search

bridgecrewio / checkov-action

This GitHub Action runs Checkov against infrastructure-as-code, open source packages, container images, and CI/CD configurations to identify misconfigurations, vulnerabilities, and license compliance issues.
Apache License 2.0
246 stars 101 forks source link

Add version selection #41

Open lukerosser opened 3 years ago

lukerosser commented 3 years ago

At the minute the checkov version is tied to the Github action version, and there's no correlation in the tags so if you want to pin a specific checkov version it's quite awkward.

It would be nice to change this to an input in the action, similar to how this tflint action works: https://github.com/marketplace/actions/setup-tflint#tflint_version

This allows more configurable functionality, and also allows the Github action features to progress without forcing a checkov version update at the same time.

ivan-pinatti-ciandt commented 2 years ago

+1 on this.

It helps to lock the version when running it locally through other tools like task or pre-commit and then match the version on the CI/CD pipeline (GHA).

rusherr02 commented 1 year ago

Is it possible to integrate Checkov with GitHub CI? I can't find any documentation for the same. Can someone help?