pkgs/development/tools/analysis/checkov/default.nix

   1 {
   2   lib,
   3   fetchFromGitHub,
   4   python3,
   5 }:
   6
   7 python3.pkgs.buildPythonApplication rec {
   8   pname = "checkov";
   9   version = "3.2.334";
  10   pyproject = true;
  11
  12   src = fetchFromGitHub {
  13     owner = "bridgecrewio";
  14     repo = "checkov";
  15     rev = "refs/tags/${version}";
  16     hash = "sha256-UY3EXGOo9xXU/Iqzwk2+pcbtMYQwuEU9G3uETWL3o2o=";
  17   };
  18
  19   patches = [ ./flake8-compat-5.x.patch ];
  20
  21   pythonRelaxDeps = [
  22     "bc-detect-secrets"
  23     "bc-python-hcl2"
  24     "boto3"
  25     "botocore"
  26     "cloudsplaining"
  27     "cyclonedx-python-lib"
  28     "dpath"
  29     "igraph"
  30     "importlib-metadata"
  31     "license-expression"
  32     "networkx"
  33     "openai"
  34     "packageurl-python"
  35     "packaging"
  36     "pycep-parser"
  37     "rustworkx"
  38     "schema"
  39     "termcolor"
  40     "urllib3"
  41   ];
  42
  43   pythonRemoveDeps = [
  44     # pythonRelaxDeps doesn't work with that one
  45     "pycep-parser"
  46   ];
  47
  48   build-system = with python3.pkgs; [ setuptools-scm ];
  49
  50   dependencies = with python3.pkgs; [
  51     aiodns
  52     aiohttp
  53     aiomultiprocess
  54     argcomplete
  55     bc-detect-secrets
  56     bc-jsonpath-ng
  57     bc-python-hcl2
  58     boto3
  59     cachetools
  60     charset-normalizer
  61     cloudsplaining
  62     colorama
  63     configargparse
  64     cyclonedx-python-lib
  65     docker
  66     dockerfile-parse
  67     dpath
  68     flake8
  69     gitpython
  70     igraph
  71     jmespath
  72     jsonschema
  73     junit-xml
  74     license-expression
  75     networkx
  76     openai
  77     packaging
  78     policyuniverse
  79     prettytable
  80     pycep-parser
  81     pyyaml
  82     pydantic
  83     rustworkx
  84     semantic-version
  85     spdx-tools
  86     tabulate
  87     termcolor
  88     tqdm
  89     typing-extensions
  90     update-checker
  91   ];
  92
  93   nativeCheckInputs = with python3.pkgs; [
  94     aioresponses
  95     distutils
  96     mock
  97     pytest-asyncio
  98     pytest-mock
  99     pytest-xdist
 100     pytestCheckHook
 101     responses
 102   ];
 103
 104   preCheck = ''
 105     export HOME=$(mktemp -d);
 106   '';
 107
 108   disabledTests = [
 109     # No API key available
 110     "api_key"
 111     # Requires network access
 112     "TestSarifReport"
 113     "test_skip_mapping_default"
 114     # Flake8 test
 115     "test_file_with_class"
 116     "test_dataclass_skip"
 117     "test_typing_class_skip"
 118     # Tests are comparing console output
 119     "cli"
 120     "console"
 121     # Assertion error
 122     "test_runner"
 123     "test_same_resources_in_report_and_coordinator"
 124     # AssertionError: assert ['<?xml versi...
 125     "test_get_cyclonedx_report"
 126     # Test fails on Hydra
 127     "test_sast_js_filtered_files_by_ts"
 128     # Timing sensitive
 129     "test_non_multiline_pair_time_limit_creating_report"
 130   ];
 131
 132   disabledTestPaths = [
 133     # Tests are pulling from external sources
 134     # https://github.com/bridgecrewio/checkov/blob/f03a4204d291cf47e3753a02a9b8c8d805bbd1be/.github/workflows/build.yml
 135     "integration_tests/"
 136     "tests/ansible/"
 137     "tests/arm/"
 138     "tests/bicep/"
 139     "tests/cloudformation/"
 140     "tests/common/"
 141     "tests/dockerfile/"
 142     "tests/generic_json/"
 143     "tests/generic_yaml/"
 144     "tests/github_actions/"
 145     "tests/github/"
 146     "tests/kubernetes/"
 147     "tests/sca_package_2"
 148     "tests/terraform/"
 149     "cdk_integration_tests/"
 150     "sast_integration_tests"
 151     # Performance tests have no value for us
 152     "performance_tests/test_checkov_performance.py"
 153     # No Helm
 154     "dogfood_tests/test_checkov_dogfood.py"
 155   ];
 156
 157   pythonImportsCheck = [ "checkov" ];
 158
 159   postInstall = ''
 160     chmod +x $out/bin/checkov
 161   '';
 162
 163   meta = with lib; {
 164     description = "Static code analysis tool for infrastructure-as-code";
 165     homepage = "https://github.com/bridgecrewio/checkov";
 166     changelog = "https://github.com/bridgecrewio/checkov/releases/tag/${version}";
 167     longDescription = ''
 168       Prevent cloud misconfigurations during build-time for Terraform, Cloudformation,
 169       Kubernetes, Serverless framework and other infrastructure-as-code-languages.
 170     '';
 171     license = licenses.asl20;
 172     maintainers = with maintainers; [
 173       anhdle14
 174       fab
 175     ];
 176   };
 177 }