v1.4.0 — Milestone: Central pipeline contract + shell reproducibility + streaming - acdl

v1.4.0 e050e65158

v1.4.0 — Milestone: Central pipeline contract + shell reproducibility + streaming

acdl-ci / Lint (push) Successful in 8s

Details

acdl-ci / Test (push) Successful in 14s

Details

acdl-ci / Platform check-only (offline) (push) Successful in 9s

Details

Stable

grimacing released this 2026-07-22 15:11:37 +00:00 | 535 commits to main since this release

Milestone v1.4 — Central Pipeline Contract + Shell Reproducibility + Output Streaming

v1.4 makes the CI/CD pipeline a declarative contract rather than duplicated
workflow copies, enables full shell reproducibility of the CI pipeline, and
streams terraform/checkov output so users can see what the platform is doing.

Phases

Phase	Name	Version	Status
19	central-pipeline-contract-and-shell-reproducibility	v1.4.1	complete

Requirements

REQ	Description	Status
REQ-43	Central pipeline contract (JSON Schema + YAML instance + conformance tests)	complete
REQ-44	Shell reproducibility (run_ci.sh mirrors CI pipeline)	complete
REQ-45	Output streaming (run_platform.sh streams by default, --quiet for log-only)	complete

Summary

Central pipeline contract: + as the single source of truth. Both (Gitea Actions, dev) and (GitHub Actions, production) are byte-identical and validated against the contract by 32 new tests.
Shell reproducibility: === ACDL CI Pipeline (local reproduction) ===
contract: pipelines/ci.yaml (3 stages)

── Stage 1/3: lint (py_compile) ──

lint: OK

── Stage 2/3: test (pytest) ──

============================= test session starts ==============================
platform linux -- Python 3.12.3, pytest-8.4.2, pluggy-1.6.0 -- /usr/bin/python3
cachedir: .pytest_cache
rootdir: /root/acdl
configfile: pyproject.toml
plugins: anyio-4.13.0, asyncio-0.26.0, cov-7.1.0
asyncio: mode=Mode.STRICT, asyncio_default_fixture_loop_scope=None, asyncio_default_test_loop_scope=function
collecting ... collected 122 items

tests/test_adapter.py::TestSpikeInstance::test_spike_instance_validates_against_ir_schema PASSED [ 0%]
tests/test_adapter.py::TestSpikeInstance::test_spike_instance_has_one_resource PASSED [ 1%]
tests/test_adapter.py::TestSpikeInstance::test_spike_instance_stack_is_l1_s3 PASSED [ 2%]
tests/test_adapter.py::TestRegistry::test_registry_has_7_l1_entries PASSED [ 3%]
tests/test_adapter.py::TestRegistry::test_registry_has_no_l2_entries PASSED [ 4%]
tests/test_adapter.py::TestRegistry::test_all_l1_interfaces_exist PASSED [ 4%]
tests/test_adapter.py::TestTypeMap::test_s3_in_type_map PASSED [ 5%]
tests/test_adapter.py::TestTypeMap::test_vpc_types_in_type_map PASSED [ 6%]
tests/test_adapter.py::TestTypeMap::test_ecs_types_in_type_map PASSED [ 7%]
tests/test_adapter.py::TestTypeMap::test_alb_types_in_type_map PASSED [ 8%]
tests/test_adapter.py::TestTypeMap::test_iam_and_ecr_in_type_map PASSED [ 9%]
tests/test_adapter.py::TestTfValue::test_string_quoted PASSED [ 9%]
tests/test_adapter.py::TestTfValue::test_bool_true PASSED [ 10%]
tests/test_adapter.py::TestTfValue::test_bool_false PASSED [ 11%]
tests/test_adapter.py::TestTfValue::test_int PASSED [ 12%]
tests/test_adapter.py::TestTfValue::test_float PASSED [ 13%]
tests/test_adapter.py::TestTfValue::test_dict_jsonencoded PASSED [ 13%]
tests/test_adapter.py::TestTfValue::test_list_jsonencoded PASSED [ 14%]
tests/test_adapter.py::TestTfValue::test_json_string_jsonencoded PASSED [ 15%]
tests/test_adapter.py::TestTfValue::test_ref_raises PASSED [ 16%]
tests/test_adapter.py::TestRefExpr::test_basic_ref PASSED [ 17%]
tests/test_adapter.py::TestRefExpr::test_vpc_ref PASSED [ 18%]
tests/test_adapter.py::TestRefExpr::test_unknown_id_raises PASSED [ 18%]
tests/test_adapter.py::TestAdapt::test_adapt_emits_three_files PASSED [ 19%]
tests/test_adapter.py::TestAdapt::test_main_tf_has_s3_bucket PASSED [ 20%]
tests/test_adapter.py::TestAdapt::test_main_tf_has_versioning PASSED [ 21%]
tests/test_adapter.py::TestAdapt::test_main_tf_has_outputs PASSED [ 22%]
tests/test_adapter.py::TestAdapt::test_terraform_tf_has_backend PASSED [ 22%]
tests/test_adapter.py::TestAdapt::test_providers_tf_has_aws PASSED [ 23%]
tests/test_adapter.py::TestAdapt::test_backend_key_uses_stack_name PASSED [ 24%]
tests/test_checkov_adapter.py::TestRuleMap::test_secrets_rules PASSED [ 25%]
tests/test_checkov_adapter.py::TestRuleMap::test_public_ingress_rules PASSED [ 26%]
tests/test_checkov_adapter.py::TestRuleMap::test_iam_wildcard PASSED [ 27%]
tests/test_checkov_adapter.py::TestRuleMap::test_kms PASSED [ 27%]
tests/test_checkov_adapter.py::TestRuleMap::test_all_have_severities PASSED [ 28%]
tests/test_checkov_adapter.py::TestToPcr::test_passed_result PASSED [ 29%]
tests/test_checkov_adapter.py::TestToPcr::test_failed_result PASSED [ 30%]
tests/test_checkov_adapter.py::TestToPcr::test_skipped_result PASSED [ 31%]
tests/test_checkov_adapter.py::TestToPcr::test_unknown_rule_defaults_to_info PASSED [ 31%]
tests/test_checkov_adapter.py::TestToPcr::test_pcr_validates_against_schema PASSED [ 32%]
tests/test_checkov_adapter.py::TestTagNamingSkipped::test_skipped_pcr PASSED [ 33%]
tests/test_checkov_adapter.py::TestAdapt::test_adapt_returns_list PASSED [ 34%]
tests/test_checkov_adapter.py::TestAdapt::test_adapt_includes_tag_naming PASSED [ 35%]
tests/test_checkov_adapter.py::TestAdapt::test_adapt_has_passed_and_failed PASSED [ 36%]
tests/test_checkov_adapter.py::TestAdapt::test_adapt_empty_input PASSED [ 36%]
tests/test_confidence_signal.py::TestWeights::test_weights_sum_to_one PASSED [ 37%]
tests/test_confidence_signal.py::TestWeights::test_policy_weight_highest PASSED [ 38%]
tests/test_confidence_signal.py::TestWeights::test_validation_weight PASSED [ 39%]
tests/test_confidence_signal.py::TestThresholds::test_dev_threshold PASSED [ 40%]
tests/test_confidence_signal.py::TestThresholds::test_qa_threshold PASSED [ 40%]
tests/test_confidence_signal.py::TestThresholds::test_prod_threshold PASSED [ 41%]
tests/test_confidence_signal.py::TestThresholds::test_dr_threshold PASSED [ 42%]
tests/test_confidence_signal.py::TestPenalty::test_critical_is_none PASSED [ 43%]
tests/test_confidence_signal.py::TestPenalty::test_high_penalty PASSED [ 44%]
tests/test_confidence_signal.py::TestPenalty::test_medium_penalty PASSED [ 45%]
tests/test_confidence_signal.py::TestPenalty::test_low_penalty PASSED [ 45%]
tests/test_confidence_signal.py::TestPenalty::test_info_no_penalty PASSED [ 46%]
tests/test_confidence_signal.py::TestPerInputScore::test_missing_input_returns_half PASSED [ 47%]
tests/test_confidence_signal.py::TestPerInputScore::test_empty_policy_list PASSED [ 48%]
tests/test_confidence_signal.py::TestPerInputScore::test_all_pass_policy PASSED [ 49%]
tests/test_confidence_signal.py::TestPerInputScore::test_mixed_policy PASSED [ 50%]
tests/test_confidence_signal.py::TestPerInputScore::test_skipped_counts_as_pass PASSED [ 50%]
tests/test_confidence_signal.py::TestPerInputScore::test_validation_all_true PASSED [ 51%]
tests/test_confidence_signal.py::TestPerInputScore::test_validation_partial PASSED [ 52%]
tests/test_confidence_signal.py::TestPerInputScore::test_freshness_fresh PASSED [ 53%]
tests/test_confidence_signal.py::TestPerInputScore::test_freshness_stale PASSED [ 54%]
tests/test_confidence_signal.py::TestPerInputScore::test_source_complete PASSED [ 54%]
tests/test_confidence_signal.py::TestPerInputScore::test_source_partial PASSED [ 55%]
tests/test_confidence_signal.py::TestPerInputScore::test_history_clean PASSED [ 56%]
tests/test_confidence_signal.py::TestPerInputScore::test_history_with_failures PASSED [ 57%]
tests/test_confidence_signal.py::TestPerInputScore::test_nfrs_none PASSED [ 58%]
tests/test_confidence_signal.py::TestPerInputScore::test_nfrs_full PASSED [ 59%]
tests/test_confidence_signal.py::TestCompute::test_dev_pass PASSED [ 59%]
tests/test_confidence_signal.py::TestCompute::test_missing_input_blocks PASSED [ 60%]
tests/test_confidence_signal.py::TestCompute::test_critical_policy_blocks PASSED [ 61%]
tests/test_confidence_signal.py::TestCompute::test_high_policy_lowers_score PASSED [ 62%]
tests/test_confidence_signal.py::TestCompute::test_dev_warn_becomes_block PASSED [ 63%]
tests/test_confidence_signal.py::TestCompute::test_signal_has_per_input PASSED [ 63%]
tests/test_confidence_signal.py::TestCompute::test_all_six_inputs_present PASSED [ 64%]
tests/test_outbox_writer.py::TestCanonicalHash::test_deterministic PASSED [ 65%]
tests/test_outbox_writer.py::TestCanonicalHash::test_order_independent PASSED [ 66%]
tests/test_outbox_writer.py::TestCanonicalHash::test_is_sha256_hex PASSED [ 67%]
tests/test_outbox_writer.py::TestCanonicalHash::test_different_events_different_hash PASSED [ 68%]
tests/test_outbox_writer.py::TestWriteEvent::test_write_event_with_mock_dynamodb PASSED [ 68%]
tests/test_outbox_writer.py::TestWriteEvent::test_write_event_hash_matches_canonical PASSED [ 69%]
tests/test_outbox_writer.py::TestWriteEvent::test_write_event_persists_to_dynamodb PASSED [ 70%]
tests/test_pipeline.py::TestPipelineIntegration::test_load_ir_and_adapt_offline PASSED [ 71%]
tests/test_pipeline.py::TestPipelineIntegration::test_confidence_signal_with_adapted_tf PASSED [ 72%]
tests/test_pipeline.py::TestPipelineIntegration::test_run_platform_check_only PASSED [ 72%]
tests/test_pipeline.py::TestPipelineIntegration::test_run_platform_check_only_no_aws_creds PASSED [ 73%]
tests/test_pipeline_contract.py::TestPipelineSchema::test_schema_is_valid_json_schema PASSED [ 74%]
tests/test_pipeline_contract.py::TestPipelineSchema::test_schema_has_required_fields PASSED [ 75%]
tests/test_pipeline_contract.py::TestPipelineSchema::test_schema_stage_def_has_command_and_required PASSED [ 76%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_validates_against_schema PASSED [ 77%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_has_three_stages PASSED [ 77%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_runner_is_ubuntu_latest PASSED [ 78%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_python_version PASSED [ 79%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_triggers_push_main PASSED [ 80%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_triggers_pr_main PASSED [ 81%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_all_stages_required PASSED [ 81%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_lint_command_compiles_python PASSED [ 82%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_test_command_runs_pytest PASSED [ 83%]
tests/test_pipeline_contract.py::TestPipelineContract::test_contract_check_only_runs_platform PASSED [ 84%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_workflow_exists PASSED [ 85%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_github_workflow_exists PASSED [ 86%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_workflows_are_byte_identical PASSED [ 86%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_workflow_name_matches_contract PASSED [ 87%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_workflow_has_three_jobs PASSED [ 88%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_workflow_triggers_match_contract PASSED [ 89%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_workflow_runner_matches_contract PASSED [ 90%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_workflow_python_version_matches_contract PASSED [ 90%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_lint_command_matches_contract PASSED [ 91%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_test_command_matches_contract PASSED [ 92%]
tests/test_pipeline_contract.py::TestWorkflowConformance::test_gitea_check_only_command_matches_contract PASSED [ 93%]
tests/test_pipeline_contract.py::TestRunCiScript::test_run_ci_script_exists_and_executable PASSED [ 94%]
tests/test_pipeline_contract.py::TestRunCiScript::test_run_ci_script_contains_lint_stage PASSED [ 95%]
tests/test_pipeline_contract.py::TestRunCiScript::test_run_ci_script_contains_test_stage PASSED [ 95%]
tests/test_pipeline_contract.py::TestRunCiScript::test_run_ci_script_contains_check_only_stage PASSED [ 96%]
tests/test_pipeline_contract.py::TestRunCiScript::test_run_ci_script_has_success_message PASSED [ 97%]
tests/test_pipeline_contract.py::TestRunCiScript::test_run_ci_lint_and_check_only_pass PASSED [ 98%]
tests/test_pipeline_contract.py::TestRunPlatformStreaming::test_check_only_streams_emitted_terraform PASSED [ 99%]
tests/test_pipeline_contract.py::TestRunPlatformStreaming::test_check_only_quiet_suppresses_terraform PASSED [100%]

============================= 122 passed in 2.73s ==============================
test: OK

── Stage 3/3: check-only (run_platform.sh --check-only) ──

=== Step 1+2: load pre-existing IR instance (contract resolution deferred) ===
IR: l1-s3 l1 1 resource(s)
=== Step 3: adapter compiles IR -> terraform/spike/*.tf (regenerate) ===
adapter: emitted terraform/spike/{main.tf,terraform.tf,providers.tf}

--- emitted terraform/spike/main.tf ---
resource "aws_s3_bucket" "s3" {
bucket = "acdl-spike-bucket"
versioning {
enabled = true
}
}

output "bucket_arn" {
value = aws_s3_bucket.s3.arn
}

output "bucket_name" {
value = aws_s3_bucket.s3.id
}
--- end main.tf ---

=== Step 3b: validate adapter output structure (offline) ===
adapter output: OK

=== PLATFORM CHECK OK ===
IR instance -> adapter -> structure validated (offline, no AWS)
check-only: OK

=== CI PIPELINE OK ===
3 stages passed: lint, test, check-only runs the same 3 stages (lint, test, check-only) locally.

Output streaming: === Step 1+2: load pre-existing IR instance (contract resolution deferred) ===
IR: l1-s3 l1 1 resource(s)
=== Step 3: adapter compiles IR -> terraform/spike/*.tf (regenerate) ===
adapter: emitted terraform/spike/{main.tf,terraform.tf,providers.tf}

--- emitted terraform/spike/main.tf ---
resource "aws_s3_bucket" "s3" {
bucket = "acdl-spike-bucket"
versioning {
enabled = true
}
}

output "bucket_arn" {
value = aws_s3_bucket.s3.arn
}

output "bucket_name" {
value = aws_s3_bucket.s3.id
}
--- end main.tf ---
=== Loading AWS credentials (not needed for --check-only) ===
=== Step 4: terraform init + validate + plan -lock=false (real AWS) ===

--- terraform init ---
[0m[1mInitializing the backend...[0m
[0m[32m
Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.[0m
[0m[1mInitializing provider plugins...[0m

Reusing previous version of hashicorp/aws from the dependency lock file
Using previously-installed hashicorp/aws v5.100.0

[0m[1m[32mTerraform has been successfully initialized![0m[32m[0m
[0m[32m
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.[0m

--- terraform validate ---
[33m╷[0m[0m
[33m│[0m [0m[1m[33mWarning: [0m[0m[1mArgument is deprecated[0m
[33m│[0m [0m
[33m│[0m [0m[0m with aws_s3_bucket.s3,
[33m│[0m [0m on main.tf line 1, in resource "aws_s3_bucket" "s3":
[33m│[0m [0m 1: resource "aws_s3_bucket" "s3" [4m{[0m[0m
[33m│[0m [0m
[33m│[0m [0mversioning is deprecated. Use the aws_s3_bucket_versioning resource
[33m│[0m [0minstead.
[33m╵[0m[0m
[32m[1mSuccess![0m The configuration is valid, but there were some
validation warnings as shown above.
[0m

--- terraform plan ---

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
[32m+[0m create[0m

Terraform will perform the following actions:

[1m # aws_s3_bucket.s3[0m will be created
[0m [32m+[0m[0m resource "aws_s3_bucket" "s3" {
[32m+[0m[0m acceleration_status = (known after apply)
[32m+[0m[0m acl = (known after apply)
[32m+[0m[0m arn = (known after apply)
[32m+[0m[0m bucket = "acdl-spike-bucket"
[32m+[0m[0m bucket_domain_name = (known after apply)
[32m+[0m[0m bucket_prefix = (known after apply)
[32m+[0m[0m bucket_regional_domain_name = (known after apply)
[32m+[0m[0m force_destroy = false
[32m+[0m[0m hosted_zone_id = (known after apply)
[32m+[0m[0m id = (known after apply)
[32m+[0m[0m object_lock_enabled = (known after apply)
[32m+[0m[0m policy = (known after apply)
[32m+[0m[0m region = (known after apply)
[32m+[0m[0m request_payer = (known after apply)
[32m+[0m[0m tags_all = (known after apply)
[32m+[0m[0m website_domain = (known after apply)
[32m+[0m[0m website_endpoint = (known after apply)

  [32m+[0m[0m cors_rule (known after apply)

  [32m+[0m[0m grant (known after apply)

  [32m+[0m[0m lifecycle_rule (known after apply)

  [32m+[0m[0m logging (known after apply)

  [32m+[0m[0m object_lock_configuration (known after apply)

  [32m+[0m[0m replication_configuration (known after apply)

  [32m+[0m[0m server_side_encryption_configuration (known after apply)

  [32m+[0m[0m versioning {
      [32m+[0m[0m enabled    = true
      [32m+[0m[0m mfa_delete = false
    }

  [32m+[0m[0m website (known after apply)
}

[1mPlan:[0m 1 to add, 0 to change, 0 to destroy.
[0m
Changes to Outputs:
[32m+[0m[0m bucket_arn = (known after apply)
[32m+[0m[0m bucket_name = (known after apply)
[33m╷[0m[0m
[33m│[0m [0m[1m[33mWarning: [0m[0m[1mArgument is deprecated[0m
[33m│[0m [0m
[33m│[0m [0m[0m with aws_s3_bucket.s3,
[33m│[0m [0m on main.tf line 1, in resource "aws_s3_bucket" "s3":
[33m│[0m [0m 1: resource "aws_s3_bucket" "s3" [4m{[0m[0m
[33m│[0m [0m
[33m│[0m [0mversioning is deprecated. Use the aws_s3_bucket_versioning resource
[33m│[0m [0minstead.
[33m│[0m [0m
[33m│[0m [0m(and one more similar warning elsewhere)
[33m╵[0m[0m
[90m
─────────────────────────────────────────────────────────────────────────────[0m

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
terraform apply "tfplan"

terraform plan OK (1 to add, 0 to change, 0 to destroy expected)

=== Step 5: run Checkov on terraform/spike/main.tf ===
{
"check_type": "terraform",
"results": {
"passed_checks": [
{
"check_id": "CKV_AWS_93",
"bc_check_id": "BC_AWS_S3_24",
"check_name": "Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)",
"check_result": {
"result": "PASSED",
"evaluated_keys": [
"policy"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.terraform.checks.resource.aws.S3ProtectAgainstPolicyLockout",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/bc-aws-s3-24",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_57",
"bc_check_id": "BC_AWS_S3_2",
"check_name": "S3 Bucket has an ACL defined which allows public WRITE access.",
"check_result": {
"result": "PASSED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"access_control_policy/grant//grantee/uri",
"access_control_policy/grant//permission",
"access_control_policy/grant",
"access_control_policy",
"resource_type",
"acl"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-2-acl-write-permissions-everyone",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_19",
"bc_check_id": "BC_AWS_S3_14",
"check_name": "Ensure all data stored in the S3 bucket is securely encrypted at rest",
"check_result": {
"result": "PASSED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"rule/apply_server_side_encryption_by_default/sse_algorithm",
"resource_type",
"server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-14-data-encrypted-at-rest",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_21",
"bc_check_id": "BC_AWS_S3_16",
"check_name": "Ensure all data stored in the S3 bucket have versioning enabled",
"check_result": {
"result": "PASSED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"versioning_configuration/status",
"versioning/enabled",
"resource_type"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-16-enable-versioning",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_20",
"bc_check_id": "BC_AWS_S3_1",
"check_name": "S3 Bucket has an ACL defined which allows public READ access.",
"check_result": {
"result": "PASSED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"access_control_policy/grant//grantee/uri",
"access_control_policy/grant",
"access_control_policy",
"resource_type",
"acl"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-1-acl-read-permissions-everyone",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
}
],
"failed_checks": [
{
"check_id": "CKV2_AWS_6",
"bc_check_id": "BC_AWS_NETWORKING_52",
"check_name": "Ensure that S3 bucket has a Public Access block",
"check_result": {
"result": "FAILED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"block_public_acls",
"resource_type",
"block_public_policy"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV2_AWS_62",
"bc_check_id": "BC_AWS_LOGGING_36",
"check_name": "Ensure S3 buckets should have event notifications enabled",
"check_result": {
"result": "FAILED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"resource_type"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-62",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_18",
"bc_check_id": "BC_AWS_S3_13",
"check_name": "Ensure the S3 bucket has access logging enabled",
"check_result": {
"result": "FAILED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"logging",
"resource_type"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/s3-policies/s3-13-enable-logging",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_145",
"bc_check_id": "BC_AWS_GENERAL_56",
"check_name": "Ensure that S3 buckets are encrypted with KMS by default",
"check_result": {
"result": "FAILED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"rule/apply_server_side_encryption_by_default/sse_algorithm",
"resource_type",
"server_side_encryption_configuration/rule/apply_server_side_encryption_by_default/sse_algorithm"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV2_AWS_61",
"bc_check_id": "BC_AWS_LOGGING_35",
"check_name": "Ensure that an S3 bucket has a lifecycle configuration",
"check_result": {
"result": "FAILED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"resource_type",
"lifecycle_rule"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-logging-policies/bc-aws-2-61",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
},
{
"check_id": "CKV_AWS_144",
"bc_check_id": "BC_AWS_GENERAL_72",
"check_name": "Ensure that S3 bucket has cross-region replication enabled",
"check_result": {
"result": "FAILED",
"entity": {
"aws_s3_bucket": {
"s3": {
"end_line": 6,
"start_line": 1,
"bucket": [
"acdl-spike-bucket"
],
"versioning": [
{
"enabled": [
true
]
}
],
"address": "aws_s3_bucket.s3"
}
}
},
"evaluated_keys": [
"rule//status",
"replication_configuration/rules/*/status",
"resource_type"
]
},
"code_block": [
[
1,
"resource "aws_s3_bucket" "s3" {
"
],
[
2,
" bucket = "acdl-spike-bucket"
"
],
[
3,
" versioning {
"
],
[
4,
" enabled = true
"
],
[
5,
" }
"
],
[
6,
"}
"
]
],
"file_path": "/main.tf",
"file_abs_path": "/root/acdl/terraform/spike/main.tf",
"repo_file_path": "/terraform/spike/main.tf",
"file_line_range": [
1,
6
],
"resource": "aws_s3_bucket.s3",
"evaluations": null,
"check_class": "checkov.common.graph.checks_infra.base_check",
"fixed_definition": null,
"entity_tags": null,
"caller_file_path": null,
"caller_file_line_range": null,
"resource_address": null,
"severity": null,
"bc_category": null,
"benchmarks": null,
"description": null,
"short_description": null,
"vulnerability_details": null,
"connected_node": null,
"guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled",
"details": [],
"check_len": null,
"definition_context_file_path": "/root/acdl/terraform/spike/main.tf"
}
],
"skipped_checks": [],
"parsing_errors": []
},
"summary": {
"passed": 5,
"failed": 6,
"skipped": 0,
"parsing_errors": 0,
"resource_count": 1,
"checkov_version": "3.3.8"
},
"url": "Add an api key '--bc-api-key ' to see more detailed insights via https://bridgecrew.cloud"
}

checkov summary: 6 failed, 5 passed

=== Step 6: Checkov adapter -> PolicyCheckResult (compliance details) ===
PolicyCheckResult: 12 record(s) streams terraform init/validate/plan, Checkov compliance results, and PolicyCheckResult records by default. for log-only mode.

122 tests pass (90 original + 32 new), all offline.

Downloads

128 Releases 190 Tags

v1.4.0 — Milestone: Central pipeline contract + shell reproducibility + streaming acdl-ci / Lint (push) Successful in 8s Details acdl-ci / Test (push) Successful in 14s Details acdl-ci / Platform check-only (offline) (push) Successful in 9s Details Stable

Milestone v1.4 — Central Pipeline Contract + Shell Reproducibility + Output Streaming

Phases

Requirements

Summary

v1.4.0 — Milestone: Central pipeline contract + shell reproducibility + streaming

acdl-ci / Lint (push) Successful in 8s

Details

acdl-ci / Test (push) Successful in 14s

Details

acdl-ci / Platform check-only (offline) (push) Successful in 9s

Details

Stable