From b0d8b842e589c50a6c1d4e1ed5a7d26d781c8b05 Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Wed, 17 Jun 2026 17:06:05 -0400
Subject: [PATCH] security-review: surgically exclude only cdk.out asset
 bundles from checkov (A2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The prior exclusion (--skip-path cdk.out) stopped the CDK-repo stall but also
silenced checkov on cdk.out/<stack>.template.json — the actual deploy artifact —
losing real S3/IAM IaC coverage (CKV_AWS_53-56, CKV_AWS_111). Switch to skipping
only the cdk.out asset.<hash>/ dependency bundles (the stall cause) so the
synthesized templates are still scanned.

- --skip-path 'cdk\.out/asset\.' anchors to cdk.out so a source file literally
  named asset.* is not also excluded; keeps cdk.out/*.template.json scanned.
- venv/dist/build kept as bare names (match anywhere); .venv/.aws-sam escaped.

cfn-lint + semgrep already prune these trees (prior commit). gitleaks runs in
git-mode and respects .gitignore, so cdk.out is already skipped there.

Verified: shellcheck clean; synthetic cdk.out test confirms the stack template is
scanned while asset.* is skipped; the orchestrator's own --scanners-only gate
still exits 0 with suppressions (inert on non-CDK repos: A1==A2 findings here).
---
 security-review/review.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/security-review/review.sh b/security-review/review.sh
index 1980449..17ca224 100755
--- a/security-review/review.sh
+++ b/security-review/review.sh
@@ -111,7 +111,12 @@ else note_missing gitleaks "brew install gitleaks"; fi
 if command -v checkov >/dev/null; then
   CKALL="$TMP/ck.json"; echo '[]' > "$CKALL"
   for p in $SCOPE_PATHS; do
-    if [ -d "$p" ]; then RAW="$(checkov -d "$p" --skip-path cdk.out --skip-path node_modules --skip-path .venv --skip-path venv --skip-path .aws-sam --skip-path dist --skip-path build -o json --compact --quiet 2>/dev/null || true)"
+    # --skip-path is a regex over the file path. Skip only the cdk.out asset.<hash>/
+    # dependency bundles (the stall cause) + vendored/generated dirs — but KEEP
+    # scanning cdk.out/<stack>.template.json, which is the real deploy artifact
+    # (dropping it would silence genuine S3/IAM IaC findings). asset is anchored to
+    # cdk.out so a source file literally named asset.* is not also excluded.
+    if [ -d "$p" ]; then RAW="$(checkov -d "$p" --skip-path 'cdk\.out/asset\.' --skip-path node_modules --skip-path '\.venv' --skip-path venv --skip-path '\.aws-sam' --skip-path dist --skip-path build -o json --compact --quiet 2>/dev/null || true)"
     else RAW="$(checkov -f "$p" -o json --compact --quiet 2>/dev/null || true)"; fi
     [ -z "$RAW" ] && continue
     FC="$(echo "$RAW" | jq '[ (if type=="array" then .[] else . end).results.failed_checks // [] ] | add // []' 2>/dev/null || echo '[]')"