Skip to main content
Checkov is a static code analysis tool for scanning Infrastructure as Code (IaC) files for misconfigurations. CodeRabbit runs Checkov version 3.3.11.

​
Files

Checkov will run on files with the following names and extensions:
  • .tf
  • .yml
  • .yaml
  • .json
  • .template
  • .bicep
  • .hcl
  • bower.json
  • build.gradle
  • build.gradle.kts
  • go.sum
  • gradle.properties
  • METADATA
  • npm-shrinkwrap.json
  • package.json
  • package-lock.json
  • pom.xml
  • requirements.txt
  • Dockerfile
  • .dockerfile
  • Dockerfile.*
  • .csproj
  • yarn.lock
  • Gemfile
  • Gemfile.lock
  • go.mod
  • paket.dependencies
  • paket.lock
  • packages.config
  • composer.json
  • composer.lock

​
Configuration

Checkov is enabled by default. Enable or disable it with .coderabbit.yaml or the CodeRabbit web UI:
.coderabbit.yaml
CodeRabbit reads .checkov.yaml or .checkov.yml from the repository root. CodeRabbit will include the following severity levels based on the profile selected:

​
Chill

  • MEDIUM
  • HIGH
  • CRITICAL

​
Assertive

  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL

​
When we skip Checkov

CodeRabbit will skip Checkov entirely or skip individual files when:
  • Checkov is already configured in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
  • The repository’s .checkov.yml or .checkov.yaml config sets external-checks-dir, external-checks-git, external_checks_dir, or external_checks_git to a non-empty value.
  • An individual file is unavailable in the sandbox worktree.
  • An individual file is 8 MiB or larger.