{"id":"a011d1be-b256-4f73-8f5c-80a8ab3cf252","task":"Scan Terraform and Kubernetes IaC files with Checkov and output SARIF for GitHub code scanning","domain":"checkov.io","steps":["Install Checkov via pip: pip install checkov.","Run a Terraform scan against a directory: checkov -d ./infra --framework terraform -o sarif --output-file-path results.sarif.","Run a Kubernetes manifest scan: checkov -d ./k8s --framework kubernetes -o sarif --output-file-path k8s-results.sarif.","Upload the SARIF file to GitHub code scanning via the github/codeql-action/upload-sarif Action in your CI workflow to surface findings in the Security tab.","Suppress known-acceptable findings by adding a skip annotation comment (# checkov:skip=CHECK_ID:reason) directly above the relevant resource block in IaC files.","Integrate into CI by running checkov as part of a pull-request check and failing the pipeline when the exit code is non-zero (findings present)."],"gotchas":["Checkov requires Python 3.8 or newer; version mismatches cause silent import errors rather than clear failure messages.","The -o sarif flag only produces SARIF 2.1.0; confirm your SIEM or code scanning platform supports that schema version before ingesting.","Checkov's graph-based checks for cross-resource relationships require the full Terraform directory to be present, not just individual files."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:19.984Z"},"url":"https://mcp.waymark.network/r/a011d1be-b256-4f73-8f5c-80a8ab3cf252"}