feat: add checkov

[martimlobao]

• remove from trunk

[cursor]

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on February 25.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds Checkov as a standalone IaC security check run via uv in CI and local Makefile workflows, removes its Trunk integration, and wires up minimal configuration to support running it through existing tooling.

Flow diagram for updated make check with lint-checkov

flowchart TD
  MakeCheck["make check"]

  MakeCheck --> LintCheckov["lint-checkov: uvx checkov -d ."]
  MakeCheck --> LintJs["lint-jsort"]
  MakeCheck --> LintOxipng["lint-oxipng"]
  MakeCheck --> LintRuff["lint-ruff"]
  MakeCheck --> LintRuffFormat["lint-ruff-format"]
  MakeCheck --> LintRumdl["lint-rumdl"]
  MakeCheck --> LintShellcheck["lint-shellcheck"]
  MakeCheck --> LintShfmt["lint-shfmt"]
  MakeCheck --> LintTombi["lint-tombi"]
  MakeCheck --> LintTrufflehog["lint-trufflehog"]
  MakeCheck --> LintTy["lint-ty"]
  MakeCheck --> LintYamllint["lint-yamllint"]

  LintCheckov --> CheckovCLI["Checkov via uvx (IaC security checks)"]

Loading

File-Level Changes

Change	Details	Files
Introduce a dedicated Checkov job in the lint_pr GitHub Actions workflow, executed via uv.	Add a new checkov job that runs on ubuntu-latest in the lint PR workflow Check out the repository before running checks Install uv using the astral-sh/setup-uv GitHub Action Execute uvx checkov -d . to scan the repository	.github/workflows/lint_pr.yaml
Integrate Checkov into the local lint/check flow via Makefile.	Add lint-checkov to the list of phony lint targets Wire lint-checkov into the aggregate check target so it runs with other linters Implement lint-checkov target to run uvx checkov -d .	Makefile
Adjust CI validation and tooling configuration to accommodate Checkov and its runtime management outside Trunk.	Enable ACTIONS_ALLOW_UNSECURE_COMMANDS for the semantic pull request validation job, likely required by a used action Remove Checkov from Trunk’s managed linters so it is no longer run via Trunk Declare checkov as a Python tool managed via uv in apps.toml with a short description	.github/workflows/validate_pr.yaml .trunk/trunk.yaml apps.toml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The checkov invocation is now duplicated between the Makefile and the GitHub Action; consider calling the Makefile target from the workflow (or vice versa) to keep behavior in one place and avoid future drift.
• You previously pinned checkov via Trunk but now run uvx checkov without a version; if reproducibility matters, consider pinning the checkov version (e.g., via uv lockfile or explicit version) to avoid unexpected changes in CI behavior.
• Enabling ACTIONS_ALLOW_UNSECURE_COMMANDS: true in validate_pr.yaml weakens GitHub’s security model; it would be good to document why this is needed or see if the semantic PR action can be configured in a way that doesn’t require this flag.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `checkov` invocation is now duplicated between the Makefile and the GitHub Action; consider calling the Makefile target from the workflow (or vice versa) to keep behavior in one place and avoid future drift.
- You previously pinned `checkov` via Trunk but now run `uvx checkov` without a version; if reproducibility matters, consider pinning the checkov version (e.g., via uv lockfile or explicit version) to avoid unexpected changes in CI behavior.
- Enabling `ACTIONS_ALLOW_UNSECURE_COMMANDS: true` in `validate_pr.yaml` weakens GitHub’s security model; it would be good to document why this is needed or see if the semantic PR action can be configured in a way that doesn’t require this flag.

## Individual Comments

### Comment 1
<location> `.github/workflows/validate_pr.yaml:22` </location>
<code_context>
       - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # 6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ACTIONS_ALLOW_UNSECURE_COMMANDS: true
</code_context>

<issue_to_address>
**🚨 issue (security):** Avoid enabling `ACTIONS_ALLOW_UNSECURE_COMMANDS` unless strictly necessary, as it weakens GitHub Actions security.

This re-enables deprecated, unsafe workflow commands and increases command injection risk. Please check whether a newer version or configuration of the semantic PR action can avoid this env var. If you must keep it, restrict its usage as much as possible and clearly document the rationale in the workflow file.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}