We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
check CKV_SECRET_6 fails even when suppressed
**Describe the bug**
Checkov raises FAILED check CKV_SECRET_6 when running against a project even if the check is suppressed. However if running checkov on a single terraform file it doesn't flag the same error.

**To Reproduce**
Steps to reproduce the behaviour:
1. Create a single terraform file and save in under a new dir (test/main.tf) with a resource would fail this check but make a comment so checkov suppresses the alert:
```
resource "aws_emr_cluster" "cluster" {
  #checkov:skip=CKV_SECRET_6:todo
  #checkov:skip=CKV2_AWS_7:todo
  name          = "emr"
  termination_protection = true
  ebs_root_volume_size = 10
  service_role = "emr_role"
  master_instance_fleet {
    name = "emr-leader"
    target_on_demand_capacity = 1
    instance_type_configs {
      instance_type = var.emr_leader_instance_type

      ebs_config {
        size = "64"
        type = "gp2"
        volumes_per_instance = 1
      }
      configurations {
        classification = "spark-defaults"
        properties = {
          "spark.cassandra.connection.host" = "cassandra.domain.co.uk",
          "spark.cassandra.connection.port" = "9999",
          "spark.cassandra.auth.username" = "user123",
          "spark.cassandra.auth.password" = "pass123", #checkov:skip=CKV_SECRET_6:todo
        }
      }
    }
  }
}
```
2. Run cli command  `checkov -f test/main.tf`
3. Observe result behaves as expected:
```
...
 secrets scan results:

Passed checks: 0, Failed checks: 0, Skipped checks: 1

Check: CKV_SECRET_6: "Base64 High Entropy String"
	SKIPPED for resource: d34df506cfa43c623b4da8853ce91637ed575be6
	Suppress comment: checkov:skip=
	File: /test/main.tf:29-30
	Guide: https://docs.bridgecrew.io/docs/git_secrets_6
```
4. Run cli command `checkov --directory test/`
5. Observe the same test fail:
```
...
secrets scan results:

Passed checks: 0, Failed checks: 1, Skipped checks: 0

Check: CKV_SECRET_6: "Base64 High Entropy String"
	FAILED for resource: d34df506cfa43c623b4da8853ce91637ed575be6
	File: /main.tf:29-30
	Guide: https://docs.bridgecrew.io/docs/git_secrets_6

		29 |
```

**Expected behaviour**
There is no terraform code difference, checkov should behave the same way in both tests, it should show SKIPPED for CKV_SECRET_6.

**Desktop (please complete the following information):**
 - Terraform 1.0.1
 - Checkov Version 2.0.259

**Additional context**
I have not been able to observe if this behaviour is unique to check CKV_SECRET_6 or not. But it's the first time I have observed a suppressed check still show as failure.


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/secrets/runner.py`
Content:
```
1 import linecache
2 import logging
3 import os
4 import re
5 import time
6 from typing import Optional, List
7 
8 from detect_secrets import SecretsCollection
9 from detect_secrets.core.potential_secret import PotentialSecret
10 from detect_secrets.settings import transient_settings
11 
12 from checkov.common.comment.enum import COMMENT_REGEX
13 from checkov.common.graph.graph_builder.utils import run_function_multithreaded
14 from checkov.common.models.consts import SUPPORTED_FILE_EXTENSIONS
15 from checkov.common.models.enums import CheckResult
16 from checkov.common.output.record import Record
17 from checkov.common.output.report import Report
18 from checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths
19 from checkov.common.runners.base_runner import ignored_directories
20 from checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR
21 from checkov.runner_filter import RunnerFilter
22 
23 SECRET_TYPE_TO_ID = {
24     'Artifactory Credentials': 'CKV_SECRET_1',
25     'AWS Access Key': 'CKV_SECRET_2',
26     'Azure Storage Account access key': 'CKV_SECRET_3',
27     'Basic Auth Credentials': 'CKV_SECRET_4',
28     'Cloudant Credentials': 'CKV_SECRET_5',
29     'Base64 High Entropy String': 'CKV_SECRET_6',
30     'IBM Cloud IAM Key': 'CKV_SECRET_7',
31     'IBM COS HMAC Credentials': 'CKV_SECRET_8',
32     'JSON Web Token': 'CKV_SECRET_9',
33     # 'Secret Keyword': 'CKV_SECRET_10',
34     'Mailchimp Access Key': 'CKV_SECRET_11',
35     'NPM tokens': 'CKV_SECRET_12',
36     'Private Key': 'CKV_SECRET_13',
37     'Slack Token': 'CKV_SECRET_14',
38     'SoftLayer Credentials': 'CKV_SECRET_15',
39     'Square OAuth Secret': 'CKV_SECRET_16',
40     'Stripe Access Key': 'CKV_SECRET_17',
41     'Twilio API Key': 'CKV_SECRET_18',
42     'Hex High Entropy String': 'CKV_SECRET_19'
43 }
44 CHECK_ID_TO_SECRET_TYPE = {v: k for k, v in SECRET_TYPE_TO_ID.items()}
45 
46 PROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']
47 
48 
49 class Runner(BaseRunner):
50     check_type = 'secrets'
51 
52     def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=RunnerFilter(),
53             collect_skip_comments=True) -> Report:
54         current_dir = os.path.dirname(os.path.realpath(__file__))
55         secrets = SecretsCollection()
56         with transient_settings({
57             # Only run scans with only these plugins.
58             'plugins_used': [
59                 {
60                     'name': 'AWSKeyDetector'
61                 },
62                 {
63                     'name': 'ArtifactoryDetector'
64                 },
65                 {
66                     'name': 'AzureStorageKeyDetector'
67                 },
68                 {
69                     'name': 'BasicAuthDetector'
70                 },
71                 {
72                     'name': 'CloudantDetector'
73                 },
74                 {
75                     'name': 'IbmCloudIamDetector'
76                 },
77                 {
78                     'name': 'MailchimpDetector'
79                 },
80                 {
81                     'name': 'PrivateKeyDetector'
82                 },
83                 {
84                     'name': 'SlackDetector'
85                 },
86                 {
87                     'name': 'SoftlayerDetector'
88                 },
89                 {
90                     'name': 'SquareOAuthDetector'
91                 },
92                 {
93                     'name': 'StripeDetector'
94                 },
95                 {
96                     'name': 'TwilioKeyDetector'
97                 },
98                 {
99                     'name': 'EntropyKeywordCombinator',
100                     'path': f'file://{current_dir}/plugins/entropy_keyword_combinator.py',
101                     'limit': 4.5
102                 }
103             ]
104         }) as settings:
105             report = Report(self.check_type)
106             # Implement non IaC files (including .terraform dir)
107             files_to_scan = files or []
108             excluded_paths = (runner_filter.excluded_paths or []) + ignored_directories + [DEFAULT_EXTERNAL_MODULES_DIR]
109             if root_folder:
110                 for root, d_names, f_names in os.walk(root_folder):
111                     filter_ignored_paths(root, d_names, excluded_paths)
112                     filter_ignored_paths(root, f_names, excluded_paths)
113                     for file in f_names:
114                         if file not in PROHIBITED_FILES and f".{file.split('.')[-1]}" in SUPPORTED_FILE_EXTENSIONS:
115                             files_to_scan.append(os.path.join(root, file))
116             logging.info(f'Secrets scanning will scan {len(files_to_scan)} files')
117 
118             settings.disable_filters(*['detect_secrets.filters.heuristic.is_indirect_reference'])
119 
120             def _scan_file(file_paths: List[str]):
121                 for file_path in file_paths:
122                     start = time.time()
123                     try:
124                         secrets.scan_file(file_path)
125                     except Exception as err:
126                         logging.warning(f"Secret scanning:could not process file {file_path}, {err}")
127                         continue
128                     end = time.time()
129                     scan_time = end - start
130                     if scan_time > 10:
131                         logging.info(f'Scanned {file_path}, took {scan_time} seconds')
132 
133             run_function_multithreaded(_scan_file, files_to_scan, 1, num_of_workers=os.cpu_count())
134 
135             for _, secret in iter(secrets):
136                 check_id = SECRET_TYPE_TO_ID.get(secret.type)
137                 if not check_id:
138                     continue
139                 if runner_filter.checks and check_id not in runner_filter.checks:
140                     continue
141                 result = {'result': CheckResult.FAILED}
142                 line_text = linecache.getline(secret.filename,secret.line_number)
143                 if line_text != "" and line_text.split()[0] == 'git_commit':
144                     continue
145                 result = self.search_for_suppression(check_id, secret, runner_filter.skip_checks,
146                                                      CHECK_ID_TO_SECRET_TYPE) or result
147                 report.add_record(Record(
148                     check_id=check_id,
149                     check_name=secret.type,
150                     check_result=result,
151                     code_block=[(secret.line_number, line_text)],
152                     file_path=f'/{os.path.relpath(secret.filename, root_folder)}',
153                     file_line_range=[secret.line_number, secret.line_number + 1],
154                     resource=secret.secret_hash,
155                     check_class=None,
156                     evaluations=None,
157                     file_abs_path=os.path.abspath(secret.filename)
158                 ))
159 
160             return report
161 
162     @staticmethod
163     def search_for_suppression(check_id: str, secret: PotentialSecret, skipped_checks: list,
164                                CHECK_ID_TO_SECRET_TYPE: dict) -> Optional[dict]:
165         if skipped_checks:
166             for skipped_check in skipped_checks:
167                 if skipped_check == check_id and skipped_check in CHECK_ID_TO_SECRET_TYPE:
168                     return {'result': CheckResult.SKIPPED,
169                             'suppress_comment': f"Secret scan {skipped_check} is skipped"}
170         # Check for suppression comment in the line before, the line of, and the line after the secret
171         for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]:
172             lt = linecache.getline(secret.filename, line_number)
173             skip_search = re.search(COMMENT_REGEX, lt)
174             if skip_search:
175                 return {'result': CheckResult.SKIPPED, 'suppress_comment': skip_search[1]}
176         return None
177
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/secrets/runner.py b/checkov/secrets/runner.py
--- a/checkov/secrets/runner.py
+++ b/checkov/secrets/runner.py
@@ -8,6 +8,7 @@
 from detect_secrets import SecretsCollection
 from detect_secrets.core.potential_secret import PotentialSecret
 from detect_secrets.settings import transient_settings
+from typing_extensions import TypedDict
 
 from checkov.common.comment.enum import COMMENT_REGEX
 from checkov.common.graph.graph_builder.utils import run_function_multithreaded
@@ -46,6 +47,11 @@
 PROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']
 
 
+class _CheckResult(TypedDict, total=False):
+    result: CheckResult
+    suppress_comment: str
+
+
 class Runner(BaseRunner):
     check_type = 'secrets'
 
@@ -138,12 +144,15 @@
                     continue
                 if runner_filter.checks and check_id not in runner_filter.checks:
                     continue
-                result = {'result': CheckResult.FAILED}
-                line_text = linecache.getline(secret.filename,secret.line_number)
+                result: _CheckResult = {'result': CheckResult.FAILED}
+                line_text = linecache.getline(secret.filename, secret.line_number)
                 if line_text != "" and line_text.split()[0] == 'git_commit':
                     continue
-                result = self.search_for_suppression(check_id, secret, runner_filter.skip_checks,
-                                                     CHECK_ID_TO_SECRET_TYPE) or result
+                result = self.search_for_suppression(
+                    check_id=check_id,
+                    secret=secret,
+                    skipped_checks=runner_filter.skip_checks,
+                ) or result
                 report.add_record(Record(
                     check_id=check_id,
                     check_name=secret.type,
@@ -160,17 +169,23 @@
             return report
 
     @staticmethod
-    def search_for_suppression(check_id: str, secret: PotentialSecret, skipped_checks: list,
-                               CHECK_ID_TO_SECRET_TYPE: dict) -> Optional[dict]:
-        if skipped_checks:
-            for skipped_check in skipped_checks:
-                if skipped_check == check_id and skipped_check in CHECK_ID_TO_SECRET_TYPE:
-                    return {'result': CheckResult.SKIPPED,
-                            'suppress_comment': f"Secret scan {skipped_check} is skipped"}
+    def search_for_suppression(
+        check_id: str,
+        secret: PotentialSecret,
+        skipped_checks: List[str]
+    ) -> Optional[_CheckResult]:
+        if check_id in skipped_checks and check_id in CHECK_ID_TO_SECRET_TYPE.keys():
+            return {
+                "result": CheckResult.SKIPPED,
+                "suppress_comment": f"Secret scan {check_id} is skipped"
+            }
         # Check for suppression comment in the line before, the line of, and the line after the secret
         for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]:
             lt = linecache.getline(secret.filename, line_number)
             skip_search = re.search(COMMENT_REGEX, lt)
-            if skip_search:
-                return {'result': CheckResult.SKIPPED, 'suppress_comment': skip_search[1]}
+            if skip_search and skip_search.group(2) == check_id:
+                return {
+                    "result": CheckResult.SKIPPED,
+                    "suppress_comment": skip_search.group(3)[1:] if skip_search.group(3) else "No comment provided"
+                }
         return None

{"golden_diff": "diff --git a/checkov/secrets/runner.py b/checkov/secrets/runner.py\n--- a/checkov/secrets/runner.py\n+++ b/checkov/secrets/runner.py\n@@ -8,6 +8,7 @@\n from detect_secrets import SecretsCollection\n from detect_secrets.core.potential_secret import PotentialSecret\n from detect_secrets.settings import transient_settings\n+from typing_extensions import TypedDict\n \n from checkov.common.comment.enum import COMMENT_REGEX\n from checkov.common.graph.graph_builder.utils import run_function_multithreaded\n@@ -46,6 +47,11 @@\n PROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']\n \n \n+class _CheckResult(TypedDict, total=False):\n+    result: CheckResult\n+    suppress_comment: str\n+\n+\n class Runner(BaseRunner):\n     check_type = 'secrets'\n \n@@ -138,12 +144,15 @@\n                     continue\n                 if runner_filter.checks and check_id not in runner_filter.checks:\n                     continue\n-                result = {'result': CheckResult.FAILED}\n-                line_text = linecache.getline(secret.filename,secret.line_number)\n+                result: _CheckResult = {'result': CheckResult.FAILED}\n+                line_text = linecache.getline(secret.filename, secret.line_number)\n                 if line_text != \"\" and line_text.split()[0] == 'git_commit':\n                     continue\n-                result = self.search_for_suppression(check_id, secret, runner_filter.skip_checks,\n-                                                     CHECK_ID_TO_SECRET_TYPE) or result\n+                result = self.search_for_suppression(\n+                    check_id=check_id,\n+                    secret=secret,\n+                    skipped_checks=runner_filter.skip_checks,\n+                ) or result\n                 report.add_record(Record(\n                     check_id=check_id,\n                     check_name=secret.type,\n@@ -160,17 +169,23 @@\n             return report\n \n     @staticmethod\n-    def search_for_suppression(check_id: str, secret: PotentialSecret, skipped_checks: list,\n-                               CHECK_ID_TO_SECRET_TYPE: dict) -> Optional[dict]:\n-        if skipped_checks:\n-            for skipped_check in skipped_checks:\n-                if skipped_check == check_id and skipped_check in CHECK_ID_TO_SECRET_TYPE:\n-                    return {'result': CheckResult.SKIPPED,\n-                            'suppress_comment': f\"Secret scan {skipped_check} is skipped\"}\n+    def search_for_suppression(\n+        check_id: str,\n+        secret: PotentialSecret,\n+        skipped_checks: List[str]\n+    ) -> Optional[_CheckResult]:\n+        if check_id in skipped_checks and check_id in CHECK_ID_TO_SECRET_TYPE.keys():\n+            return {\n+                \"result\": CheckResult.SKIPPED,\n+                \"suppress_comment\": f\"Secret scan {check_id} is skipped\"\n+            }\n         # Check for suppression comment in the line before, the line of, and the line after the secret\n         for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]:\n             lt = linecache.getline(secret.filename, line_number)\n             skip_search = re.search(COMMENT_REGEX, lt)\n-            if skip_search:\n-                return {'result': CheckResult.SKIPPED, 'suppress_comment': skip_search[1]}\n+            if skip_search and skip_search.group(2) == check_id:\n+                return {\n+                    \"result\": CheckResult.SKIPPED,\n+                    \"suppress_comment\": skip_search.group(3)[1:] if skip_search.group(3) else \"No comment provided\"\n+                }\n         return None\n", "issue": "check CKV_SECRET_6 fails even when suppressed\n**Describe the bug**\r\nCheckov raises FAILED check CKV_SECRET_6 when running against a project even if the check is suppressed. However if running checkov on a single terraform file it doesn't flag the same error.\r\n\r\n**To Reproduce**\r\nSteps to reproduce the behaviour:\r\n1. Create a single terraform file and save in under a new dir (test/main.tf) with a resource would fail this check but make a comment so checkov suppresses the alert:\r\n```\r\nresource \"aws_emr_cluster\" \"cluster\" {\r\n  #checkov:skip=CKV_SECRET_6:todo\r\n  #checkov:skip=CKV2_AWS_7:todo\r\n  name          = \"emr\"\r\n  termination_protection = true\r\n  ebs_root_volume_size = 10\r\n  service_role = \"emr_role\"\r\n  master_instance_fleet {\r\n    name = \"emr-leader\"\r\n    target_on_demand_capacity = 1\r\n    instance_type_configs {\r\n      instance_type = var.emr_leader_instance_type\r\n\r\n      ebs_config {\r\n        size = \"64\"\r\n        type = \"gp2\"\r\n        volumes_per_instance = 1\r\n      }\r\n      configurations {\r\n        classification = \"spark-defaults\"\r\n        properties = {\r\n          \"spark.cassandra.connection.host\" = \"cassandra.domain.co.uk\",\r\n          \"spark.cassandra.connection.port\" = \"9999\",\r\n          \"spark.cassandra.auth.username\" = \"user123\",\r\n          \"spark.cassandra.auth.password\" = \"pass123\", #checkov:skip=CKV_SECRET_6:todo\r\n        }\r\n      }\r\n    }\r\n  }\r\n}\r\n```\r\n2. Run cli command  `checkov -f test/main.tf`\r\n3. Observe result behaves as expected:\r\n```\r\n...\r\n secrets scan results:\r\n\r\nPassed checks: 0, Failed checks: 0, Skipped checks: 1\r\n\r\nCheck: CKV_SECRET_6: \"Base64 High Entropy String\"\r\n\tSKIPPED for resource: d34df506cfa43c623b4da8853ce91637ed575be6\r\n\tSuppress comment: checkov:skip=\r\n\tFile: /test/main.tf:29-30\r\n\tGuide: https://docs.bridgecrew.io/docs/git_secrets_6\r\n```\r\n4. Run cli command `checkov --directory test/`\r\n5. Observe the same test fail:\r\n```\r\n...\r\nsecrets scan results:\r\n\r\nPassed checks: 0, Failed checks: 1, Skipped checks: 0\r\n\r\nCheck: CKV_SECRET_6: \"Base64 High Entropy String\"\r\n\tFAILED for resource: d34df506cfa43c623b4da8853ce91637ed575be6\r\n\tFile: /main.tf:29-30\r\n\tGuide: https://docs.bridgecrew.io/docs/git_secrets_6\r\n\r\n\t\t29 |\r\n```\r\n\r\n**Expected behaviour**\r\nThere is no terraform code difference, checkov should behave the same way in both tests, it should show SKIPPED for CKV_SECRET_6.\r\n\r\n**Desktop (please complete the following information):**\r\n - Terraform 1.0.1\r\n - Checkov Version 2.0.259\r\n\r\n**Additional context**\r\nI have not been able to observe if this behaviour is unique to check CKV_SECRET_6 or not. But it's the first time I have observed a suppressed check still show as failure.\r\n\n", "before_files": [{"content": "import linecache\nimport logging\nimport os\nimport re\nimport time\nfrom typing import Optional, List\n\nfrom detect_secrets import SecretsCollection\nfrom detect_secrets.core.potential_secret import PotentialSecret\nfrom detect_secrets.settings import transient_settings\n\nfrom checkov.common.comment.enum import COMMENT_REGEX\nfrom checkov.common.graph.graph_builder.utils import run_function_multithreaded\nfrom checkov.common.models.consts import SUPPORTED_FILE_EXTENSIONS\nfrom checkov.common.models.enums import CheckResult\nfrom checkov.common.output.record import Record\nfrom checkov.common.output.report import Report\nfrom checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths\nfrom checkov.common.runners.base_runner import ignored_directories\nfrom checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR\nfrom checkov.runner_filter import RunnerFilter\n\nSECRET_TYPE_TO_ID = {\n    'Artifactory Credentials': 'CKV_SECRET_1',\n    'AWS Access Key': 'CKV_SECRET_2',\n    'Azure Storage Account access key': 'CKV_SECRET_3',\n    'Basic Auth Credentials': 'CKV_SECRET_4',\n    'Cloudant Credentials': 'CKV_SECRET_5',\n    'Base64 High Entropy String': 'CKV_SECRET_6',\n    'IBM Cloud IAM Key': 'CKV_SECRET_7',\n    'IBM COS HMAC Credentials': 'CKV_SECRET_8',\n    'JSON Web Token': 'CKV_SECRET_9',\n    # 'Secret Keyword': 'CKV_SECRET_10',\n    'Mailchimp Access Key': 'CKV_SECRET_11',\n    'NPM tokens': 'CKV_SECRET_12',\n    'Private Key': 'CKV_SECRET_13',\n    'Slack Token': 'CKV_SECRET_14',\n    'SoftLayer Credentials': 'CKV_SECRET_15',\n    'Square OAuth Secret': 'CKV_SECRET_16',\n    'Stripe Access Key': 'CKV_SECRET_17',\n    'Twilio API Key': 'CKV_SECRET_18',\n    'Hex High Entropy String': 'CKV_SECRET_19'\n}\nCHECK_ID_TO_SECRET_TYPE = {v: k for k, v in SECRET_TYPE_TO_ID.items()}\n\nPROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']\n\n\nclass Runner(BaseRunner):\n    check_type = 'secrets'\n\n    def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=RunnerFilter(),\n            collect_skip_comments=True) -> Report:\n        current_dir = os.path.dirname(os.path.realpath(__file__))\n        secrets = SecretsCollection()\n        with transient_settings({\n            # Only run scans with only these plugins.\n            'plugins_used': [\n                {\n                    'name': 'AWSKeyDetector'\n                },\n                {\n                    'name': 'ArtifactoryDetector'\n                },\n                {\n                    'name': 'AzureStorageKeyDetector'\n                },\n                {\n                    'name': 'BasicAuthDetector'\n                },\n                {\n                    'name': 'CloudantDetector'\n                },\n                {\n                    'name': 'IbmCloudIamDetector'\n                },\n                {\n                    'name': 'MailchimpDetector'\n                },\n                {\n                    'name': 'PrivateKeyDetector'\n                },\n                {\n                    'name': 'SlackDetector'\n                },\n                {\n                    'name': 'SoftlayerDetector'\n                },\n                {\n                    'name': 'SquareOAuthDetector'\n                },\n                {\n                    'name': 'StripeDetector'\n                },\n                {\n                    'name': 'TwilioKeyDetector'\n                },\n                {\n                    'name': 'EntropyKeywordCombinator',\n                    'path': f'file://{current_dir}/plugins/entropy_keyword_combinator.py',\n                    'limit': 4.5\n                }\n            ]\n        }) as settings:\n            report = Report(self.check_type)\n            # Implement non IaC files (including .terraform dir)\n            files_to_scan = files or []\n            excluded_paths = (runner_filter.excluded_paths or []) + ignored_directories + [DEFAULT_EXTERNAL_MODULES_DIR]\n            if root_folder:\n                for root, d_names, f_names in os.walk(root_folder):\n                    filter_ignored_paths(root, d_names, excluded_paths)\n                    filter_ignored_paths(root, f_names, excluded_paths)\n                    for file in f_names:\n                        if file not in PROHIBITED_FILES and f\".{file.split('.')[-1]}\" in SUPPORTED_FILE_EXTENSIONS:\n                            files_to_scan.append(os.path.join(root, file))\n            logging.info(f'Secrets scanning will scan {len(files_to_scan)} files')\n\n            settings.disable_filters(*['detect_secrets.filters.heuristic.is_indirect_reference'])\n\n            def _scan_file(file_paths: List[str]):\n                for file_path in file_paths:\n                    start = time.time()\n                    try:\n                        secrets.scan_file(file_path)\n                    except Exception as err:\n                        logging.warning(f\"Secret scanning:could not process file {file_path}, {err}\")\n                        continue\n                    end = time.time()\n                    scan_time = end - start\n                    if scan_time > 10:\n                        logging.info(f'Scanned {file_path}, took {scan_time} seconds')\n\n            run_function_multithreaded(_scan_file, files_to_scan, 1, num_of_workers=os.cpu_count())\n\n            for _, secret in iter(secrets):\n                check_id = SECRET_TYPE_TO_ID.get(secret.type)\n                if not check_id:\n                    continue\n                if runner_filter.checks and check_id not in runner_filter.checks:\n                    continue\n                result = {'result': CheckResult.FAILED}\n                line_text = linecache.getline(secret.filename,secret.line_number)\n                if line_text != \"\" and line_text.split()[0] == 'git_commit':\n                    continue\n                result = self.search_for_suppression(check_id, secret, runner_filter.skip_checks,\n                                                     CHECK_ID_TO_SECRET_TYPE) or result\n                report.add_record(Record(\n                    check_id=check_id,\n                    check_name=secret.type,\n                    check_result=result,\n                    code_block=[(secret.line_number, line_text)],\n                    file_path=f'/{os.path.relpath(secret.filename, root_folder)}',\n                    file_line_range=[secret.line_number, secret.line_number + 1],\n                    resource=secret.secret_hash,\n                    check_class=None,\n                    evaluations=None,\n                    file_abs_path=os.path.abspath(secret.filename)\n                ))\n\n            return report\n\n    @staticmethod\n    def search_for_suppression(check_id: str, secret: PotentialSecret, skipped_checks: list,\n                               CHECK_ID_TO_SECRET_TYPE: dict) -> Optional[dict]:\n        if skipped_checks:\n            for skipped_check in skipped_checks:\n                if skipped_check == check_id and skipped_check in CHECK_ID_TO_SECRET_TYPE:\n                    return {'result': CheckResult.SKIPPED,\n                            'suppress_comment': f\"Secret scan {skipped_check} is skipped\"}\n        # Check for suppression comment in the line before, the line of, and the line after the secret\n        for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]:\n            lt = linecache.getline(secret.filename, line_number)\n            skip_search = re.search(COMMENT_REGEX, lt)\n            if skip_search:\n                return {'result': CheckResult.SKIPPED, 'suppress_comment': skip_search[1]}\n        return None\n", "path": "checkov/secrets/runner.py"}], "after_files": [{"content": "import linecache\nimport logging\nimport os\nimport re\nimport time\nfrom typing import Optional, List\n\nfrom detect_secrets import SecretsCollection\nfrom detect_secrets.core.potential_secret import PotentialSecret\nfrom detect_secrets.settings import transient_settings\nfrom typing_extensions import TypedDict\n\nfrom checkov.common.comment.enum import COMMENT_REGEX\nfrom checkov.common.graph.graph_builder.utils import run_function_multithreaded\nfrom checkov.common.models.consts import SUPPORTED_FILE_EXTENSIONS\nfrom checkov.common.models.enums import CheckResult\nfrom checkov.common.output.record import Record\nfrom checkov.common.output.report import Report\nfrom checkov.common.runners.base_runner import BaseRunner, filter_ignored_paths\nfrom checkov.common.runners.base_runner import ignored_directories\nfrom checkov.common.util.consts import DEFAULT_EXTERNAL_MODULES_DIR\nfrom checkov.runner_filter import RunnerFilter\n\nSECRET_TYPE_TO_ID = {\n    'Artifactory Credentials': 'CKV_SECRET_1',\n    'AWS Access Key': 'CKV_SECRET_2',\n    'Azure Storage Account access key': 'CKV_SECRET_3',\n    'Basic Auth Credentials': 'CKV_SECRET_4',\n    'Cloudant Credentials': 'CKV_SECRET_5',\n    'Base64 High Entropy String': 'CKV_SECRET_6',\n    'IBM Cloud IAM Key': 'CKV_SECRET_7',\n    'IBM COS HMAC Credentials': 'CKV_SECRET_8',\n    'JSON Web Token': 'CKV_SECRET_9',\n    # 'Secret Keyword': 'CKV_SECRET_10',\n    'Mailchimp Access Key': 'CKV_SECRET_11',\n    'NPM tokens': 'CKV_SECRET_12',\n    'Private Key': 'CKV_SECRET_13',\n    'Slack Token': 'CKV_SECRET_14',\n    'SoftLayer Credentials': 'CKV_SECRET_15',\n    'Square OAuth Secret': 'CKV_SECRET_16',\n    'Stripe Access Key': 'CKV_SECRET_17',\n    'Twilio API Key': 'CKV_SECRET_18',\n    'Hex High Entropy String': 'CKV_SECRET_19'\n}\nCHECK_ID_TO_SECRET_TYPE = {v: k for k, v in SECRET_TYPE_TO_ID.items()}\n\nPROHIBITED_FILES = ['Pipfile.lock', 'yarn.lock', 'package-lock.json', 'requirements.txt']\n\n\nclass _CheckResult(TypedDict, total=False):\n    result: CheckResult\n    suppress_comment: str\n\n\nclass Runner(BaseRunner):\n    check_type = 'secrets'\n\n    def run(self, root_folder, external_checks_dir=None, files=None, runner_filter=RunnerFilter(),\n            collect_skip_comments=True) -> Report:\n        current_dir = os.path.dirname(os.path.realpath(__file__))\n        secrets = SecretsCollection()\n        with transient_settings({\n            # Only run scans with only these plugins.\n            'plugins_used': [\n                {\n                    'name': 'AWSKeyDetector'\n                },\n                {\n                    'name': 'ArtifactoryDetector'\n                },\n                {\n                    'name': 'AzureStorageKeyDetector'\n                },\n                {\n                    'name': 'BasicAuthDetector'\n                },\n                {\n                    'name': 'CloudantDetector'\n                },\n                {\n                    'name': 'IbmCloudIamDetector'\n                },\n                {\n                    'name': 'MailchimpDetector'\n                },\n                {\n                    'name': 'PrivateKeyDetector'\n                },\n                {\n                    'name': 'SlackDetector'\n                },\n                {\n                    'name': 'SoftlayerDetector'\n                },\n                {\n                    'name': 'SquareOAuthDetector'\n                },\n                {\n                    'name': 'StripeDetector'\n                },\n                {\n                    'name': 'TwilioKeyDetector'\n                },\n                {\n                    'name': 'EntropyKeywordCombinator',\n                    'path': f'file://{current_dir}/plugins/entropy_keyword_combinator.py',\n                    'limit': 4.5\n                }\n            ]\n        }) as settings:\n            report = Report(self.check_type)\n            # Implement non IaC files (including .terraform dir)\n            files_to_scan = files or []\n            excluded_paths = (runner_filter.excluded_paths or []) + ignored_directories + [DEFAULT_EXTERNAL_MODULES_DIR]\n            if root_folder:\n                for root, d_names, f_names in os.walk(root_folder):\n                    filter_ignored_paths(root, d_names, excluded_paths)\n                    filter_ignored_paths(root, f_names, excluded_paths)\n                    for file in f_names:\n                        if file not in PROHIBITED_FILES and f\".{file.split('.')[-1]}\" in SUPPORTED_FILE_EXTENSIONS:\n                            files_to_scan.append(os.path.join(root, file))\n            logging.info(f'Secrets scanning will scan {len(files_to_scan)} files')\n\n            settings.disable_filters(*['detect_secrets.filters.heuristic.is_indirect_reference'])\n\n            def _scan_file(file_paths: List[str]):\n                for file_path in file_paths:\n                    start = time.time()\n                    try:\n                        secrets.scan_file(file_path)\n                    except Exception as err:\n                        logging.warning(f\"Secret scanning:could not process file {file_path}, {err}\")\n                        continue\n                    end = time.time()\n                    scan_time = end - start\n                    if scan_time > 10:\n                        logging.info(f'Scanned {file_path}, took {scan_time} seconds')\n\n            run_function_multithreaded(_scan_file, files_to_scan, 1, num_of_workers=os.cpu_count())\n\n            for _, secret in iter(secrets):\n                check_id = SECRET_TYPE_TO_ID.get(secret.type)\n                if not check_id:\n                    continue\n                if runner_filter.checks and check_id not in runner_filter.checks:\n                    continue\n                result: _CheckResult = {'result': CheckResult.FAILED}\n                line_text = linecache.getline(secret.filename, secret.line_number)\n                if line_text != \"\" and line_text.split()[0] == 'git_commit':\n                    continue\n                result = self.search_for_suppression(\n                    check_id=check_id,\n                    secret=secret,\n                    skipped_checks=runner_filter.skip_checks,\n                ) or result\n                report.add_record(Record(\n                    check_id=check_id,\n                    check_name=secret.type,\n                    check_result=result,\n                    code_block=[(secret.line_number, line_text)],\n                    file_path=f'/{os.path.relpath(secret.filename, root_folder)}',\n                    file_line_range=[secret.line_number, secret.line_number + 1],\n                    resource=secret.secret_hash,\n                    check_class=None,\n                    evaluations=None,\n                    file_abs_path=os.path.abspath(secret.filename)\n                ))\n\n            return report\n\n    @staticmethod\n    def search_for_suppression(\n        check_id: str,\n        secret: PotentialSecret,\n        skipped_checks: List[str]\n    ) -> Optional[_CheckResult]:\n        if check_id in skipped_checks and check_id in CHECK_ID_TO_SECRET_TYPE.keys():\n            return {\n                \"result\": CheckResult.SKIPPED,\n                \"suppress_comment\": f\"Secret scan {check_id} is skipped\"\n            }\n        # Check for suppression comment in the line before, the line of, and the line after the secret\n        for line_number in [secret.line_number, secret.line_number - 1, secret.line_number + 1]:\n            lt = linecache.getline(secret.filename, line_number)\n            skip_search = re.search(COMMENT_REGEX, lt)\n            if skip_search and skip_search.group(2) == check_id:\n                return {\n                    \"result\": CheckResult.SKIPPED,\n                    \"suppress_comment\": skip_search.group(3)[1:] if skip_search.group(3) else \"No comment provided\"\n                }\n        return None\n", "path": "checkov/secrets/runner.py"}]}