[DoloresGarciaE]

Description

Adds Checkov infrastructure-as-code scanning to CI. The new Checkov workflow scans GitHub Actions workflows (plus any Dockerfile or Kubernetes manifest added later) on pushes and pull requests to dev/main, and can be run manually. Findings are surfaced three ways: inline run annotations (the action's problem matcher), a job summary, and code scanning alerts (SARIF upload under the checkov category).

Phase 1 is informational: .checkov.yml sets soft-fail: true, so the check stays green while findings are reported. The blocking hard-fail-on list for the critical GitHub Actions checks is already written in the config, commented out.

Related Issue

Closes #393 (part of #369)

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactoring
• Performance improvement
• Other (please describe): CI / security tooling

Changes Made

• .github/workflows/checkov.yml: new workflow (push/PR to dev and main, workflow_dispatch); bridgecrewio/checkov-action pinned to a commit SHA (v12.3135.0); outputs cli,sarif,github_failed_only; failed checks appended to the job summary; SARIF uploaded with github/codeql-action/upload-sarif@v4, skipped on fork PRs where GITHUB_TOKEN is read-only. Top-level permissions: contents: read, job-level security-events: write.
• .checkov.yml: explicit frameworks (github_actions, dockerfile, kubernetes), soft-fail: true, documented phase-2 hard-fail-on block and skip-check placeholder, quiet/compact for console output.
• README.md: Checkov workflow badge.
• .claude/rules/commands.md: local scan commands (pipx and Docker) and where findings show up.

Screenshots (if applicable)

N/A

Checklist

• I have run npm run format:fix and npm run lint:fix (N/A: no src/ changes; Biome does not cover YAML/Markdown)
• I have run npm run typecheck with no errors (N/A)
• I have run tests with npm run test:run (N/A)
• I have tested my changes locally
• I have updated documentation if needed
• My code follows the project's architecture patterns

Additional Notes

• First local run (bridgecrew/checkov Docker image, Checkov 3.3.30): 469 passed, 11 failed, all CKV2_GHA_1. That check fails whenever a workflow has no top-level permissions: block, even when permissions are set at job level. The 11 workflows are audit, lint, publish-npm, e2e-all, e2e-nightly and the six e2e-* suites. They are left as informational findings in this PR; the fix is adding permissions: / contents: read at the top of each file, and it is a prerequisite for enabling hard-fail-on with CKV2_GHA_1.
• Severity-based blocking (CRITICAL/HIGH) does not work without a Prisma Cloud API key (built-in checks carry no severity), so phase 2 uses explicit check IDs.
• The secrets framework is intentionally excluded: tx hashes, addresses and the Hardhat test keys trip high-entropy detection, and secret scanning is tracked separately (Gitleaks, Quality Tooling Rollout #369).
• worker/wrangler.toml cannot be covered by built-in policies (Checkov has no TOML parser); it only holds variable names.
• The README badge shows "no status" until the workflow runs on main.
• The problem-matcher annotations render as errors even though the job is green in informational mode; they can be dropped with ::remove-matcher owner=checkov:: if they get in the way.