From 0daa010690a5128372630444184260875de270de Mon Sep 17 00:00:00 2001 From: "Jose I. Paris" Date: Wed, 28 Oct 2026 12:48:47 +0100 Subject: [PATCH] chore: add root Checkov config to skip duplicate and generated findings The managed IaC scan reported 55 policy violations, all false positives: Checkov secret checks on dev configs, vendored charts and test data, OpenAPI checks on validator test data and the generated spec, and CKV_DOCKER_2 on FROM scratch images that have Kubernetes probes. Skip the secrets and openapi frameworks (the secret scans already cover secrets) and CKV_DOCKER_2. Dockerfile and GitHub Actions checks still run. Refs: PFM-8051 Assisted-by: Claude Code Signed-off-by: Jose I. Paris Chainloop-Trace-Sessions: 82aee093-bc74-473c-a666-45f54c8814a1 --- .checkov.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .checkov.yaml diff --git a/.checkov.yaml b/.checkov.yaml new file mode 100644 index 000000000..1e07bd623 --- /dev/null +++ b/.checkov.yaml @@ -0,0 +1,21 @@ +# Root Checkov config, read automatically by the IaC scans that Chainloop runs +# on this repository (the iac-scan workflow and the scan in pr-validation). +# PR validation passes the changed files with -f, so --skip-path does not +# apply there. Use skip-framework and skip-check only. +# +# Secret detection belongs to the secret scans (secret-scan and pr-validation). +# Checkov's secrets framework only duplicates them, and here it reports +# development configs, vendored charts and test data. +# +# The openapi framework matches only validator test data and the spec that is +# generated from the protos (app/controlplane/api/gen/openapi). A fix for a +# finding in the generated spec has to go in the generator. +skip-framework: + - secrets + - openapi + +# The release images are FROM scratch and have no shell to run a HEALTHCHECK. +# The Helm chart sets liveness and readiness probes, and the CLI and migrations +# images run as jobs. +skip-check: + - CKV_DOCKER_2