From 29e05bd04134bb6818b42f3fc85c6cad963bb3ae Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Mon, 19 Oct 2026 20:35:02 -0600
Subject: [PATCH] ci(checkov): commit skip config instead of reading a repo
 variable

Fork PRs do not receive repository variables, so the
'Write skip checks config' step wrote an empty .checkov.yaml and
checkov exited 2 with 'config file ... returned type NoneType'.

Move the skip list into a committed .checkov.yaml, which checkov loads
automatically, and drop the step and the CHECKOV_SKIP_CHECKS variable.

Verified locally with checkov 3.3.29: --show-config loads the file and
the chart scan reports 1442 passed / 0 failed, same as main.

Amp-Thread-ID: https://ampcode.com/threads/T-01a1571c-39af-708a-a421-a575d606dae7
Co-authored-by: Amp <amp@ampcode.com>
---
 .checkov.yaml                 | 30 ++++++++++++++++++++++++++++++
 .github/workflows/checkov.yml |  5 +----
 2 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 .checkov.yaml

diff --git a/.checkov.yaml b/.checkov.yaml
new file mode 100644
index 00000000..3f786e93
--- /dev/null
+++ b/.checkov.yaml
@@ -0,0 +1,30 @@
+skip-path:
+  - .github/*
+  - charts/sourcegraph/examples/*
+skip-check:
+  - CKV_GHA_7
+  - CKV_K8S_8
+  - CKV_K8S_9
+  - CKV_K8S_10
+  - CKV_K8S_11
+  - CKV_K8S_12
+  - CKV_K8S_13
+  - CKV_K8S_14
+  - CKV_K8S_15
+  - CKV_K8S_16
+  - CKV_K8S_17
+  - CKV_K8S_20
+  - CKV_K8S_21
+  - CKV_K8S_22
+  - CKV_K8S_23
+  - CKV_K8S_26
+  - CKV_K8S_28
+  - CKV_K8S_29
+  - CKV_K8S_30
+  - CKV_K8S_31
+  - CKV_K8S_35
+  - CKV_K8S_37
+  - CKV_K8S_38
+  - CKV_K8S_40
+  - CKV_K8S_43
+  - CKV2_K8S_6
diff --git a/.github/workflows/checkov.yml b/.github/workflows/checkov.yml
index 8112c5bf..28f57d7a 100644
--- a/.github/workflows/checkov.yml
+++ b/.github/workflows/checkov.yml
@@ -21,11 +21,8 @@ jobs:
 
       - name: Install Checkov
         run: pip install checkov
-        
-      - name: Write skip checks config
-        run: |
-            echo "${{ vars.CHECKOV_SKIP_CHECKS }}" > .checkov.yaml
 
+      # Skip list lives in .checkov.yaml, which checkov picks up automatically.
       - name: Run Checkov scan
         run: |
           checkov -d ./charts --output cli --output sarif --output-file-path console,results.sarif