Checkov Integration Guide

Integrate Checkov with Vulnetix. Scan IaC for security misconfigurations with SARIF, CycloneDX, and SPDX output.

Install & scan

$ uv run --with checkov checkov --version
$ uv run --with checkov checkov -d . -o sarif --output-file-path .

Run Checkov in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run Checkov
  run: |
    pip install checkov
    checkov -d . -o sarif --output-file-path .
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: checkov
    path: results_sarif.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Checkov's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Checkov. Keep running it. Vulnetix sits on top of Checkov (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Checkov is strongest at its core category and also carries features in Container & Image Scanning, Secret Scanning, SCA, SBOM Generation, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Checkov does well

• Graph-based scanning builds a resource connection graph so policies can reason across related IaC resources (e.g. a security group referenced by an instance), catching misconfigs single-file scanners miss
• Broad framework support (Terraform/plan, CloudFormation, SAM, Kubernetes, Helm, Kustomize, ARM, Bicep, Serverless, OpenTofu, Dockerfile) with 750+ built-in policies
• Genuinely multi-domain for an OSS tool: adds SCA for open-source packages and images, plus entropy-based secrets detection with optional live key verification
• Deep Prisma Cloud/Palo Alto integration and custom policies in Python or YAML, with SARIF and CycloneDX outputs

Where Vulnetix adds to it: Checkov is the strongest multi-domain scanner of the four, so Vulnetix leans on it: it ingests Checkov IaC/SCA/secrets findings and deduplicates them with its own scanners into one prioritised queue. Vulnetix then adds what Checkov lacks, EPSS/KEV/LEV exploit-intel prioritisation, reachability for its SCA findings, immutable versioned VEX, EOL and SSVC policy, and Safe Harbour fix PRs. Better together, not a replacement.

No migration, no rip-and-replace. Checkov keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Checkov results in Vulnetix

Upload Checkov SARIF, CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Checkov documentation ↗  ·  Source repository ↗

Wire Checkov into your CI/CD pipeline →