chore(deps): update Checkov action

.github/workflows/iac-scan.yml

@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Checkov
-        uses: bridgecrewio/checkov-action@99bb2caf247dfd9f03cf984373bc6043d4e32ebf  # v12.1347.0
+        uses: bridgecrewio/checkov-action@a7683e7b72a04503521247973281ec8142e1ac1f  # v12.3112.0
         with:
           directory: ${{ inputs.directory }}
           framework: ${{ inputs.framework }}

CHANGELOG.md

@@ -10,6 +10,15 @@
 
 ### Changed
 
+- Update the full-SHA-pinned Checkov action from `v12.1347.0` to
+  `v12.3112.0`, including its bundled Checkov engine change from `2.0.930` to
+  `3.3.6`. Record live `workflow_call` evidence from an isolated Terraform
+  fixture that produced seven expected CKV findings while honoring
+  `soft_fail: true`. The upstream action still references its engine image by
+  the mutable `ghcr.io/bridgecrewio/checkov:3.3.6` tag; the outer action commit
+  remains immutable, but that nested image is a documented residual
+  supply-chain risk.
+
 - Exclude `swift-actions/setup-swift` from the broad GitHub Actions Dependabot
   group so major Swift action updates receive a separate review and runtime
   consumer proof instead of blocking unrelated stable action updates.

catalog/runtime-coverage.yml

@@ -91,9 +91,10 @@ entries:
     last_run: null
     waiver: null
   - workflow: .github/workflows/iac-scan.yml
-    status: unverified
-    evidence: 'No observed consumer run; static checks (actionlint/zizmor/pins/permissions) pass but do not prove workflow_call startup, tier, event, or runner lanes.'
-    last_run: null
+    status: runtime-proven
+    evidence: "Called from an isolated same-repository push proof at c4cd369; Checkov 3.3.6 scanned an intentionally unsafe Terraform fixture, reported seven CKV failures, and respected soft_fail: true."
+    last_run: https://github.com/NDDev-it-com/nddev-ci-workflows/actions/runs/29260835832
+    proven_digest: 5f94060b4821c693415704530c1938838b66de1c98d4c9ec832dfd9b36336f68
     waiver: null
   - workflow: .github/workflows/java-ci.yml
     status: unverified

catalog/tools.yml

@@ -1,7 +1,7 @@
 # External tools referenced by nddev-ci-workflows.
 # Machine-readable source of truth. Mirrored by docs/. Enforced by scripts/validate_catalog.py.
 # Action `pin` values are full commit SHAs (tags are mutable); CLIs pin by version/checksum and use null here.
-# Last verified: 2026-07-12
+# Last verified: 2026-07-13
 
 tools:
   - id: actionlint
@@ -371,11 +371,11 @@ tools:
     name: bridgecrewio/checkov-action
     homepage: "https://github.com/bridgecrewio/checkov-action"
     kind: action
-    current_version: "v12.1347.0"
-    pin: "bridgecrewio/checkov-action@99bb2caf247dfd9f03cf984373bc6043d4e32ebf"
+    current_version: "v12.3112.0"
+    pin: "bridgecrewio/checkov-action@a7683e7b72a04503521247973281ec8142e1ac1f"
     used_by:
       - .github/workflows/iac-scan.yml
-    last_verified: "2026-07-08"
+    last_verified: "2026-07-13"
 
   - id: github-action-benchmark
     name: benchmark-action/github-action-benchmark