93 lines
2.6 KiB
YAML
93 lines
2.6 KiB
YAML
# Pre-commit Hook Configuration for Checkov
|
|
# Place this file as .pre-commit-config.yaml in your project root
|
|
#
|
|
# Install: pip install pre-commit
|
|
# Setup: pre-commit install
|
|
|
|
repos:
|
|
# Checkov IaC Security Scanning
|
|
- repo: https://github.com/bridgecrewio/checkov
|
|
rev: 2.5.0
|
|
hooks:
|
|
- id: checkov
|
|
name: Checkov IaC Security Scan
|
|
args:
|
|
- --soft-fail # Don't block commits (warning only)
|
|
- --compact # Concise output
|
|
- --framework=terraform # Scan Terraform files
|
|
- --framework=kubernetes # Scan Kubernetes files
|
|
- --framework=dockerfile # Scan Dockerfiles
|
|
files: \.(tf|yaml|yml|json|Dockerfile)$
|
|
exclude: |
|
|
(?x)^(
|
|
.terraform/|
|
|
.terragrunt-cache/|
|
|
vendor/|
|
|
node_modules/
|
|
)
|
|
|
|
# Strict mode (fail on Critical/High) - optional
|
|
- repo: https://github.com/bridgecrewio/checkov
|
|
rev: 2.5.0
|
|
hooks:
|
|
- id: checkov
|
|
name: Checkov Strict Mode (Critical/High)
|
|
args:
|
|
- --hard-fail-on=CRITICAL,HIGH
|
|
- --compact
|
|
- --quiet
|
|
files: \.(tf|yaml|yml)$
|
|
exclude: |
|
|
(?x)^(
|
|
.terraform/|
|
|
test/|
|
|
examples/
|
|
)
|
|
# Only run on specific branches
|
|
stages: [push]
|
|
|
|
# Terraform-specific scanning with external modules
|
|
- repo: https://github.com/bridgecrewio/checkov
|
|
rev: 2.5.0
|
|
hooks:
|
|
- id: checkov
|
|
name: Checkov Terraform (with external modules)
|
|
args:
|
|
- --download-external-modules=true
|
|
- --framework=terraform
|
|
- --soft-fail
|
|
files: \.tf$
|
|
exclude: .terraform/
|
|
|
|
# Additional code quality hooks
|
|
- repo: https://github.com/pre-commit/pre-commit-hooks
|
|
rev: v4.5.0
|
|
hooks:
|
|
- id: trailing-whitespace
|
|
- id: end-of-file-fixer
|
|
- id: check-yaml
|
|
args: [--allow-multiple-documents]
|
|
- id: check-json
|
|
- id: check-merge-conflict
|
|
- id: detect-private-key
|
|
name: Detect Private Keys (Secrets)
|
|
|
|
# Terraform formatting
|
|
- repo: https://github.com/antonbabenko/pre-commit-terraform
|
|
rev: v1.86.0
|
|
hooks:
|
|
- id: terraform_fmt
|
|
- id: terraform_validate
|
|
- id: terraform_docs
|
|
args:
|
|
- --hook-config=--add-to-existing-file=true
|
|
- --hook-config=--create-file-if-not-exist=true
|
|
|
|
# YAML linting
|
|
- repo: https://github.com/adrienverge/yamllint
|
|
rev: v1.33.0
|
|
hooks:
|
|
- id: yamllint
|
|
args: [-c=.yamllint.yaml]
|
|
files: \.(yaml|yml)$
|