From 3ac02f2adf425a3d0af2b3cb04cb0c9105430b79 Mon Sep 17 00:00:00 2001
From: Luskish <76147806+Luskish@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:54:31 -0400
Subject: [PATCH] P2S1: policy fixtures, excluded from infra scan

---
 .checkov.yml                           |  4 ++++
 .github/workflows/policy-gate.yml      |  2 +-
 policy/fixtures/violates-org-policy.tf | 17 +++++++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 policy/fixtures/violates-org-policy.tf

diff --git a/.checkov.yml b/.checkov.yml
index bc4f37e..1589876 100644
--- a/.checkov.yml
+++ b/.checkov.yml
@@ -16,3 +16,7 @@ skip-check:
   # DEFERRED, not accepted: module needs a logging_target_bucket
   # variable. Remove this skip when implemented.
   - CKV_AWS_18
+skip-path:
+  # Deliberately non-compliant Terraform used to test custom Rego
+  # rules. Excluded from the infra scan because it exists to fail.
+  - policy/fixtures
diff --git a/.github/workflows/policy-gate.yml b/.github/workflows/policy-gate.yml
index 3edb5a4..5e3a764 100644
--- a/.github/workflows/policy-gate.yml
+++ b/.github/workflows/policy-gate.yml
@@ -42,4 +42,4 @@ jobs:
           sudo apt-get install -y trivy
 
       - name: Run Trivy
-        run: trivy config . --exit-code 1 --severity HIGH,CRITICAL --ignorefile .trivyignore.yaml
+        run: trivy config . --exit-code 1 --severity HIGH,CRITICAL --ignorefile .trivyignore.yaml --skip-dirs policy/fixtures
diff --git a/policy/fixtures/violates-org-policy.tf b/policy/fixtures/violates-org-policy.tf
new file mode 100644
index 0000000..43040b3
--- /dev/null
+++ b/policy/fixtures/violates-org-policy.tf
@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "ap-southeast-2"
+}
+
+resource "aws_s3_bucket" "sneaky" {
+  bucket        = "grc-lab-sneaky-example"
+  force_destroy = true
+}