fix(general): skip scanning VCS configuration if only files are passed in

checkov/bitbucket/runner.py

@@ -33,10 +33,13 @@ def run(
 
         self.prepare_data()
 
-        report = super().run(root_folder=self.bitbucket.bitbucket_conf_dir_path, external_checks_dir=external_checks_dir,
-                             files=files,
-                             runner_filter=runner_filter, collect_skip_comments=collect_skip_comments)
-        # JsonRunner._change_files_path_to_relative(report)
+        report = super().run(
+            root_folder=self.bitbucket.bitbucket_conf_dir_path,
+            external_checks_dir=external_checks_dir,
+            files=None,  # ignore file scans
+            runner_filter=runner_filter,
+            collect_skip_comments=collect_skip_comments,
+        )
 
         return report
 

checkov/github/runner.py

@@ -33,9 +33,13 @@ def run(
 
         self.prepare_data()
 
-        report = super().run(root_folder=self.github.github_conf_dir_path, external_checks_dir=external_checks_dir,
-                             files=files,
-                             runner_filter=runner_filter, collect_skip_comments=collect_skip_comments)
+        report = super().run(
+            root_folder=self.github.github_conf_dir_path,
+            external_checks_dir=external_checks_dir,
+            files=None,  # ignore file scans
+            runner_filter=runner_filter,
+            collect_skip_comments=collect_skip_comments,
+        )
         JsonRunner._change_files_path_to_relative(report)  # type:ignore[arg-type]  # report can only be of type Report, not a list
         return report
 

checkov/gitlab/runner.py

@@ -35,7 +35,7 @@ def run(
         report = super().run(
             root_folder=self.gitlab.gitlab_conf_dir_path,
             external_checks_dir=external_checks_dir,
-            files=files,
+            files=None,  # ignore file scans
             runner_filter=runner_filter,
             collect_skip_comments=collect_skip_comments,
         )

tests/bitbucket/test_runner.py

@@ -1,5 +1,6 @@
 import os
 import unittest
+from pathlib import Path
 from unittest import mock
 
 from checkov.bitbucket.runner import Runner
@@ -70,6 +71,25 @@ def test_runner_object_passing_check(self):
         self.assertEqual(len(report.passed_checks), 1)
         self.assertEqual(report.skipped_checks, [])
 
+    @mock.patch.dict(os.environ, {"CKV_BITBUCKET_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True)
+    def test_runner_files_ignore(self):
+        # given
+        test_file = Path(__file__).parent / "resources/bitbucket_conf/pass/branch_restrictions.json"
+        checks = ["CKV_BITBUCKET_1"]
+
+        # when
+        report = Runner().run(
+            files=[str(test_file)],
+            runner_filter=RunnerFilter(checks=checks)
+        )
+
+        # then
+        # even it points to a file with scannable content, it should skip it
+        self.assertEqual(len(report.passed_checks), 0)
+        self.assertEqual(len(report.failed_checks), 0)
+        self.assertEqual(len(report.parsing_errors), 0)
+        self.assertEqual(len(report.skipped_checks), 0)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/github/test_runner.py

@@ -1,5 +1,6 @@
 import os
 import unittest
+from pathlib import Path
 from unittest import mock
 
 from checkov.common.bridgecrew.check_type import CheckType
@@ -140,6 +141,25 @@ def test_runner_object_passing_check(self):
         self.assertEqual(len(report.passed_checks), 3)
         self.assertEqual(report.skipped_checks, [])
 
+    @mock.patch.dict(os.environ, {"CKV_GITHUB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True)
+    def test_runner_files_ignore(self):
+        # given
+        test_file = Path(__file__).parent / "resources/github_conf/pass/org_security.json"
+        checks = ["CKV_GITHUB_1", "CKV_GITHUB_2", "CKV_GITHUB_3"]
+
+        # when
+        report = Runner().run(
+            files=[str(test_file)],
+            runner_filter=RunnerFilter(checks=checks)
+        )
+
+        # then
+        # even it points to a file with scannable content, it should skip it
+        self.assertEqual(len(report.passed_checks), 0)
+        self.assertEqual(len(report.failed_checks), 0)
+        self.assertEqual(len(report.parsing_errors), 0)
+        self.assertEqual(len(report.skipped_checks), 0)
+
 
 if __name__ == "__main__":
     unittest.main()

tests/gitlab/test_runner.py

@@ -1,5 +1,6 @@
 import os
 import unittest
+from pathlib import Path
 from unittest import mock
 
 from checkov.common.bridgecrew.check_type import CheckType
@@ -63,6 +64,25 @@ def test_runner_object_passing_check(self):
         self.assertEqual(len(report.passed_checks), 2)
         self.assertEqual(report.skipped_checks, [])
 
+    @mock.patch.dict(os.environ, {"CKV_GITLAB_CONFIG_FETCH_DATA": "False", "PYCHARM_HOSTED": "1"}, clear=True)
+    def test_runner_files_ignore(self):
+        # given
+        test_file = Path(__file__).parent / "resources/gitlab_conf/pass/merge_request_approval_conf.json"
+        checks = ["CKV_GITLAB_1", "CKV_GITLAB_2"]
+
+        # when
+        report = Runner().run(
+            files=[str(test_file)],
+            runner_filter=RunnerFilter(checks=checks)
+        )
+
+        # then
+        # even it points to a file with scannable content, it should skip it
+        self.assertEqual(len(report.passed_checks), 0)
+        self.assertEqual(len(report.failed_checks), 0)
+        self.assertEqual(len(report.parsing_errors), 0)
+        self.assertEqual(len(report.skipped_checks), 0)
+
     def test_registry_has_type(self):
         self.assertEqual(registry.report_type, CheckType.GITLAB_CONFIGURATION)