feat: add checkov (#195)

- remove from trunk

Author: martimlobao

.github/workflows/lint_pr.yaml

@@ -14,6 +14,16 @@ jobs:
         uses: actions/checkout@v6
       - name: Run actionlint
         uses: raven-actions/actionlint@963d4779ef039e217e5d0e6fd73ce9ab7764e493 # v2.1.0
+  checkov:
+    name: Run checkov
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+      - name: Install uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+      - name: Run checkov
+        run: uvx checkov -d .
   jsort:
     name: Run jsort
     runs-on: ubuntu-latest

.trunk/trunk.yaml

@@ -19,7 +19,6 @@ runtimes:
 # This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
 lint:
   enabled:
-    - checkov@3.2.495
     - git-diff-check
 actions:
   enabled:

Makefile

@@ -5,17 +5,20 @@ JOBS ?= $(shell nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)
 MAKEFLAGS += -j$(JOBS) --output-sync=target
 
 .PHONY: check \
-        lint-jsort lint-oxipng lint-ruff lint-ruff-format lint-rumdl lint-shellcheck lint-shfmt lint-tombi lint-trufflehog lint-ty lint-yamllint
+        lint-checkov lint-jsort lint-oxipng lint-ruff lint-ruff-format lint-rumdl lint-shellcheck lint-shfmt lint-tombi lint-trufflehog lint-ty lint-yamllint
 
 # All tracked shell scripts (recursive, includes repo root).
 SH_FILES := $(shell git ls-files '*.sh')
 
 # High-level aggregate
-check: lint-jsort lint-oxipng lint-ruff lint-ruff-format lint-rumdl lint-shellcheck lint-shfmt lint-tombi lint-trufflehog lint-ty lint-yamllint
+check: lint-checkov lint-jsort lint-oxipng lint-ruff lint-ruff-format lint-rumdl lint-shellcheck lint-shfmt lint-tombi lint-trufflehog lint-ty lint-yamllint
 
 #################
 # Lint (parallel)
 #################
+lint-checkov:
+	uvx checkov -d .
+
 lint-jsort:
 	. linkme/.functions; \
 	jsort check

apps.toml

@@ -136,6 +136,7 @@ zsh-autosuggestions = "formula"  # Fish-like fast/unobtrusive autosuggestions fo
 zsh-syntax-highlighting = "formula"  # Fish shell like syntax highlighting for zsh
 
 [python-tools]
+checkov = "uv"  # Prevent cloud misconfigurations during build-time for IaC tools
 ipython = "uv"  # Interactive computing in Python
 marimo = "uv"  # Reactive notebook for Python [Jupyter alternative]
 mypy = "uv"  # Experimental optional static type checker for Python