Skip to content

fix(ansible): respect inline checkov:skip on block tasks#7583

Open
m-khan-97 wants to merge 1 commit into
bridgecrewio:mainfrom
m-khan-97:fix/ansible-block-inline-skip
Open

fix(ansible): respect inline checkov:skip on block tasks#7583
m-khan-97 wants to merge 1 commit into
bridgecrewio:mainfrom
m-khan-97:fix/ansible-block-inline-skip

Conversation

@m-khan-97

Copy link
Copy Markdown

Summary

  • Fixes inline checkov:skip suppression silently ignored for Ansible block checks #7501: inline checkov:skip=CKV2_ANSIBLE_3:... (and any other graph check) comments placed on an Ansible block: task were silently ignored, so the check always reported FAILED instead of SKIPPED.
  • Root cause: in checkov/ansible/utils.py, _process_blocks built the suppression-context key for a block as f"{prefix}.{name}" where prefix already ends in "." (e.g. "block."), producing "block..name". The graph builder (checkov/ansible/graph_builder/local_graph.py) creates the corresponding vertex ID as f"{prefix}{name}""block.name". The mismatched keys meant the skip lookup in the suppression logic never found the resource's skip comment.
  • Fix removes the extra ., so the context key now matches the graph vertex ID exactly, the same way generate_task_name already does for non-block tasks.

Test plan

  • Added tests/ansible/examples/block_skip.yml reproducing the reported scenario (a block: task with an inline checkov:skip=CKV2_ANSIBLE_3 comment).
  • Added test_runner_with_block_skip in tests/ansible/test_runner.py (parametrized over both graph connectors) asserting the check is now reported as SKIPPED with the correct resource id.
  • Ran the full tests/ansible/ suite locally — all existing tests still pass (no regressions for flat tasks, blocks, or nested blocks).
  • Manually reproduced the original bug and confirmed the fix resolves it:
    checkov -f test_skip.yml --framework ansible --check CKV2_ANSIBLE_3 --compact
    # before: FAILED for resource: block.Block with inline skip comment
    # after:  SKIPPED for resource: block.Block with inline skip comment
    

The suppression-context key for a block resource was built with one
extra "." than the graph builder's vertex ID (e.g. "block..name" vs
"block.name"), so the skip lookup never matched and inline
checkov:skip comments on block tasks (e.g. for CKV2_ANSIBLE_3) were
silently ignored.

Fixes bridgecrewio#7501
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

inline checkov:skip suppression silently ignored for Ansible block checks

1 participant