Inline checkov:skip comments are ignored when --deep-analysis is enabled #7643

Describe the issue

When a Terraform plan scan combines --repo-root-for-plan-enrichment with --deep-analysis, inline #checkov:skip comments are not applied. The same scan without --deep-analysis honors them. In CI this forces a fallback to global skip-check config entries, which suppress a check for every resource instead of only the annotated one.

This was reported before in #6815 and #7225, and both were closed by the stale bot without a fix. I hit it again on current versions, so I am filing a fresh report together with a root cause and a PR.

The cause is in RunnerRegistry._handle_report (checkov/common/runners/runner_registry.py). The plan enrichment block is gated on not self.runner_filter.deep_analysis, and that block is the only place where inline skips get applied to plan scans (Report.handle_skipped_checks). The deep analysis path (DeepAnalysisGraphManager) merges graph attributes and filters the report, and it never re-applies skip comments, so enabling the flag drops every inline suppression for python checks and graph checks alike. The gate has been in place since deep analysis was introduced in #4066.

Examples

main.tf:

module "sa" {
  source = "./modules/sa"
}

modules/sa/main.tf:

resource "azurerm_storage_account" "sa" {
  #checkov:skip=CKV_AZURE_206: replication intentionally LRS
  name                     = "example"
  resource_group_name      = "rg-example"
  location                 = "westeurope"
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

After terraform plan -out planfile and terraform show -json planfile > tfplan.json:

$ checkov --file tfplan.json --repo-root-for-plan-enrichment . --check CKV_AZURE_206 --compact --quiet
SKIPPED for resource: module.sa.azurerm_storage_account.sa

$ checkov --file tfplan.json --repo-root-for-plan-enrichment . --deep-analysis --check CKV_AZURE_206 --compact --quiet
FAILED for resource: module.sa.azurerm_storage_account.sa

Expected outcome is SKIPPED in both runs. A resource defined directly in the repo root reproduces it the same way as the module above, and so do external modules downloaded with DOWNLOAD_EXTERNAL_MODULES=True.

Version (please complete the following information):

• Reproduced on 3.2.495, 3.2.519 and 3.3.10.

Additional context

I will open a PR that applies handle_skipped_checks in deep analysis mode as well, while leaving the file path and code block rewriting to the non-deep path, since deep analysis reports records against the plan file.