Checkov升级提示致CI流水线失败，求跳过更新检查方法

问题情况 #

2022年11月21日美国东部时间约11:30起，CI流水线因Checkov弹出需要手动输入的升级/功能增强提示，导致执行失败，报错如下：

$ checkov
       _               _              
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V / 
  \___|_| |_|\___|\___|_|\_\___/ \_/  
                                      
By bridgecrew.io | version: 2.1.244 
Update available 2.1.244 -> 2.2.80
Run pip3 install -U checkov to update 
Would you like to “level up” your Checkov powers for free?  The upgrade includes: 
• Command line docker Image scanning
• Software Composition Analysis
• Centralized policy management
• Free bridgecrew.cloud account with API access
• Auto-fix remediation suggestions
• Enabling of VS Code Plugin
• Dashboard visualisation of Checkov scans
• Integration with GitHub for:
    ◦   Automated Pull Request scanning
    ◦   Auto remediation PR generation
• Integration with up to 100 cloud resources for:
    ◦   Automated cloud resource checks
    ◦   Resource drift detection
and much more...
It's easy and only takes 2 minutes. We can do it right now!
To Level-up, press 'y'... 
Level up? (y/n): Traceback (most recent call last):
  File "/usr/bin/checkov", line 9, in <module>
    sys.exit(run())
  File "/usr/lib/python3.10/site-packages/checkov/main.py", line 368, in run
    bc_integration.onboarding()
  File "/usr/lib/python3.10/site-packages/checkov/common/bridgecrew/platform_integration.py", line 696, in onboarding
    reply = self._input_levelup_results()
  File "/usr/lib/python3.10/site-packages/checkov/common/bridgecrew/platform_integration.py", line 860, in _input_levelup_results
    result = str(input('Level up? (y/n): ')).lower().strip()  # nosec
EOFError: EOF when reading a line
Uploading artifacts for failed job
00:01
Uploading artifacts...
WARNING: plan.json: no matching files              
ERROR: No files to upload

已尝试操作 #

尝试通过pip3 install -U checkov升级Checkov，但升级后运行checkov --version仍显示2.1.244，此问题暂不优先处理，当前核心需求是完全跳过Checkov的更新检查及相关输入提示。

当前.checkov.yaml配置 #

compact: true
quiet: true
skip-download: false
download-external-modules: true
directory:
 - ./
skip-check:
 - CKV_AWS_18  
 - CKV_AWS_50  
 - CKV_AWS_115 
 - CKV_AWS_116
 - CKV_AWS_117 
 - CKV_AWS_158 
 - CKV_AWS_173 
 - CKV_OPENAPI_4  # some APIs are public
 - CKV_OPENAPI_5  # some APIs are public
 - LOW 

解决方案 #

针对Checkov 2.1.244版本，可通过以下两种方式跳过更新检查和输入提示：

1. 环境变量方式 #

在CI执行Checkov命令前设置环境变量，或者直接在命令前拼接：

# 方式一：提前设置环境变量
export CHECKOV_DISABLE_UPDATE_CHECK=true
export BC_SKIP_ONBOARDING=true
checkov [你的其他运行参数]

# 方式二：命令行直接携带环境变量
CHECKOV_DISABLE_UPDATE_CHECK=true BC_SKIP_ONBOARDING=true checkov [你的其他运行参数]

2. 修改配置文件方式 #

在现有的.checkov.yaml中添加以下配置项：

disable-update-check: true
skip-onboarding: true

修改后的完整配置示例：

compact: true
quiet: true
disable-update-check: true
skip-onboarding: true
skip-download: false
download-external-modules: true
directory:
 - ./
skip-check:
 - CKV_AWS_18  
 - CKV_AWS_50  
 - CKV_AWS_115 
 - CKV_AWS_116
 - CKV_AWS_117 
 - CKV_AWS_158 
 - CKV_AWS_173 
 - CKV_OPENAPI_4  # some APIs are public
 - CKV_OPENAPI_5  # some APIs are public
 - LOW 

注：关于升级后版本未更新的问题，大概率是系统中存在多个Checkov安装路径，可通过which checkov查看当前执行的Checkov路径，pip3 show checkov查看pip安装的路径，调整PATH优先级或使用绝对路径运行新版本即可。

内容的提问来源于stack exchange，提问作者Dominic O'Connor