ci(checkov): silence errors on forks - #968

Problem

The Checkov workflow writes .checkov.yaml from ${{ vars.CHECKOV_SKIP_CHECKS }} at runtime. Fork PRs don't receive repository variables, so the file ends up empty and checkov exits 2:

checkov: error: The config file doesn't appear to contain 'key: value' pairs (aka. a YAML mapping). yaml.load('.../.checkov.yaml') returned type 'NoneType' instead of 'dict'.

The SARIF upload step then fails because results.sarif was never written. Example: https://github.com/sourcegraph/deploy-sourcegraph-helm/actions/runs/39357525392/job/118415955536?pr=902

Fix

Commit the skip list as .checkov.yaml (same contents as the repo variable, sorted) and drop the runtime step. Checkov loads .checkov.yaml from the working directory automatically. This matches how deploy-sourcegraph-managed already does it.

The CHECKOV_SKIP_CHECKS repo variable can be deleted once this merges.

Test plan

• checkov --show-config -d ./charts loads the committed file with the same skip-path / skip-check lists as the variable
• Local scan with checkov 3.3.29: helm 1442 passed / 0 failed, identical to main's last green run (https://github.com/sourcegraph/deploy-sourcegraph-helm/actions/runs/39320664161)
• Checkov Scan workflow on this PR

Review

Reviewed on 2026-11-13 (review thread). No open issues.

• The committed .checkov.yaml parses as a mapping with 2 skip-path and 26 skip-check entries, the same set as the CHECKOV_SKIP_CHECKS repository variable
• Reproduced the fork failure locally with an empty config file (checkov 3.4.5 exits 2 and writes no results.sarif), and a local scan with the committed file gives the same result as main: helm 1442 passed, 0 failed
• Not proven until after merge: the SARIF upload on a pull request from a fork. Every fork run so far failed before reaching the upload. PR fix(executor): render tolerations as json #902 is from a fork and can confirm it with a new push
• No chart changes, so there was nothing to test on a cluster
• The title says "silence errors"; nothing is silenced, the cause of the error is removed