Type Annotation WIP
MODIFY
checkov/circleci_pipelines/base_circleci_pipelines_check.py
checkov/circleci_pipelines/base_circleci_pipelines_check.py
+from __future__ import annotations
+
+from typing import Iterable
from checkov.common.checks.base_check import BaseCheck
from checkov.common.models.enums import CheckCategories
@@ -5,7 +8,14 @@ from checkov.circleci_pipelines.registry import registry
class BaseCircleCIPipelinesCheck(BaseCheck):
- def __init__(self, name, id, supported_entities, block_type, path=None):
+ def __init__(
+ self,
+ name: str,
+ id: str,
+ supported_entities: Iterable[str],
+ block_type: str,
+ path: str | None = None,
+ ) -> None:
categories = [CheckCategories.SUPPLY_CHAIN]
super().__init__(

MODIFY
checkov/circleci_pipelines/checks/ReverseShellNetcat.py
checkov/circleci_pipelines/checks/ReverseShellNetcat.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.common.models.enums import CheckResult
from checkov.yaml_doc.enums import BlockType
@@ -5,7 +8,7 @@ import re
class ReverseShellNetcat(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Suspicious use of netcat with IP address"
id = "CKV_CIRCLECIPIPELINES_5"
super().__init__(
@@ -15,7 +18,7 @@ class ReverseShellNetcat(BaseCircleCIPipelinesCheck):
supported_entities=['jobs.*.steps[]']
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]]:
if "run" not in conf:
return CheckResult.PASSED, conf
run = conf.get("run", "")

MODIFY
checkov/circleci_pipelines/checks/ShellInjection.py
checkov/circleci_pipelines/checks/ShellInjection.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.circleci_pipelines.common.shell_injection_list import terms as bad_inputs
from checkov.common.models.enums import CheckResult
@@ -6,7 +9,7 @@ import re
class DontAllowShellInjection(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Ensure run commands are not vulnerable to shell injection"
id = "CKV_CIRCLECIPIPELINES_6"
super().__init__(
@@ -16,7 +19,7 @@ class DontAllowShellInjection(BaseCircleCIPipelinesCheck):
supported_entities=['jobs.*.steps[]']
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]]:
if "run" not in conf:
return CheckResult.PASSED, conf
run = conf.get("run", "")

MODIFY
checkov/circleci_pipelines/checks/SuspectCurlInScript.py
checkov/circleci_pipelines/checks/SuspectCurlInScript.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.common.models.enums import CheckResult
from checkov.yaml_doc.enums import BlockType
class SuspectCurlInScript(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Suspicious use of curl in run task"
id = "CKV_CIRCLECIPIPELINES_7"
super().__init__(
@@ -13,7 +16,7 @@ class SuspectCurlInScript(BaseCircleCIPipelinesCheck):
supported_entities=['jobs.*.steps[]']
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]]:
if "run" not in conf:
return CheckResult.PASSED, conf
run = conf.get("run", "")

MODIFY
checkov/circleci_pipelines/checks/image_version_not_hash.py
checkov/circleci_pipelines/checks/image_version_not_hash.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.common.models.enums import CheckResult
from checkov.yaml_doc.enums import BlockType
class ImageReferenceHashVersion(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Ensure the pipeline image version is referenced via hash not arbitrary tag."
id = "CKV_CIRCLECIPIPELINES_2"
super().__init__(
@@ -14,12 +17,12 @@ class ImageReferenceHashVersion(BaseCircleCIPipelinesCheck):
supported_entities=['jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}']
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]]:
if not isinstance(conf, dict):
- return
+ return CheckResult.PASSED, conf
image = conf.get("image", None)
if not image:
- return
+ return CheckResult.PASSED, conf
if isinstance(image, str):
if "@" in image:
return CheckResult.PASSED, conf

MODIFY
checkov/circleci_pipelines/checks/latest_image.py
checkov/circleci_pipelines/checks/latest_image.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.common.models.enums import CheckResult
from checkov.yaml_doc.enums import BlockType
class ImageReferenceLatestTag(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Ensure the pipeline image uses a non latest version tag"
id = "CKV_CIRCLECIPIPELINES_1"
super().__init__(
@@ -13,12 +16,12 @@ class ImageReferenceLatestTag(BaseCircleCIPipelinesCheck):
supported_entities=['jobs.*.docker[].{image: image, __startline__: __startline__, __endline__:__endline__}']
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]] | None:
if not isinstance(conf, dict):
- return
+ return CheckResult.PASSED, conf
image = conf.get("image", None)
if not image:
- return
+ return CheckResult.PASSED, conf
if isinstance(image, str):
if image.endswith(":latest"):
return CheckResult.FAILED, conf

MODIFY
checkov/circleci_pipelines/checks/prevent_development_orbs.py
checkov/circleci_pipelines/checks/prevent_development_orbs.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.common.models.enums import CheckResult
from checkov.yaml_doc.enums import BlockType
class PreventDevelopmentOrbs(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Ensure mutable development orbs are not used."
id = "CKV_CIRCLECIPIPELINES_3"
super().__init__(
@@ -13,7 +16,7 @@ class PreventDevelopmentOrbs(BaseCircleCIPipelinesCheck):
supported_entities=["orbs.{orbs: @}"]
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]]:
badOrbInBlock = False
for orb in conf:
if type(conf[orb]) == str:

MODIFY
checkov/circleci_pipelines/checks/prevent_volatile_orbs.py
checkov/circleci_pipelines/checks/prevent_volatile_orbs.py
+from __future__ import annotations
+from typing import Any
+
from checkov.circleci_pipelines.base_circleci_pipelines_check import BaseCircleCIPipelinesCheck
from checkov.common.models.enums import CheckResult
from checkov.yaml_doc.enums import BlockType
class PreventVolatileOrbs(BaseCircleCIPipelinesCheck):
- def __init__(self):
+ def __init__(self) -> None:
name = "Ensure unversioned volatile orbs are not used."
id = "CKV_CIRCLECIPIPELINES_4"
super().__init__(
@@ -13,7 +16,7 @@ class PreventVolatileOrbs(BaseCircleCIPipelinesCheck):
supported_entities=["orbs.{orbs: @}"]
)
- def scan_entity_conf(self, conf):
+ def scan_entity_conf(self, conf: dict[str, Any] ) -> tuple[CheckResult, dict[str, Any]]:
badOrbInBlock = False
for orb in conf:
if type(conf[orb]) == str:

Type Annotation WIP