apiVersion: atmos/v1
kind: Policy
metadata:
  name: lifecycle-scan-production
  description: "Require a Checkov scan before planning a production Terraform component."
spec:
  policies:
    scan-production:
      on: operation
      engine: starlark
      action: hooks
      rule: |
        return ctx.input["event"] == "before.terraform.plan" and ctx.input["stack"].startswith("prod-")

      hooks:
        - ref: production-scan
          event: before.terraform.plan
          required: true
          require_success: true
  hooks:
    production-scan:
      kind: command
      command: checkov
      args:
        - --directory
        - .
  tools: {}