fix(`docker`): Pin `virtualenv` to fix `checkov` build (broken since 2026-10-09) by MaxymVlasov · Pull Request #1033 · antonbabenko/pre-commit-terraform

MaxymVlasov · 2026-10-20T14:01:56Z

Put an x into the box if that apply:

This PR introduces breaking change.
This PR fixes a bug.
This PR adds new functionality.
This PR enhances existing functionality.

Description of your changes

What

_{This section was generated by AI.}

Pin virtualenv<21.14.6 in tools/install/pre-commit.sh, so pip3 check in checkov.sh stops failing the Docker build (virtualenv>=21.14.6 needs packaging>=26.3, checkov pins packaging<24)
Unblocks the nightly image build (red since 2026-10-09, same error) and Docker CI for PRs touching tools/install/*.sh, e.g. fix(trivy): Correct macOS asset name in installer script #1032

Why

Blocks #1032

How can we test changes

_{This section was generated by AI.}

docker build --build-arg INSTALL_ALL=true . (amd64): checkov.sh passes pip3 check, all later tools install
Final image: pip check clean (virtualenv 21.14.5, packaging 23.2); real pre-commit run of a language: python hook passes; container-structure-test 19/19 passed
Repo hooks (shfmt, shellcheck) on tools/install/pre-commit.sh passed
Not run locally: arm64 build (the job that failed in CI) and the Dive step

Assisted-by

_{Specific models used per commit are specified in the commit messages.}

Assisted-by: Sisyphus:claude-sonnet-5-5 opencode (e107f11)

virtualenv>=21.14.6 requires packaging>=26.3, but checkov pins packaging<24, so `pip3 check` in checkov.sh fails the image build. Assisted-by: Sisyphus:claude-sonnet-5-5 opencode

coderabbitai · 2026-10-20T14:02:10Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: antonbabenko/pre-commit-terraform/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: d8d88f68-e765-4d66-84c6-42a7abcce48d

📥 Commits

Reviewing files that changed from the base of the PR and between 80c8033 and e107f11.

📒 Files selected for processing: 1

tools/install/pre-commit.sh

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

Bug Fixes
- Updated installation tooling to use a compatible version of virtualenv, improving setup reliability for supported environments.

The pre-commit installer now constrains virtualenv to versions below 21.14.6 for both latest and version-specific installations. A comment records the Checkov packaging<24 compatibility constraint.

Changes: Pre-commit installation

Layer / File(s)	Summary
Add virtualenv compatibility constraint `tools/install/pre-commit.sh`	Both `pip3 install` commands now constrain `virtualenv` to versions below `21.14.6`. A comment notes the Checkov `packaging<24` compatibility constraint.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: yermulnik

Merge Risk: ⚪ Minimal · up to e107f

The compatibility pin works across both installation modes for the inspected releases, with no identified merge-blocking risk.

Architecture risk: 🔵 Low · up to e107f

The change affects 1 system.

Changed systems: tools

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — tools (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in tools/install/pre-commit.sh: Added a compatibility comment and appended virtualenv<21.14.6 to both pip3 install commands, regardless of whether $VERSION is latest or a specific version.

Pre-merge checks: 5

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the main change: pinning `virtualenv` to resolve the Checkov build failure. It is specific and related to the changeset.
Description check		The pull request description directly explains the virtualenv pin in tools/install/pre-commit.sh and its purpose of resolving the Checkov packaging conflict during Docker builds.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

🟢 Approval recommended

The narrow change covers both installation paths consistently, with no identified blocking issues.

No open issues 🎉

What changed in this PR

Constrains virtualenv in the pre-commit installer to avoid its packaging dependency conflict with Checkov during Docker builds.

Changes:

Applies virtualenv<21.14.6 to both latest and version-specific installations.
Documents why the constraint is needed and when to remove it.

File	Description
`tools/install/pre-commit.sh`	Adds the dependency constraint while retaining `pip3 check`.

_{Review effort: Balanced}

## [1.109.3](v1.109.2...v1.109.3) (2026-10-20) ### Bug Fixes * **`docker`:** Pin `virtualenv` to fix `checkov` build (broken since 2026-10-09) ([#1033](#1033)) ([f6ba5a4](f6ba5a4)) * **`trivy`:** Correct macOS asset name in installer script ([#1032](#1032)) ([35dbca6](35dbca6))

antonbabenko · 2026-10-20T15:27:07Z

This PR is included in version 1.109.3 🎉

fix(docker): Pin virtualenv to fix checkov build

e107f11

virtualenv>=21.14.6 requires packaging>=26.3, but checkov pins packaging<24, so `pip3 check` in checkov.sh fails the image build. Assisted-by: Sisyphus:claude-sonnet-5-5 opencode

MaxymVlasov changed the title ~~fix(docker): Pin virtualenv to fix checkov build~~ fix(docker): Pin virtualenv to fix checkov build (broken sinse 2026-10-09) Oct 20, 2026

MaxymVlasov changed the title ~~fix(docker): Pin virtualenv to fix checkov build (broken sinse 2026-10-09)~~ fix(docker): Pin virtualenv to fix checkov build (broken since 2026-10-09) Oct 20, 2026

MaxymVlasov marked this pull request as ready for review October 20, 2026 14:15

Copilot AI balanced review requested due to automatic review settings October 20, 2026 14:15

MaxymVlasov requested review from antonbabenko and yermulnik as code owners October 20, 2026 14:15

MaxymVlasov changed the title ~~fix(docker): Pin virtualenv to fix checkov build (broken since 2026-10-09)~~ fix(docker): Pin virtualenv to fix checkov build (broken since 2026-10-09) Oct 20, 2026

Copilot started reviewing on behalf of MaxymVlasov October 20, 2026 14:15

View session

Copilot AI reviewed Oct 20, 2026

View reviewed changes

yermulnik approved these changes Oct 20, 2026

View reviewed changes

MaxymVlasov merged commit f6ba5a4 into master Oct 20, 2026
56 checks passed

MaxymVlasov deleted the fix/docker-checkov-packaging-conflict branch October 20, 2026 15:01

MaxymVlasov added area/docker hook/terraform_checkov Bash hook 3rd party Issues not related to `pre-commit-terraform` labels Oct 20, 2026

Navigation Menu

Repository navigation

fix(`docker`): Pin `virtualenv` to fix `checkov` build (broken since 2026-10-09) - #1033

fix(`docker`): Pin `virtualenv` to fix `checkov` build (broken since 2026-10-09)#1033
MaxymVlasov merged 1 commit into
masterfrom
fix/docker-checkov-packaging-conflict

MaxymVlasov commented Oct 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

antonbabenko commented Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

MaxymVlasov commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of your changes

What

Why

How can we test changes

Assisted-by

Uh oh!

coderabbitai Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

antonbabenko commented Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MaxymVlasov commented Oct 20, 2026 •

edited

Loading

coderabbitai Bot commented Oct 20, 2026 •

edited

Loading