{
  "repository": "bridgecrewio/checkov",
  "ref": "47986461a2824dfa713a302dc11c44659b61dc1e",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql-analysis.yml",
          "locator": "jobs.analyze.steps[7] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "flake8",
      "method": "static_analysis",
      "commands": [
        "pre-commit hook flake8"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.flake8"
        },
        {
          "path": ".flake8",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/PyCQA/flake8",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "bandit",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "pyproject.toml",
          "locator": "[tool.bandit]"
        }
      ],
      "upstream": "https://github.com/PyCQA/bandit",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "mypy",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "mypy.ini",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/python/mypy",
      "docs": "https://mypy.readthedocs.io/en/stable/command_line.html",
      "exit_codes": {
        "0": "no type errors",
        "1": "type errors found",
        "2": "crash or invalid invocation"
      },
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "integration-tests (python: 4, os: 3)",
        "integration-tests-old-python (python: 1, os: 2)",
        "sast-integration-tests (python: 4, os: 2)",
        "sast-integration-tests-old-python (python: 1, os: 1)",
        "unit-tests (python: 5)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests-old-python.strategy.matrix"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests-old-python.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.unit-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests-old-python.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests-old-python.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests-old-python.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest integration_tests",
        "pytest sast_integration_tests",
        "pytest tests",
        "pytest --cov-report term --cov=checkov tests",
        "pytest integration_tests -k not api_key"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests.steps[12] (Run integration tests)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests-old-python.steps[12] (Run integration tests)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests.steps[8] (Run integration tests)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests-old-python.steps[8] (Run integration tests)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.unit-tests.steps[6] (Test with pytest)"
        },
        {
          "path": ".github/workflows/coverage.yaml",
          "locator": "jobs.update-coverage.steps[7] (Test with pytest)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.unit-tests.steps[6] (Unit tests)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests.steps[12] (Run integration tests)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests-old-python.steps[12] (Run integration tests)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests.steps[8] (Run integration tests)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests-old-python.steps[8] (Run integration tests)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests.steps[5] (Run integration tests)"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pre-commit-hooks",
      "method": "formatting",
      "commands": [
        "pre-commit hook debug-statements"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.debug-statements"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "black",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "pyproject.toml",
          "locator": "[tool.black]"
        }
      ],
      "upstream": "https://github.com/psf/black",
      "docs": null,
      "exit_codes": {
        "0": "nothing to change",
        "1": "files would be reformatted (--check)",
        "123": "internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "base_resource_check.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.eval-keys-test.steps[2] (Validate 'BaseResourceCheck' use contains eval keys)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c ./cdk_integration_tests/prepare_data.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests.steps[4] (Create checkov reports)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests-old-python.steps[4] (Create checkov reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c ./integration_tests/prepare_data.sh \"$EXPR\" \"$EXPR\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests.steps[11] (Create checkov reports)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests-old-python.steps[11] (Create checkov reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c ./integration_tests/prepare_data.sh $EXPR 3.9"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests.steps[11] (Create checkov reports)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests-old-python.steps[11] (Create checkov reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c ./sast_integration_tests/prepare_data.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests.steps[7] (Create checkov reports)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests-old-python.steps[7] (Create checkov reports)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests.steps[7] (Create checkov reports)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests-old-python.steps[7] (Create checkov reports)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c pipenv run pip install dist/checkov-*.whl"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests.steps[6] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.integration-tests-old-python.steps[6] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.prisma-tests.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.sast-integration-tests-old-python.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests.steps[6] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.integration-tests-old-python.steps[6] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.sast-integration-tests-old-python.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cdk-integration-tests-old-python.steps[3] (Build & install checkov package)"
        },
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.performance-tests.steps[6] (Build & install checkov package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "cfn-lint $file -i W"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pr-test.yml",
          "locator": "jobs.cfn-lint.steps[4] (Install cfn-lint & Lint Cloudformation templates)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "checkov -s -d terragoat --bc-api-key $PRISMA_KEY --repo-id yuvalyacoby/terragoat > checkov_report_prisma.txt"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.prisma-tests.steps[5] (Run checkov with Prisma creds)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "coverage_badge -o coverage.svg -f"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/coverage.yaml",
          "locator": "jobs.update-coverage.steps[7] (Test with pytest)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook actionlint-docker"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.actionlint-docker"
        }
      ],
      "upstream": "https://github.com/rhysd/actionlint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook import-linter"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.import-linter"
        }
      ],
      "upstream": "https://github.com/seddonym/import-linter",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook pipenv-setup"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pipenv-setup"
        }
      ],
      "upstream": "https://github.com/Madoshakalaka/pipenv-setup",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook teyit"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.teyit"
        }
      ],
      "upstream": "https://github.com/isidentical/teyit",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pyinstaller checkov.spec"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/nightly.yml",
          "locator": "jobs.build-release-artifacts.steps[4] (Build executable)"
        },
        {
          "path": ".github/workflows/nightly.yml",
          "locator": "jobs.build-release-artifact-linux-arm.steps[3] (Build executable)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python checkov/main.py --list --framework $i >> $scansdoc"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.bump-version.steps[6] (version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python checkov/main.py --list --framework cloudformation >> $scansdoc"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/build.yml",
          "locator": "jobs.bump-version.steps[6] (version)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "zip checkov.zip dist/checkov"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/nightly.yml",
          "locator": "jobs.build-release-artifacts.steps[8] (Linux/Mac - zip artifact)"
        },
        {
          "path": ".github/workflows/nightly.yml",
          "locator": "jobs.build-release-artifact-linux-arm.steps[4] (zip artifact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}