Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CKV2_GIT_1 should be updated #7035

Open
armaj4 opened this issue Mar 4, 2025 · 0 comments
Open

CKV2_GIT_1 should be updated #7035

armaj4 opened this issue Mar 4, 2025 · 0 comments
Labels
checks Check additions or changes

Comments

@armaj4
Copy link

armaj4 commented Mar 4, 2025

Describe the issue
Regarding CKV2_GIT_1 it's in need of being updated since GitHub has added rulesets as a modern replacement of branch rules. Currently have rulesets defined and get the check CKV2_GIT_1 failing.

Examples
Ruleset

resource "github_repository_ruleset" "example" {
  name        = "example"
  repository  = github_repository.example.name
  target      = "branch"
  enforcement = "active"

  conditions {
    ref_name {
      include = ["~ALL"]
      exclude = []
    }
  }

  bypass_actors {
    actor_id    = 13473
    actor_type  = "Integration"
    bypass_mode = "always"
  }

  rules {
    creation                = true
    update                  = true
    deletion                = true
    required_linear_history = true
    required_signatures     = true

    required_deployments {
      required_deployment_environments = ["test"]
    }
  }
}

Branch protection V3

resource "github_branch_protection_v3" "example" {
  repository     = github_repository.example.name
  branch         = "main"
  enforce_admins = true

  required_status_checks {
    strict   = false
    checks = [
      "ci/check:824642007264"
    ]
  }

  required_pull_request_reviews {
    dismiss_stale_reviews = true
    dismissal_users       = ["foo-user"]
    dismissal_teams       = [github_team.example.slug]
    dismissal_app         = ["foo-app"]

    bypass_pull_request_allowances {
      users = ["foo-user"]
      teams = [github_team.example.slug]
      apps  = ["foo-app"]
    }
  }

  restrictions {
    users = ["foo-user"]
    teams = [github_team.example.slug]
    apps  = ["foo-app"]
  }
}

Version (please complete the following information):

  • Checkov Version 3.2.379

Additional context
It's a false positive and adding an ignore about it with an explanation about that is good enough for now. But then it doesn't really catch if anyone doesn't add a ruleset.

@armaj4 armaj4 added the checks Check additions or changes label Mar 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
checks Check additions or changes
Projects
None yet
Development

No branches or pull requests

1 participant