checkov --create-baseline: Grandfather Existing Findings
checkov --create-baseline snapshots current findings into a file so future scans fail only on new violations.
A baseline is the practical way to adopt Checkov on a large existing repo: accept what is there today, then block any new misconfiguration without drowning in legacy noise.
What it does
checkov --create-baseline writes a .checkov.baseline file listing every current finding. On later runs, --baseline .checkov.baseline suppresses exactly those known findings, so the scan fails only on violations introduced since the snapshot. New findings still hard-fail.
Common usage
# create the baseline once, then commit it
checkov -d . --create-baseline
git add .checkov.baseline
# subsequent runs only fail on new findings
checkov -d . --baseline .checkov.baselineOptions
| Flag | What it does |
|---|---|
| --create-baseline | Write .checkov.baseline of current findings |
| --baseline <file> | Suppress findings recorded in the baseline |
| -d <dir> | Directory the baseline is created from and applied to |
In CI
Commit .checkov.baseline and run with --baseline so PRs fail only on newly introduced issues. Periodically regenerate it after fixing a batch of legacy findings to shrink the grandfathered set. Unlike --soft-fail, a baseline still blocks new problems while ignoring old ones, which is usually the better long-term posture.
Common errors in CI
"baseline file ... not found" means --baseline points at a missing or uncommitted file; commit .checkov.baseline. If a known finding still fails, the baseline may be stale after a refactor moved the resource; regenerate it. If new findings are not blocked, you likely combined --baseline with --soft-fail, which suppresses everything.