Skip to content

Commit e3a9834

Browse files
bmbferreirabmbferreira
authored
feat: Added terraform_checkov (run per folder), deprecated checkov hook (antonbabenko#290)
1 parent b35dc17 commit e3a9834

File tree

3 files changed

+93
-6
lines changed

3 files changed

+93
-6
lines changed

‎.pre-commit-hooks.yaml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@
9393
language: script
9494

9595
- id: checkov
96-
name: Checkov
96+
name: checkov (deprecated, use "terraform_checkov")
9797
description: Runs checkov on Terraform templates.
9898
entry: checkov -d .
9999
language: python
@@ -103,6 +103,16 @@
103103
exclude: \.terraform\/.*$
104104
require_serial: true
105105

106+
- id: terraform_checkov
107+
name: Checkov
108+
description: Runs checkov on Terraform templates.
109+
entry: hooks/terraform_checkov.sh
110+
language: script
111+
always_run: false
112+
files: \.tf$
113+
exclude: \.terraform\/.*$
114+
require_serial: true
115+
106116
- id: terrascan
107117
name: terrascan
108118
description: Runs terrascan on Terraform templates.

‎README.md

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ If you are using `pre-commit-terraform` already or want to support its developme
3636
* [4. Run](#4-run)
3737
* [Available Hooks](#available-hooks)
3838
* [Hooks usage notes and examples](#hooks-usage-notes-and-examples)
39-
* [checkov](#checkov)
39+
* [checkov (deprecated) and terraform_checkov](#checkov-deprecated-and-terraform_checkov)
4040
* [infracost_breakdown](#infracost_breakdown)
4141
* [terraform_docs](#terraform_docs)
4242
* [terraform_docs_replace (deprecated)](#terraform_docs_replace-deprecated)
@@ -220,11 +220,11 @@ There are several [pre-commit](https://pre-commit.com/) hooks to keep Terraform
220220
<!-- markdownlint-disable no-inline-html -->
221221
| Hook name | Description | Dependencies<br><sup>[Install instructions here](#1-install-dependencies)</sup> |
222222
| ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
223-
| `checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues. [Hook notes](#checkov) | `checkov`<br>Ubuntu deps: `python3`, `python3-pip` |
223+
| `checkov` and `terraform_checkov` | [checkov](https://github.com/bridgecrewio/checkov) static analysis of terraform templates to spot potential security issues. [Hook notes](#checkov-deprecated-and-terraform_checkov) | `checkov`<br>Ubuntu deps: `python3`, `python3-pip` |
224224
| `infracost_breakdown` | Check how much your infra costs with [infracost](https://github.com/infracost/infracost). [Hook notes](#infracost_breakdown) | `infracost`, `jq`, [Infracost API key](https://www.infracost.io/docs/#2-get-api-key) |
225+
| `terraform_docs` | Inserts input and output documentation into `README.md`. Recommended. [Hook notes](#terraform_docs) | `terraform-docs` |
225226
| `terraform_docs_replace` | Runs `terraform-docs` and pipes the output directly to README.md. **DEPRECATED**, see [#248](https://github.com/antonbabenko/pre-commit-terraform/issues/248). [Hook notes](#terraform_docs_replace-deprecated) | `python3`, `terraform-docs` |
226227
| `terraform_docs_without_`<br>`aggregate_type_defaults` | Inserts input and output documentation into `README.md` without aggregate type defaults. Hook notes same as for [terraform_docs](#terraform_docs) | `terraform-docs` |
227-
| `terraform_docs` | Inserts input and output documentation into `README.md`. Recommended. [Hook notes](#terraform_docs) | `terraform-docs` |
228228
| `terraform_fmt` | Reformat all Terraform configuration files to a canonical format. [Hook notes](#terraform_fmt) | - |
229229
| `terraform_providers_lock` | Updates provider signatures in [dependency lock files](https://www.terraform.io/docs/cli/commands/providers/lock.html). [Hook notes](#terraform_providers_lock) | - |
230230
| `terraform_tflint` | Validates all Terraform configuration files with [TFLint](https://github.com/terraform-linters/tflint). [Available TFLint rules](https://github.com/terraform-linters/tflint/tree/master/docs/rules#rules). [Hook notes](#terraform_tflint). | `tflint` |
@@ -240,9 +240,24 @@ Check the [source file](https://github.com/antonbabenko/pre-commit-terraform/blo
240240

241241
## Hooks usage notes and examples
242242

243-
### checkov
243+
### checkov (deprecated) and terraform_checkov
244+
245+
> `checkov` hook is deprecated, please use `terraform_checkov`.
246+
247+
Note that `terraform_checkov` runs recursively during `-d .` usage. That means, for example, if you change `.tf` file in repo root, all existing `.tf` files in repo will be checked.
248+
249+
1. You can specify custom arguments. E.g.:
250+
251+
```yaml
252+
- id: terraform_checkov
253+
args:
254+
- --args=--quiet
255+
- --args=--skip-check CKV2_AWS_8
256+
```
257+
258+
Check all available arguments [here](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html).
244259
245-
For [checkov](https://github.com/bridgecrewio/checkov) you need to specify each argument separately:
260+
For deprecated hook you need to specify each argument separately:
246261
247262
```yaml
248263
- id: checkov

‎hooks/terraform_checkov.sh

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/usr/bin/env bash
2+
set -eo pipefail
3+
4+
# globals variables
5+
# hook ID, see `- id` for details in .pre-commit-hooks.yaml file
6+
# shellcheck disable=SC2034 # Unused var.
7+
readonly HOOK_ID='terraform_checkov'
8+
# shellcheck disable=SC2155 # No way to assign to readonly variable in separate lines
9+
readonly SCRIPT_DIR="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
10+
# shellcheck source=_common.sh
11+
. "$SCRIPT_DIR/_common.sh"
12+
13+
function main {
14+
common::initialize "$SCRIPT_DIR"
15+
common::parse_cmdline "$@"
16+
# shellcheck disable=SC2153 # False positive
17+
common::per_dir_hook "${ARGS[*]}" "$HOOK_ID" "${FILES[@]}"
18+
}
19+
20+
#######################################################################
21+
# Unique part of `common::per_dir_hook`. The function is executed in loop
22+
# on each provided dir path. Run wrapped tool with specified arguments
23+
# Arguments:
24+
# args (string with array) arguments that configure wrapped tool behavior
25+
# dir_path (string) PATH to dir relative to git repo root.
26+
# Can be used in error logging
27+
# Outputs:
28+
# If failed - print out hook checks status
29+
#######################################################################
30+
function per_dir_hook_unique_part {
31+
# common logic located in common::per_dir_hook
32+
local -r args="$1"
33+
# shellcheck disable=SC2034 # Unused var.
34+
local -r dir_path="$2"
35+
36+
# shellcheck disable=SC2068 # hook fails when quoting is used ("$arg[@]")
37+
checkov -d . ${args[@]}
38+
39+
# return exit code to common::per_dir_hook
40+
local exit_code=$?
41+
return $exit_code
42+
}
43+
44+
#######################################################################
45+
# Unique part of `common::per_dir_hook`. The function is executed one time
46+
# in the root git repo
47+
# Arguments:
48+
# args (string with array) arguments that configure wrapped tool behavior
49+
#######################################################################
50+
function run_hook_on_whole_repo {
51+
local -r args="$1"
52+
53+
# pass the arguments to hook
54+
# shellcheck disable=SC2068 # hook fails when quoting is used ("$arg[@]")
55+
checkov -d "$(pwd)" ${args[@]}
56+
57+
# return exit code to common::per_dir_hook
58+
local exit_code=$?
59+
return $exit_code
60+
}
61+
62+
[[ ${BASH_SOURCE[0]} != "$0" ]] || main "$@"

0 commit comments

Comments
 (0)