Toward Checkov and Trivy coverage

Roadmap

v0.2 is an attribute scanner. The epics below close Checkov graph/plan/Helm/catalog gaps and Trivy secrets/SCA, without putting a CVE database on the default scan path.

ROADMAP.md · All epics

v0.3 — graph and Terraform evaluation

#1 Resource graph / CKV2_*

Composite checks across resources. Checkov’s catalog is incomplete without this.

#2 Terraform eval, modules, plan JSON

Variables, locals, OpenTofu, terraform_plan. Interpolations that resolve stop being unknown.

v0.4 — packaging and more IaC

#3 Helm and Kustomize

Render to Kubernetes IR; reuse CKV_K8S_*. Same class of work as Checkov/Trivy config.

#6 ARM, Bicep, Ansible, Serverless, OpenAPI, SAM

Formats Checkov already scans that 0.2 does not.

v0.5 — catalog, pipelines, secrets

#4 Catalog depth

Toward Checkov’s 1000+ policies: remaining AWS, then Azure and GCP. Every check keeps fixtures.

#5 CI/CD as code

GitHub Actions, GitLab CI, Azure Pipelines, CircleCI, Argo Workflows.

#7 Secrets

Checkov secrets and Trivy secret rules, redacted in SARIF.

v1.0 — compliance and optional Trivy SCA

#10 Compliance and Rego

CIS/NSA packs; optional Rego for existing Conftest/Trivy policies.

#9 Live Kubernetes

Trivy k8s-style cluster scan via kubeconfig. No mutation.

#8 Vulns, licenses, SBOM

Opt-in --scanners vuln. Default scan stays IaC-only so CI does not fetch a CVE DB.