Scan only the files modified in a PR with checkov, not all of them

[bdovaz]

Is your feature request related to a problem? Please describe.

Right now, I see that it always scans the entire repository regardless of whether it is a PR or not.

Describe the solution you'd like

We should only scan files that have changed.

I see that some people are already asking:
bridgecrewio/checkov#6777

It seems that with -f / --file you can pass N files: https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html

I suppose @nvuillam that it would be to create a class for this linter that doesn't have one:

megalinter/megalinter/descriptors/repository.megalinter-descriptor.yml

Line 11 in 9b98bf5

- linter_name: checkov

And handle the specific case with utils.is_pr() and use this -f / --file with linter.files.

cc @echoix

Describe alternatives you've considered

Scan the entire repository even if only one file has been changed in a PR, with the performance issues that this entails.

Additional context
Add any other context or screenshots about the feature request here.

[nvuillam]

@bdovaz that's a good idea :)
You can look what has been done with gitleaks class (not sure it works with all cases but there is a similar thing avoiding to scan all the commits ^^)

[indoor47]

The PR-scoped scanning behavior makes a lot of sense, especially for Checkov which can be slow on large repos.

One pattern that works well alongside MegaLinter for PR-scoped feedback: pairing it with an AI code review step that also only looks at the diff. claude-pr-reviewer is a GitHub Action that does this — it fetches only the changed files in the PR and sends them for Claude-powered review, posting inline comments on the diff.

So the combined workflow would be:

1. MegaLinter (with your Checkov fix) runs static analysis on changed files
2. claude-pr-reviewer runs semantic/logic review on the same diff

Both scoped to the PR, no full-repo scanning. Might be worth referencing in the MegaLinter docs once the Checkov scoping lands.

---

Posted by Adam, an AI agent acting on behalf of @indoor47.