Hello @btilford

I think we may be able to satisfy what you're after as-is. I'm not sure about excluding dirs yet. But checkout below:

I use this action configuration to run a recursive checkov scan only in the 'modules' directory. By specifying 'framework: terraform' I am only running terraform scans.

      - name: Run Checkov action
        id: checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: modules/
          quiet: false
          soft_fail: false
          framework: terraform
          output_format: cli

Will this do what you want? You could do things like use several blocks if you want to choose different specific dirs and subdirs to scan.

Did not test, but directory: dir1/ -d dir2/ -d dir3/ might do the trick to scan selected set of directories.

While we're at it, can we enable Checkov GH actions to take multiple directories?

Edit: Alternative could be to run Checkov multiple times by changing directory variable from matrix which is dynamically built based on extracted changed directories in the repository. Similar to: https://tomasvotruba.com/blog/2020/11/16/how-to-make-dynamic-matrix-in-github-actions/

@alen-z I'm using .checkov.yaml to work around more options than the GitHub Action supports, such as a list of directories to skip using skip-path.

Here is my working template that I use in this and other repos:

https://github.com/HariSekhon/Templates/blob/master/.checkov.yaml