Checkov Scanner
Checkov IaC Scanner - Reusable Workflow
Runs the Checkov scanner via the argus Python CLI. Equivalent to: python -m argus scan checkov
For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/infrastructure-scanning.yml
uses: huntridge-labs/argus/.github/workflows/scanner-checkov.yml@1.1.0
Triggers
- Manual dispatch
- Reusable (called by other workflows)
Permissions
| Scope | Access |
|---|---|
contents |
read |
security-events |
write |
actions |
read |
pull-requests |
write |
Inputs
| Input | Description | Required | Default |
|---|---|---|---|
iac_path |
Relative path to the infrastructure-as-code directory to scan string | No | infrastructure |
framework |
IaC framework to scan (terraform, cloudformation, kubernetes, etc.) string | No | terraform |
enable_code_security |
Whether GitHub Code Security is enabled for this repository boolean | No | False |
post_pr_comment |
Whether to post PR comments boolean | No | False |
fail_on_severity |
Fail the job if any check fails. Checkov does not support severity-based filtering - any value other than "none" will... string | No | none |
Secrets
| Secret | Description | Required |
|---|---|---|
BC_API_KEY |
Prisma Cloud API key for enhanced severity scoring and features | No |
Jobs
checkov-scan — Checkov Security Scan
Runs on: ubuntu-latest · Timeout: 15 minutes · Continue on error: Yes
Steps:
- Checkout repository —
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - Set up Python —
actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 - Install Argus
- Run scan
- Upload artifacts —
actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f - Upload SARIF —
github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 - Comment PR with results —
huntridge-labs/argus/.github/actions/comment-pr@1.1.0