feat(security): Add checkov for security check

[ThomasSanson]

it should be added to the github workflow as a warning for now

[tchiotludo]

Don't understand the goal of this one? We don't have terraform inside the repo ?

[ThomasSanson]

@tchiotludo Checkov scans these IaC file types:

• Terraform (for AWS, GCP, Azure and OCI)
• CloudFormation (including AWS SAM)
• Azure Resource Manager (ARM)
• Serverless framework
• Helm charts
• Kubernetes
• Docker

It will make a little duplicate with kics indeed but I find it complementary 😇

[tchiotludo]

Does it offered more than dependabot for the both of them? Having many scan solution will suffer to have duplicated notification than it's really hard and take a lot of time for maintainer to analyse.

[ThomasSanson]

Yes I understand and share (but it doesn't seem to me that dependabot does all this).

That's why I advise to put only in warning

[tchiotludo]

I've already this activated :

• https://codeql.github.com/ activated here
• Dependabot alerts

[ThomasSanson]

Hum 🤔, if you find it not necessary, feel free to refuse the 2 pull requests, I would not be offended 😇

I don't know codeql and I don't know how to access the results locally, I'll look into it when I have time 😅

Thanks for this discovery

[tchiotludo]

I'm not refusing them, I just challenging them :smile: Too many alert is not a life :skull:

If you have a fully automated solution like dependanbot (create a PR, launch test), i'm ok with that :+1:

[ThomasSanson]

I'll look into running this via dependabot