subhamay-bhattacharyya-gha/Reusable Checkov IaC Scan
Reusable GitHub Action to run Checkov against a specified IaC directory for security and compliance checks.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| release-tag | DEPRECATED and ignored. This action no longer runs its own actions/checkout (doing so wiped downloaded plan-file artifacts). The caller is responsible for checkout. The input is retained only to avoid 'Unexpected input(s)' warnings in callers that still pass it; remove it from your workflow when convenient. | no | "" |
| iac-dir | The directory path of the IAC file. | yes | iac |
| iac-framework | IAC Framework - Accepted values: cloudformation, terraform, kubernetes etc. | yes | terraform |
| plan-file | Path (relative to the workspace) to a Terraform plan JSON file. If set, Checkov scans this file with framework 'terraform_plan' instead of scanning 'iac-dir'. | no | "" |
| output-file-path | DEPRECATED and ignored. This action now runs the checkov CLI directly and writes SARIF to a deterministic location under $GITHUB_WORKSPACE; it then copies it to $GITHUB_WORKSPACE/results.sarif for downstream steps. Retained only so existing callers don't hit 'Unexpected input(s)'. | no | "" |
| soft-fail | If true, Checkov scan will not fail the pipeline | no | true |
| github-token | GitHub token used for API calls (pass secrets.GITHUB_TOKEN from the caller workflow). | yes | — |
Outputs
no outputs