Skip to content

fix(terraform_plan): apply inline skip comments when deep analysis is enabled - #7644

Draft
pszypowicz wants to merge 1 commit into
bridgecrewio:mainfrom
pszypowicz:fix/deep-analysis-inline-skips
Draft

fix(terraform_plan): apply inline skip comments when deep analysis is enabled#7644
pszypowicz wants to merge 1 commit into
bridgecrewio:mainfrom
pszypowicz:fix/deep-analysis-inline-skips

Conversation

@pszypowicz

Copy link
Copy Markdown

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

RunnerRegistry._handle_report gated the whole plan enrichment block on deep analysis being off, and that block is the only place where inline checkov:skip comments get applied to plan scans. Running --repo-root-for-plan-enrichment together with --deep-analysis therefore dropped every inline suppression, while the same scan without --deep-analysis honored them.

This change parses the enrichment repo root and applies Report.handle_skipped_checks in both modes. The file path, line range and code block rewriting of Report.enrich_plan_report stays on the non-deep path, because deep analysis reports records against the plan file through the merged graph and existing tests pin that behavior.

The new test mirrors the existing test_skip_check with deep_analysis=True and fails without the fix.

Fixes #7643 (previously reported in #6815 and #7225, both closed by the stale bot without a fix)

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my feature, policy, or fix is effective and works
  • New and existing tests pass locally with my changes

… enabled

_handle_report gated the whole plan enrichment block on deep analysis
being off, and that block is the only place inline checkov:skip
comments get applied to plan scans, so combining
--repo-root-for-plan-enrichment with --deep-analysis dropped every
inline suppression. Apply handle_skipped_checks in both modes and keep
the file path, line range and code block rewriting on the non-deep
path, where records are not already mapped through the merged graph.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Inline checkov:skip comments are ignored when --deep-analysis is enabled

1 participant