# add_checkov_skips.py

Reads checkov failures from a GitHub PR comment and inserts `#checkov:skip` annotations into the matching Terraform files.

## Prerequisites

- Python 3
- `gh` CLI authenticated (`gh auth login`)

## Basic usage

Run from the workspace directory that contains the `.tf` files:

```bash
python3 add_checkov_skips.py <PR_NUMBER> \
  --repo <owner/repo> \
  --root . \
  --path-map "<remote_path_prefix>="
```

The `--path-map` strips the remote file path prefix so the script can find local files.  
For example, if the checkov comment shows `aoma-core/prod/iam/core/foo.tf` but locally the file is at `./foo.tf`, use:

```bash
--path-map "aoma-core/prod/iam/core/="
```

> **Note:** Include the trailing `/` in the prefix to avoid a leading slash in the result.

## Examples

```bash
# IAM workspace (run from sme-aoma-core-prod/iam/)
python3 add_checkov_skips.py 34354 \
  --repo theorchard/terraform-infra \
  --root . \
  --path-map "aoma-core/prod/iam/core/="

# Target a specific checkov comment (not the latest)
python3 add_checkov_skips.py 34354 \
  --repo theorchard/terraform-infra \
  --root . \
  --path-map "aoma-core/prod/iam/core/=" \
  --comment-index 0 # (0 = oldest, -1 = latest, -2 = second to last, etc.)

# List all checkov comments on a PR
python3 add_checkov_skips.py 34354 \
  --repo theorchard/terraform-infra \
  --list-comments
```

## Options

| Flag | Description |
|---|---|
| `--root` | Local directory to resolve files against (default: `.`) |
| `--path-map REMOTE=LOCAL` | Map remote path prefix to local prefix. Repeatable. |
| `--comment-index` | Which checkov comment to use: `0`=oldest, `-1`=latest (default) |
| `--list-comments` | List all checkov comments with their index, then exit |
| `--debug` | Print raw parsing output for troubleshooting |

## Notes

- Safe to rerun — already annotated resources are skipped (`ALREADY PRESENT`)
- `NOT FOUND` usually means an incorrect `--path-map` (check the remote path in the output)