Two-stage policy scan per item 20:
1. Checkov on static code BEFORE terraform plan (fail-fast, quick dev
feedback). Added to run_platform.sh Step 3c + run_codegen.sh Step 3c
(runs on the authored TF dir before plan, using --framework terraform).
2. Runtime policy scan on the plan AFTER terraform plan: Wiz when
configured (WIZ_API_TOKEN + WIZ_API_URL), else Checkov against the
plan as a drop-in replacement (--framework terraform_plan). Wiz and
Checkov are NEVER both run on the plan. Replaces the old single
Checkov-on-main.tf step in run_platform.sh Step 5 + run_postapply.sh
Step 5.
pipelines/contract.yml: stage list updated — 'checkov' stage replaced by
'checkov-static' (before terraform-plan) + 'runtime-policy-scan' (after
terraform-plan). 9 stages → 10 stages. Header comment updated.
adapters/wiz/wiz_adapter.py: add --plan mode CLI (fetch_and_adapt_plan)
for scanning a terraform plan; backward-compat with the positional
<wiz_issues.json> <contract-id> mode. is_configured() gates the Wiz path.
Tests: test_pipeline_contract.py (9 → 10 stages, new stage names);
test_contract_resolver.py (rename test, assert checkov-static +
runtime-policy-scan present, old 'checkov' gone). Full suite: 685 pass
+ 1 pre-existing attestation failure (NOVA_ATTESTATION_SIGNING_KEY_ID
unset, unrelated to v1.21, fails on main without these changes too).
---ci---
project: acdl
phase: 4
milestone: v1.21
status: execute
phase_role: execution
---/ci---
Jon Chery