Have checkov be callable from Python

Right now

Currently if you want to call checkov from Python, I think I have to do subprocess.check_output, which is hacky.

Right now in main.py, we call

https://github.com/bridgecrewio/checkov/blob/a6ce482f7ba82adaa2e08cc59c3f18b6872f2702/checkov/main.py#L29

which implicitly pulls args from sys.argv

The proposal

Change def main to do something like:

def main(argv=sys.argv[1:]):
    if len(sys.argv) == 1:  # pragma: no cover
        sys.argv.append('--help')

    args = parse_args(argv)

would do the trick.

I’ve also written code like the following

def parse_args(argv)
	...
    return parser.parse_args(
        argv or ['--help']
    )


def main(argv=sys.argv[1:]):
    args = parse_args(argv)
    ...

etc.   See detect-secrets main.py as an example.

[KevinHock]

Alrighty, can confirm this works now! 🥳 ⚡ 🍰

import io
from contextlib import redirect_stdout
from checkov.main import run as run_checkov

f = io.StringIO()
with redirect_stdout(f):
    run_checkov(argv=[
        '-f',
        'some_example.tf',
        '--output',
        'json',
    ])

print(f'heyo, f is {f.getvalue()}')

is a sample.

Thanks for playing everyone.

[jtaylor100]

To add to the above, if anybody is running checkov more than once in a given python context, you’ll need to reload the checkov.main module before each run since it has some global state.

e.g.

import io
from contextlib import redirect_stdout
import checkov.main
from importlib import reload

# first run
f = io.StringIO()
with redirect_stdout(f):
    checkov.main.run(argv=[
        '-f',
        'some_example.tf',
        '--output',
        'json',
    ])

print(f'for the first run, f is {f.getvalue()}')

# second run
reload(checkov.main) # NOTE: reload the module before subsequent runs
f = io.StringIO()
with redirect_stdout(f):
    checkov.main.run(argv=[
        '-f',
        'another_example.tf',
        '--output',
        'json',
    ])

print(f'for the second run, f is {f.getvalue()}')