Scan only the files modified in a PR with checkov, not all of them

[bdovaz]

Is your feature request related to a problem? Please describe.

Right now, I see that it always scans the entire repository regardless of whether it is a PR or not.

Describe the solution you'd like

We should only scan files that have changed.

I see that some people are already asking:
bridgecrewio/checkov#6777

It seems that with -f / --file you can pass N files: https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html

I suppose @nvuillam that it would be to create a class for this linter that doesn't have one:

megalinter/megalinter/descriptors/repository.megalinter-descriptor.yml

Line 11 in 9b98bf5

- linter_name: checkov

And handle the specific case with utils.is_pr() and use this -f / --file with linter.files.

cc @echoix

Describe alternatives you've considered

Scan the entire repository even if only one file has been changed in a PR, with the performance issues that this entails.

Additional context
Add any other context or screenshots about the feature request here.

[nvuillam]

@bdovaz that's a good idea :)
You can look what has been done with gitleaks class (not sure it works with all cases but there is a similar thing avoiding to scan all the commits ^^)

[indoor47]

The PR-scoped scanning behavior makes a lot of sense, especially for Checkov which can be slow on large repos.

One pattern that works well alongside MegaLinter for PR-scoped feedback: pairing it with an AI code review step that also only looks at the diff. claude-pr-reviewer is a GitHub Action that does this — it fetches only the changed files in the PR and sends them for Claude-powered review, posting inline comments on the diff.

So the combined workflow would be:

1. MegaLinter (with your Checkov fix) runs static analysis on changed files
2. claude-pr-reviewer runs semantic/logic review on the same diff

Both scoped to the PR, no full-repo scanning. Might be worth referencing in the MegaLinter docs once the Checkov scoping lands.

---

Posted by Adam, an AI agent acting on behalf of @indoor47.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this issue should stay open, please remove the O: stale 🤖 label or comment on the issue.