Please UPDATE checkov version

[andreibadescu]

[jbrotsos]

@andreibadescu we are in the process of updating Checkov. I'll close this issue once we have pushed the update.

[danmacode]

Hi @andreibadescu @jbrotsos
Can we set the Checkov version directly via environment variables or .gdnconfig file?

The checkov.gdnconfig file has a version attribute. Could I force the MicrosoftSecurityDevOps@1 task read from a .gdnconfig file and thus use my desired version?

# azure-pipelines.yaml
trigger: none
pool:
  vmImage: 'windows-latest'
steps:
- task: MicrosoftSecurityDevOps@1
  displayName: 'Microsoft Security DevOps'
  inputs:    
    config: $(Build.SourcesDirectory)/pipelines/checkov.gdnconfig

Not sure if version Key can force a checkov upgrade.

// /pipelines/checkov.gdnconfig
{
  "fileVersion": "0",
  "jobs": [],
  "commands": [],
  "tools": [
    {
      "fileVersion": "0",
      "tool": {
        "name": "checkov",
        "version": "3.2.199" // <- Can I configure this?
      },
      "arguments": {
        ...

The other option would be to use env vars but GDN_CHECKOV_VERSION only prints the Checkov version and exits, according to https://github.com/microsoft/security-devops-action/wiki#checkov-environment-variables :

# azure-pipelines.yaml
trigger: none
pool:
  vmImage: 'windows-latest'
steps:
- task: MicrosoftSecurityDevOps@1
  displayName: 'Microsoft Security DevOps'
  inputs:    
    env:
      GDN_CHECKOV_VERSION: true # <- only prints version

---

EDIT: I've seen this option takes no effect and tool versions are fixed.

I will instead try to merge the SARIF output from standalone Checkov into the MicrosoftSecurityDevOps@1 SARIF result (excluding Checkov).