Skip to content

inline checkov:skip suppression silently ignored for Ansible block checks #7501

@pydepinject

Description

@pydepinject

Describe the issue
Inline checkov:skip suppression comments are silently ignored for CKV2_ANSIBLE_3 on Ansible block: tasks. The check always reports as FAILED regardless of a valid skip comment placed inside the block task. Other suppression mechanisms (e.g. --baseline) work correctly, confirming the issue is specific to inline suppression.

Examples

test_skip.yml:

---
- name: Reproduce CKV2_ANSIBLE_3 inline skip bug
  hosts: localhost
  tasks:
    - name: Block with inline skip comment  # checkov:skip=CKV2_ANSIBLE_3:no rescue needed, natural failure is more informative
      block:
        - name: Run a command
          ansible.builtin.command: echo hello
          changed_when: false
checkov -f test_skip.yml --framework ansible --check CKV2_ANSIBLE_3 --compact

Expected output:

Passed checks: 0, Failed checks: 0, Skipped checks: 1

Actual output:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV2_ANSIBLE_3: "Ensure block is handling task errors properly"
    FAILED for resource: block.Block with inline skip comment
    File: /test_skip.yml:5-10

Version (please complete the following information):

  • Checkov Version 3.2.517

Additional context
The --baseline workaround does suppress the check correctly, confirming the check itself is functional and only the inline suppression path is broken. Inline suppression works correctly for non-block Ansible task checks (e.g. CKV_ANSIBLE_1), so the bug is specific to the graph check path used by CKV2_ANSIBLE_3.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions