checkov-pipeline.yml

trigger: none
pr: none

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: QualityCheckStage
  displayName: Quality Check Stage
  jobs:
    - job: CheckovJob
      displayName: Run Checkov Scan
      steps:
      # Checkov is a static code analysis tool for infrastructure-as-code.
      # It scans cloud infrastructure provisioned using Terraform, Cloudformation, Kubernetes, Serverless 
      # or ARM Templates and detects security and compliance misconfigurations.
      # Documentation: https://github.com/bridgecrewio/checkov
      # NOTE: If you want to skip a specific check from the analysis, include it in the command-line as 
      # follows: --skip-check CKV_AWS_70,CKV_AWS_52,CKV_AWS_21,CKV_AWS_18,CKV_AWS_19
      - script: |
          mkdir CheckovReport
          docker pull bridgecrew/checkov:latest

          docker run \
            --volume $(System.DefaultWorkingDirectory)/Infrastructure-Source-Code/terraform:/tf \
            bridgecrew/checkov \
              --directory /tf \
              --output junitxml > $(System.DefaultWorkingDirectory)/CheckovReport/Checkov-Report.xml

          docker run \
          --volume $(System.DefaultWorkingDirectory)/Infrastructure-Source-Code/terraform:/tf \
          bridgecrew/checkov \
            --directory /tf
        displayName: 'Checkov Static Code Analysis'
        name: CheckovScan
        condition: always()
      
      # Publish the Checkov report as an artifact to Azure Pipelines
      - task: PublishBuildArtifacts@1
        displayName: 'Publish Artifact: Checkov Report'
        condition: succeededOrFailed()
        inputs:
          PathtoPublish: '$(System.DefaultWorkingDirectory)/CheckovReport'
          ArtifactName: CheckovReport

      # Publish the results of the Checkov analysis as Test Results to the pipeline
      # NOTE: There is a current issue with the produced XML that fails to publish the test results correctly.
      # Discussed issue with BridgeCrew, which is looking into it.
      # Work-around is to include the Script step to remove the last 2 lines from the file before processing.
      - task: PublishTestResults@2
        displayName: Publish Checkov Test Results
        condition: succeededOrFailed()
        inputs:
          testResultsFormat: 'JUnit' # Options JUnit, NUnit, VSTest, xUnit, cTest
          testResultsFiles: '**/*Checkov-Report.xml'
          searchFolder: '$(System.DefaultWorkingDirectory)/CheckovReport'
          mergeTestResults: false
          testRunTitle: Checkov Scan
          failTaskOnFailedTests: false
          publishRunAttachments: true

      # Clean up any of the containers / images that were used for quality checks
      - bash: |
          docker rmi "bridgecrew/checkov" -f | true
        displayName: 'Remove Terraform Quality Check Docker Images'
        condition: always()