Describe the issue
Inline checkov:skip suppression comments are silently ignored for CKV2_ANSIBLE_3 on Ansible block: tasks. The check always reports as FAILED regardless of a valid skip comment placed inside the block task. Other suppression mechanisms (e.g. --baseline) work correctly, confirming the issue is specific to inline suppression.
Examples
test_skip.yml:
---
- name: Reproduce CKV2_ANSIBLE_3 inline skip bug
hosts: localhost
tasks:
- name: Block with inline skip comment # checkov:skip=CKV2_ANSIBLE_3:no rescue needed, natural failure is more informative
block:
- name: Run a command
ansible.builtin.command: echo hello
changed_when: false
checkov -f test_skip.yml --framework ansible --check CKV2_ANSIBLE_3 --compact
Expected output:
Passed checks: 0, Failed checks: 0, Skipped checks: 1
Actual output:
Passed checks: 0, Failed checks: 1, Skipped checks: 0
Check: CKV2_ANSIBLE_3: "Ensure block is handling task errors properly"
FAILED for resource: block.Block with inline skip comment
File: /test_skip.yml:5-10
Version (please complete the following information):
Additional context
The --baseline workaround does suppress the check correctly, confirming the check itself is functional and only the inline suppression path is broken. Inline suppression works correctly for non-block Ansible task checks (e.g. CKV_ANSIBLE_1), so the bug is specific to the graph check path used by CKV2_ANSIBLE_3.
Describe the issue
Inline
checkov:skipsuppression comments are silently ignored forCKV2_ANSIBLE_3on Ansibleblock:tasks. The check always reports asFAILEDregardless of a valid skip comment placed inside the block task. Other suppression mechanisms (e.g.--baseline) work correctly, confirming the issue is specific to inline suppression.Examples
test_skip.yml:Expected output:
Actual output:
Version (please complete the following information):
Additional context
The
--baselineworkaround does suppress the check correctly, confirming the check itself is functional and only the inline suppression path is broken. Inline suppression works correctly for non-block Ansible task checks (e.g.CKV_ANSIBLE_1), so the bug is specific to the graph check path used byCKV2_ANSIBLE_3.