Skip to content

checkov fails to download external modules #235

Closed
Closed
checkov fails to download external modules#235
Assignees
DimaBir
Labels
area:msdo-cliMSDO CLI integration and executionstatus:waiting-on-authorWaiting for more information from authortype:featureNew feature or request

Description

@seanstark
seanstark-ms (seanstark)
opened on Apr 3, 2026

I started seeing checkov failures on downloading external modules to support scanning functionality. Since the checkov.exe is not including the --download-external-modules flag this failing.

  • Need the ability to include the --download-external-modules flag
D:\a\_msdo\packages\nuget\Microsoft.Guardian.CheckovRedist_windows_amd64.3.2.497\tools\dist\checkov.exe --directory .\ --output sarif --soft-fail --output-file-path D:\a\aks-store-demo\aks-store-demo\.gdn\.r\checkov\001\checkov.sarif

Error:      2026-04-03 17:00:19,354 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-documentdb-databaseaccount/azurerm:0.10.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,354 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-containerregistry-registry/azurerm:0.4.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,354 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-containerservice-managedcluster/azurerm:0.1.7 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,356 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-cognitiveservices-account/azurerm:0.10.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:19,356 [ThreadPoolEx] [WARNI]  Failed to download module Azure/avm-res-servicebus-namespace/azurerm:0.4.0 (for external modules, the --download-external-modules flag is required)

Error:      2026-04-03 17:00:21,600 [ThreadPoolEx] [WARNI]  Fail to read file .\.github\workflows\test-e2e-pr.yml. error: 'charmap' codec can't decode byte 0x9d in position 1457: character maps to <undefined>`

Activity

  1. Dima Birenbaum (DimaBir)
    added
    type:featureNew feature or request
    status:team-reviewQueued for team review and decision
    area:msdo-cliMSDO CLI integration and execution
    on Apr 5, 2026

  2. DimaBir commented on Apr 5, 2026

    @DimaBir
    Dima Birenbaum (DimaBir)
    on Apr 5, 2026
    Collaborator

    Hi seanstark-ms (@seanstark), thanks for reporting this.

    You can enable --download-external-modules today by setting an environment variable in your workflow:

    - uses: microsoft/security-devops-action@latest
  env:
    GDN_CHECKOV_DOWNLOADEXTERNALMODULES: "true"
  with:
    tools: checkov

    MSDO supports passing arguments to individual tools through the GDN_<ToolName>_<ArgumentId> environment variable pattern. You can find more details on the wiki.

    Let me know if that resolves the issue for you.

  3. Dima Birenbaum (DimaBir)
    added
    status:waiting-on-authorWaiting for more information from author
    and removed
    status:team-reviewQueued for team review and decision
    on Apr 5, 2026
  4. Dima Birenbaum (DimaBir)
    self-assigned this
    on Apr 5, 2026

  5. seanstark commented on Apr 10, 2026

    @seanstark
    seanstark-ms (seanstark)
    on Apr 10, 2026
    Author

    Looks that worked, thank you

  6. Dima Birenbaum (DimaBir)
    closed this as completedon Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:msdo-cliMSDO CLI integration and executionstatus:waiting-on-authorWaiting for more information from authortype:featureNew feature or request

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions