Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Add option to output checks skipped from baseline

See original GitHub issue

Is your feature request related to a problem? Please describe. Yes. We’ve inherited a terraform repo with a lot of legacy problems. We’ve introduced checkov to ensure new config going forward meets our standards. We’ve also generated baseline files for all of the existing legacy terraform config, so that we only fail checks for new problems. However, we’d like to keep visibility on all of the baseline/legacy config that we’re skipping. In particular, with junitxml output, we’d like to see the checks that are being skipped due to the baseline. So we’d effectively be treating all of the legacy config as skipped tests with visibility on those as we update/fix them.

Describe the solution you’d like Add the ability to explicitly output baseline-skipped checks as baseline-skipped. For junitxml output formatting, render these as skipped tests.

Describe alternatives you’ve considered We’ve considered running checkov twice. Once with the --baseline flag and once without, and then comparing the output junitxml files. Failures unique to the run without the --baseline flag would basically be those skipped checks, so we could post-process the result XML and display those as skipped tests. However, this is pretty ugly.