[pre-commit] terraform_checkov skip-path argument not working at all

[tomiszili]

Hello,

Describe the bug

I have tried several different options to exclude my examples directory under any folder, but somehow checkov checks them as this argument haven't provided at all in the pre-commit config file.

How can we reproduce it?

An option to reproduce this bug: delete some checkov skip comments in your folder and run git add -A and after that pre-commit run.

Environment information

• OS:

• uname -a and/or systeminfo | Select-String "^OS" output:

uname -a
Linux myname5.10.102.1-microsoft-standard-WSL2 #1 SMP Wed Mar 2 00:30:59 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

• Tools availability and versions:

GNU bash, version 5.0.17(1)-release (x86_64-pc-linux-gnu)
pre-commit 2.17.0
Terraform v1.2.8
python SKIPPED
Python 3.8.10
checkov 2.1.268
terraform-docs version v0.16.0 1f686b1 linux/amd64
terragrunt version v0.38.7
terrascan version: v1.13.2
TFLint version 0.41.0
+ ruleset.aws (0.17.0)
+ ruleset.terraform (0.1.1-bundled)
tfsec v1.27.5
tfupdate tfupdate SKIPPED
hcledit hcledit SKIPPED

• .pre-commit-config.yaml:

file content

```bash repos: - repo: https://github.com/antonbabenko/pre-commit-terraform rev: v1.76.0 hooks: - id: terraform_checkov args: - --args=--directory __GIT_WORKING_DIR__/ - --args=--skip-path '/examples/.*' # not working... - --args=--skip-path ".*/examples/.*", # not working... - --args=--skip-path "(../|./|/|.*)*examples(/.*)*", # not working... - --args=--skip-path '__GIT_WORKING_DIR__/.*/examples/.*' # not working - --args=--quiet - --args=--framework terraform ```

[MaxymVlasov]

repos:
    - repo: https://github.com/antonbabenko/pre-commit-terraform
      rev: v1.76.0
      hooks:
        - id: terraform_checkov
          args:
            - --args=--quiet
            - --args=--framework terraform
          exclude: '/examples/'

That's what you need

https://pre-commit.com/#config-exclude

https://pre-commit.com/#regular-expressions

---

--directory __GIT_WORKING_DIR__/ - useless, because pre-commit hooks run only on changed files (in case with some TF hooks - on changed dirs) If you'd like to have --directory __GIT_WORKING_DIR__/, which the same as pre-commit run --all, you also need include always_run