Add checkov GitHub actions

[dlpzx]

Feature or Bugfix

• Feature

Detail

Checkov

Add checkov github action on PRs and push to main
Checkov scans ignore the paths: tests/, .github, compose/, docker/dev/ that contain support or local development files.

The PR ignores the findings, which should (or not) be handled in a separate PR

• CKV_DOCKER_2, CKV_DOCKER_4 are skipped in the checkov github action definition. They are LOW severity recommendations
  • CKV_DOCKER_2 - Healthcheck instructions have not been added to container images
  • CKV_DOCKER_4 - Copy is not used instead of Add in Dockerfiles
• Some CloudFormation findings on the pivot role and in the cdk execution role YAML templated are skipped with # checkov:skip= comments. We should review each finding one by one.

In addition, other next steps include the assessment of how we can synthesize cdk templates so that checkov scans them.

Other changes

• upgraded all Python version to 3.9 in all actions
• removed duplicated static-checking.yaml test in favor of flake8 (Renamed from Lint
• standardize names

Relates

• Add checkov security scanner to the build #881

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

• Does this PR introduce or modify any input fields or queries - this includes
  fetching data from storage outside the application (e.g. a database, an S3 bucket)?
  • Is the input sanitized?
  • What precautions are you taking before deserializing the data you consume?
  • Is injection prevented by parametrizing queries?
  • Have you ensured no eval or similar functions are used?
• Does this PR introduce any functionality or component that requires authorization?
  • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
  • Are you logging failed auth attempts?
• Are you using or adding any cryptographic features?
  • Do you use a standard proven implementations?
  • Are the used keys controlled by the customer? Where are they stored?
• Are you introducing any new policies/roles/users?
  • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[noah-paige]

Left 1 minor comment but otherwise think it is good to approve this PR to add checkov Github Workflow

Can use the following open issues to tackle Checkov scanner exceptions 1-by-1:

• Remove access without constraints on the pivotRole #875
• Remove access without constraints on the cdk custom execution policy #876
• Remove access without constraints on various policies #877

[noah-paige]

Looks good!