Checkov's SoftFail not documented, working, and ignored by MSDO #169

Activity

1. Dima Birenbaum (DimaBir)

   self-assigned this

   on Jun 1, 2026
2. Dima Birenbaum (DimaBir)

   added

   type:questionGeneral question or support requestGeneral question or support request

   type:docsImprovements or additions to documentationImprovements or additions to documentation

   area:taskAzure DevOps build task definition and configurationAzure DevOps build task definition and configuration

   area:toolsIndividual security tool configuration and issuesIndividual security tool configuration and issues

   on Jun 1, 2026
3. DimaBir commented on Jun 1, 2026

   

   Dima Birenbaum (DimaBir)

   on Jun 1, 2026

   Collaborator

   More actions

   Hi ncook-hxgn, thanks for the detailed writeup — the command output and logs made it easy to see exactly what's happening.

   The short version is that SoftFail and the build break are two separate mechanisms, and SoftFail only affects the first one:

   • SoftFail: true in your .gdnconfig controls Checkov's own exit code. As you saw, MSDO passes --soft-fail through and Checkov exits 0. That part is working as intended.
   • Whether the pipeline fails is decided separately by MSDO, not by the individual tool's exit code. MSDO evaluates the SARIF results against its policy and raises BreakException (exit 8) when it finds breaking results. --soft-fail changes Checkov's exit code but doesn't remove the findings from the SARIF, so MSDO still sees them and breaks. That's why it looks like your exit code is being ignored — MSDO is intentionally not relying on it.

   The knob you actually want is the break input on the task, not the tool config. Setting it to false lets the scan run and publish findings without failing the step:

   - task: MicrosoftSecurityDevOps@1
     inputs:
       break: false

   break defaults to false, so if your build is failing on exit 8 you most likely have it set to true somewhere — happy to take a look if you can share the task block.

   On your first point, you're right that this interaction isn't documented, and that's a fair gap — the relationship between a tool's SoftFail and the task's break behavior should be spelled out. I've tagged this as a docs item so we track it.

   Let me know if switching break to false gets you what you're after.

   ❤️React with ❤️1Reacted by ncook-hxgn
4. Dima Birenbaum (DimaBir)

   added

   status:waiting-on-authorWaiting for more information from authorWaiting for more information from author

   on Jun 1, 2026