chore: add root Checkov config to skip duplicate and generated findings

Merged
JI
6d ago
+21-0

Add a root .checkov.yaml so that the managed IaC scan stops reporting false positives for this repository.

The iac-misconfiguration policy reported 55 violations. None is a real issue:

  • Checkov secret checks found development configs, vendored charts and test data. The secret scans (secret-scan and pr-validation) already cover secret detection.
  • OpenAPI checks found validator test data and the spec that the build generates from the protos.
  • CKV_DOCKER_2 (HEALTHCHECK) found the FROM scratch release images. These images have no shell. The Helm chart sets liveness and readiness probes.

The config skips the secrets and openapi frameworks and the CKV_DOCKER_2 check. The Dockerfile and GitHub Actions checks still run. The config uses skip-framework and skip-check only, because PR validation passes files with -f and skip-path has no effect there.

Refs PFM-8051.

AI disclosure: Claude Code helped to triage the findings and to write this change.