/tmp/claude-501/-Users-jiparis-projects-chainloop/82aee093-bc74-473c-a666-45f54c8814a1/scratchpad/sbom; mkdir -p $D; curl -sSL -o $D/sbom.json 'https://cas.chainloop.dev/download/sha256:be6e... Secret (jwt) detected in session content [turn=85, source=tool_result, line=21]: deel_pto: "https://api.deel.com/apps/webhooks/calendars/[CHAINLOOP_TRACE_REDACTED:jwt]" Secret (private-key) detected in session content [turn=121, source=tool_result, line=16]: [CHAINLOOP_TRACE_REDACTED:private-key] Secret (private-key) detected in session content [turn=53, source=tool_result, line=13]: ## [CHAINLOOP_TRACE_REDACTED:private-key]
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-82aee0	-

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[migmartri]

we might want to add some documentation about how to do this in our docs.

[jiparis]

we might want to add some documentation about how to do this in our docs.

I'll do it once all the issues are solved and/or documented.