Suppress checkov false-positive on docs/language_status/dockerfile.md - #1994
Merged
squid-protocol merged 1 commit intoAug 21, 2026
Merged
Conversation
checkov's Dockerfile checks (CKV_DOCKER_2/3/7 -- missing HEALTHCHECK, no non-root USER, base image uses :latest) match this file purely because its filename contains "dockerfile", then parse plain English documentation prose (describing what GitGalaxy's regex detects, e.g. the words "HEALTHCHECK"/"USER") as if it were literal Dockerfile instructions. It's a Markdown coverage doc with no fenced code blocks at all, added in #1976. Confirmed as the actual cause of muninn failing on every push to main since #1976 merged (last green run: 68c2b01 at 23:03:49; first red run: b7a9396, #1976's own merge commit, at 00:44:19) -- not a pre-existing, unrelated flakiness as it initially looked.
Contributor
squid-protocol
deleted the
fix/muninn-checkov-dockerfile-md-false-positive
branch
August 21, 2026 02:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
muninn(this repo's security scan CI check) has been failing on every push tomainsince#1976merged (last green run:68c2b013at 23:03:49; first red run:b7a93963, #1976's own merge commit, at 00:44:19). Root-caused this while investigating why two dockerfile-tri-comparison-sweep fix PRs auto-merged despite red checks.Root cause
checkov's Dockerfile checks (
CKV_DOCKER_2/3/7-- missingHEALTHCHECK, no non-rootUSER, base image uses:latest) matchdocs/language_status/dockerfile.mdpurely because its filename contains "dockerfile" -- then parse plain English documentation prose (describing what GitGalaxy's own regex detects, e.g. literally containing the words "HEALTHCHECK"/"USER" as text) as if it were real Dockerfile instructions. It's a Markdown coverage doc with no fenced code blocks at all, not a real Dockerfile -- confirmed viagh api repos/.../code-scanning/alerts, which shows all 3 blocking findings pointing at this exact file.Fix
Adds a
muninn.ymlsuppression entry for this specific file + tool, following the exact same pattern already used formkdocs.yml's "API Exposure" false positive elsewhere in this file.Note
This was caught mid-session because I'd been treating
muninn's failure as a pre-existing, unrelated issue (it "fails on every recent push, including unrelated automated docs commits") and was about to proceed past it -- turned out the "unrelated" commits were unrelated in diff content but not in root cause, since checkov re-scans the whole repo on every run, not just the PR's own diff. Confirmed viagh run listhistory that the failure started exactly at #1976's merge, not before.🤖 Generated with Claude Code