Checkov treats files outside of given path as rules and fails

Author: yardbirdsaxCreated May 20, 2025Updated Sep 13, 2026

Labelsstale

Starting with the release of version 3.2.427, we are seeing Checkov treat files outside of the path passed to the --external-checks-git flag as if they were checks.

For example, I have a repository structured like this:

.
├── rules
│   ├── __init__.py
│   ├── __pycache__
│   ├── runtime
│   ├── static
├── tests
│   ├── __init__.py
│   ├── __pycache__
│   ├── runtime
│   ├── static

I then pass https://github.com/org/repo//rules/runtime to the --external-checks-git flag.

When run, we get this error:

running checkov on file: /github/workspace/repo/something/plan.json
checkov -f /github/workspace/repo/something/plan.json  --check CKV_INTERNAL*      --skip-results-upload     --external-checks-git https://github.com/org/repo//rules/runtime  --output sarif
Error: -20 10:36:14,107 [MainThread  ] [ERROR]  Cannot load external check 'test_run_checkov' from /github/workspace/e2ba652c_checks/result/tests/run_checkov/test_run_checkov.py

Expected behavior Only the files in the rules/runtime folder should be loaded and executed as checks.

Source: bridgecrewio/checkov

View original on GitHub View discussion on GitHub