Scan only the files modified in a PR with checkov#7119
Open
Conversation
bdovaz
requested review from
Kurt-von-Laven,
echoix and
nvuillam
as code owners
Contributor
✅
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| self.cli_lint_extra_args_after.append("--directory") | ||
| self.cli_lint_extra_args_after.append(".") | ||
|
|
||
| return super().build_lint_command(file) |
There was a problem hiding this comment.
Mutating shared state causes argument accumulation across calls
Medium Severity
build_lint_command appends to self.cli_lint_extra_args_after (a persistent instance attribute) on every invocation. The code explicitly handles cli_lint_mode == "file", but in file mode the parent Linter.run() calls build_lint_command(file) once per file in a loop, causing "--file" (or "--directory" + ".") to be appended repeatedly. The second file's command would contain duplicate --file flags, the third would have three, etc., producing broken checkov invocations. Similarly, in the PR branch, --file plus all file paths would be re-appended on each call. Unlike CSpellLinter, which guards against duplicates, no idempotency check is present here.
| self.cli_lint_extra_args_after.append("--file") | ||
|
|
||
| for file_to_lint in self.files: | ||
| self.cli_lint_extra_args_after.append(file_to_lint) |
There was a problem hiding this comment.
PR file scanning broken: self.files always empty by default
High Severity
The checkov descriptor defines no file_extensions and no file_names_regex, so the filter_files utility rejects all files, leaving self.files always empty in the default configuration. When the PR-mode branch appends --file followed by iterating the empty self.files, the resulting command is checkov ... --file with no file arguments — an invalid invocation. The pre_test method masks this by explicitly setting REPOSITORY_CHECKOV_FILE_EXTENSIONS and REPOSITORY_CHECKOV_FILE_NAMES_REGEX, so tests pass, but in production the feature silently produces an error.
Additional Locations (1)
Collaborator
Author
There was a problem hiding this comment.
@nvuillam how can I fix this, which I guess makes sense?
Collaborator
Author
|
/build
|
Collaborator
Author
|
@nvuillam @echoix do you know why all the linters fail with the following error? https://github.com/oxsecurity/megalinter/actions/runs/21965017245/job/63452459680?pr=7119 |
Collaborator
Author
|
I see that this problem is not my PR's fault, it was driving me crazy: #7115 |
Collaborator
So it's the azure DevOps warning that finally becomes an |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| self.cli_lint_extra_args_after.append("--file") | ||
|
|
||
| for file_to_lint in self.files: | ||
| self.cli_lint_extra_args_after.append(file_to_lint) |
There was a problem hiding this comment.
PR mode passes multiple files after single --file flag
High Severity
In PR mode, the code appends a single --file flag followed by all file paths as separate arguments, producing checkov ... --file file1 file2 file3. Checkov's CLI documentation defines --file as -f FILE, --file FILE (singular), meaning it accepts a single file path — not multiple space-separated files. This likely causes checkov to only scan the first file (or error), silently skipping all other PR-modified files. Each file likely needs its own --file prefix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7116
Note
Medium Risk
Changes how a security scanner is invoked and what scope it scans, which may reduce coverage if file selection/modes are misdetected, but the change is small and isolated to Checkov.
Overview
Adds a dedicated
CheckovLinterimplementation and wires thecheckovdescriptor to use it.When running on PRs with
VALIDATE_ALL_CODEBASE=false, Checkov now lints only the changed files by passing repeated--file <path>arguments; otherwise it falls back to--directory .for project-mode scans, removing the previous always-scan-directory behavior.Written by Cursor Bugbot for commit ef95833. This will update automatically on new commits. Configure here.