[checkov bug] Terraform Checkov not failing properly with --hard-fail-on flag about pre-commit-terraform HOT 5 CLOSED

You're right. That's a bug in checkov - it returns wrong exit code

from pre-commit-terraform.

If you run checkov -d "$(pwd)" --hard-fail-on MEDIUM - you'll get error message and exit code 0

from pre-commit-terraform.

@CaspervdKerk please open the issue in https://github.com/bridgecrewio/checkov/
It also break their checkov pre-commit hook, as far as I can see

https://github.com/bridgecrewio/checkov/blob/05cf950fd9f1d1eaba2998d9b845b62494df060c/.pre-commit-hooks.yaml#L6-L15

from pre-commit-terraform.

Thank you for confirming my findings! I'll raise this bug on the checkov repo as well.
There is definitely some strange behavior going on. During my testing I found my code also triggered CKV_AZURE_103, which is a LOW severity check.
Using the pre-commit hook with --soft-fail and --hard-fail-on MEDIUM Checkov passes, as is expected. However, when I use the local installed Checkov CLI it fails on this LOW severity check, even though the --soft-fail and --hard-fail-on MEDIUM flags are passed...

from pre-commit-terraform.

From bridgecrewio/checkov#5560 (comment) :

Severities only work with an API key, that's why it doesn't work as expected.

from pre-commit-terraform.