feat(checkov): vendor checkov-action locally so renovate can manage the version#153
Merged
Conversation
…he version The upstream bridgecrewio/checkov-action publishes too many git tags for Renovate to enumerate releases, so it never gets bumped. Vendor the action verbatim (Apache-2.0) and pin the checkov Docker image directly; Renovate's built-in github-actions manager keeps it current via the runs.image reference. - add .github/actions/checkov (action.yml, LICENSE, NOTICE) - document the action and migration in README
check-docs requires every action to ship a README.md with AUTO-DOC markers; generate the input/output tables from action.yml.
Apache-2.0 section 4(b) requires modified files to carry a prominent notice stating they were changed. Spell out the vendoring and that only a header comment was added (no behavior change).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The upstream
bridgecrewio/checkov-actionpublishes a very large number of git tags, which prevents Renovate from enumerating its releases — so the action never gets bumped.What
Vendor the upstream action verbatim into
.github/actions/checkov/and pin the checkov Docker image directly (docker://ghcr.io/bridgecrewio/checkov:3.3.0). Renovate's built-ingithub-actionsmanager updatesruns.image, which tracks clean semver image tags instead of the action repo's tag flood..github/actions/checkov/action.yml— upstream action copied verbatim (same inputs, outputs, args, env, behavior); added a header comment explaining the vendoring.github/actions/checkov/LICENSE+NOTICE— upstream is Apache-2.0; carries attribution and the rationale for the local copyREADME.md— new Checkov section with usage and migration notesNotes
zizmorreports no findings; the file is valid YAML.Follow-ups (not in this PR)
git tag checkov/v1 && git push origin checkov/v1bridgecrewio/checkov-action@...toloft-sh/github-actions/.github/actions/checkov@checkov/v1— inputs are identical, only theuses:line changes.