From 2f73c1c91d414b47fcc8a7be266f1a40f30003ad Mon Sep 17 00:00:00 2001 From: KaifAhmad1 Date: Wed, 24 Jun 2026 13:31:19 +0530 Subject: [PATCH] fix(ci): add .checkov.yaml soft-fail to silence tool-error break in MSDO Active results are 0 and 'Found no breaking results' but MSDO still fails because checkov exits with code 1 whenever it finds any violation (including MEDIUM/LOW below the minimum severity threshold). MSDO v1.12.0 treats a non-zero tool exit code as a breaking result even when Guardian reports no active findings. soft-fail: true makes checkov exit 0 in all cases. MSDO Guardian still reads the full SARIF output and would surface any HIGH/CRITICAL findings as active results that break the build, so the security posture is unchanged. --- .checkov.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .checkov.yaml diff --git a/.checkov.yaml b/.checkov.yaml new file mode 100644 index 00000000..0c64913c --- /dev/null +++ b/.checkov.yaml @@ -0,0 +1,9 @@ +# Checkov configuration for MSDO (Microsoft Security DevOps) CI. +# +# soft-fail: true makes checkov exit with code 0 regardless of findings. +# MSDO Guardian still reads the SARIF output produced by checkov and surfaces +# any HIGH/CRITICAL violations as "active results" that break the build. +# Without this setting, checkov exits 1 on any violation (even MEDIUM/LOW), +# which MSDO v1.12.0 treats as a tool error and breaks the build even when +# Active results = 0. +soft-fail: true