Repository navigation
fix(ci): scan the PR head, not the base branch, in reusable scan workflows - #18
Merged
Merged
Conversation
…flows Under pull_request_target, a bare actions/checkout@v4 checks out the base branch, so the Checkov and TFLint jobs scanned main instead of the pull request code. Use the same head-sha pattern that terraform-deploy-test.yml already uses, with a fallback to github.sha for push runs.
rzkw
approved these changes
Oct 19, 2026
rzkw
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The reusable
checkov-scan.ymlandtflint-scan.ymlworkflows use a bareactions/checkout@v4. Underpull_request_target, a bare checkout resolves to the base branch, so both jobs have been scanningmaininstead of the pull request code. This was found while reviewing PR #15: its Checkov job kept failing with findings and line numbers that belong tomain.This PR adds an explicit
refto both workflows, using the same pattern thatterraform-deploy-test.ymlalready uses for its checkout step: the pull request head SHA forpull_request_targetruns, andgithub.shaas the fallback for push runs.Effect: Checkov and TFLint jobs scan the code of the pull request that triggered them. PR #15's Checkov check can only turn green after this PR merges into
mainand its checks are re-run, becausepull_request_targetalways runs the workflow definition from the base branch.Type of Change
Environment Impact
Checklist