feat(azure_pipelines): support custom pipeline file names and directories - #7641
Open
SandwichProtector wants to merge 2 commits into
Open
feat(azure_pipelines): support custom pipeline file names and directories#7641SandwichProtector wants to merge 2 commits into
SandwichProtector wants to merge 2 commits into
Conversation
…rRole The YAML check previously evaluated rules.resourceNames existence across the entire Role, not per-rule. A ClusterRole with one unrestricted secrets rule plus a scoped rule with resourceNames incorrectly passed. Replace three attribute checks with a single JSONPath that looks for the risky case on the same rule entry: resources includes secrets or wildcard, verbs includes get, watch, list or wildcard, and resourceNames is absent. Check now passes only when no such unscoped rule exists. Add MixedResourceNamesClusterRole fixture and update expected to require failure for mixed-secrets-global binding. Retains existing passing fixtures for scoped resourceNames. Fixes bridgecrewio#7616
…ries Fixes bridgecrewio#7525. Previously Runner.is_workflow_file only accepted azure-pipelines.yml/yaml, blocking custom names like .azuredevops/pr-pipeline.yaml or pipelines/ci.yml. Support any yaml that is in .azuredevops/, pipelines/, contains pipeline or azure in name, and also any yaml when framework is azure_pipelines for full custom support via --file. Preserves backward compat for standard names.
SandwichProtector
requested a deployment
to
scan-security
August 10, 2026 12:40 — with 
GitHub Actions
Waiting
GitHub Actions
Waiting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7525
Why
The Azure Pipelines runner currently only recognizes canonical names
azure-pipelines.yml/azure-pipelines.yaml. Teams keep pipelines under custom names likeci.yml,pr-pipeline.yaml,/pipelines/,.azuredevops/and there is no way to make the runner scan them. Forcing--framework azure_pipelinesdoes not help becauseis_workflow_file()rejects the file before parsing.What
Extended
Runner.is_workflow_file()incheckov/azure_pipelines/runner.pyto:azure-pipelines.yml/yamlsupport.yml/.yamlwhen path contains.azuredevops/orpipelines/.yml/.yamlwhen filename containspipelineorazure.yml/.yamlwhen framework is azure_pipelines for full custom support via explicit--filepassing likeci.ymlThis matches issue request to allow users to pass custom file names and directories.
Backward compatible: all previous names still work, non-yaml files still rejected.
There is also open PR #7533 proposing env var
CHECKOV_AZURE_PIPELINES_FILE_NAMES. This PR is simpler, zero-config, and directly solves the reported UX where--file .azuredevops/pr-pipeline.yaml --framework azure_pipelinesshould just work.Tests
Current test suite:
tests/azure_pipelines/test_runner.py- 3 tests still passE2E Proof
Full log:
checkov-7525-e2e.logattached in trajectory.Examples from issue
Closes #7525