Add policy test fixtures

.checkov.yml

@@ -16,3 +16,7 @@ skip-check:
   # DEFERRED, not accepted: module needs a logging_target_bucket
   # variable. Remove this skip when implemented.
   - CKV_AWS_18
+skip-path:
+  # Deliberately non-compliant Terraform used to test custom Rego
+  # rules. Excluded from the infra scan because it exists to fail.
+  - policy/fixtures

.github/workflows/policy-gate.yml

@@ -42,4 +42,4 @@ jobs:
           sudo apt-get install -y trivy
 
       - name: Run Trivy
-        run: trivy config . --exit-code 1 --severity HIGH,CRITICAL --ignorefile .trivyignore.yaml
+        run: trivy config . --exit-code 1 --severity HIGH,CRITICAL --ignorefile .trivyignore.yaml --skip-dirs policy/fixtures

policy/fixtures/violates-org-policy.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = "ap-southeast-2"
+}
+
+resource "aws_s3_bucket" "sneaky" {
+  bucket        = "grc-lab-sneaky-example"
+  force_destroy = true
+}