Repository: bridgecrewio/checkov

Issue:
CKV_GIT_3 should not be triggered on archived repositories
**Describe the issue**
_CKV_GIT_3_ currently gets triggered also on archived GitHub repositories. When archiving a repository the configuration `vulnerability_alerts` will get changed to `false` automatically. It's also not possible to turn it on again on an archived repository. _CKV_GIT_3_ should be changed to ignore archived repositories.

**Examples**

```terraform
resource "github_repository" "test" {
  name                 = "test"
  visibility           = "private"
  archived             = true
  vulnerability_alerts = false
}
```

**Version (please complete the following information):**
 - Starting with Checkov Version 2.0.764

**Additional context**
See the [GitHub documentation](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/configuring-dependabot-security-updates#supported-repositories) that Dependabot is only supported on non-archived repositories.



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py b/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py
--- a/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py
+++ b/checkov/terraform/checks/resource/github/RepositoryEnableVulnerabilityAlerts.py
@@ -13,6 +13,9 @@ def __init__(self) -> None:
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def scan_resource_conf(self, conf) -> CheckResult:
+        # GitHub disables the alerts when archiving the repository without an option to turn them on again.
+        if conf.get("archived") == [True]:
+            return CheckResult.PASSED
         # GitHub enables the alerts on public repos but disables them on private repos by default.
         # is private repo
         if conf.get("private") == [True] or conf.get("visibility") in [["private"], ["internal"]]:


Test patch:
diff --git a/tests/terraform/checks/resource/github/example_RepositoryEnableVulnerabilityAlerts/main.tf b/tests/terraform/checks/resource/github/example_RepositoryEnableVulnerabilityAlerts/main.tf
--- a/tests/terraform/checks/resource/github/example_RepositoryEnableVulnerabilityAlerts/main.tf
+++ b/tests/terraform/checks/resource/github/example_RepositoryEnableVulnerabilityAlerts/main.tf
@@ -60,4 +60,32 @@ resource "github_repository" "fail2" {
     owner      = "github"
     repository = "terraform-module-template"
   }
+}
+
+resource "github_repository" "pass4" {
+  name        = "example"
+  description = "My awesome codebase"
+
+  visibility = "public"
+  archived   = true
+
+  template {
+    owner      = "github"
+    repository = "terraform-module-template"
+  }
+  vulnerability_alerts = false
+}
+
+resource "github_repository" "pass5" {
+  name        = "example"
+  description = "My awesome codebase"
+
+  visibility = "private"
+  archived   = true
+
+  template {
+    owner      = "github"
+    repository = "terraform-module-template"
+  }
+  vulnerability_alerts = false
 }
\ No newline at end of file
diff --git a/tests/terraform/checks/resource/github/test_RepositoryVulnerabilityAlerts.py b/tests/terraform/checks/resource/github/test_RepositoryVulnerabilityAlerts.py
--- a/tests/terraform/checks/resource/github/test_RepositoryVulnerabilityAlerts.py
+++ b/tests/terraform/checks/resource/github/test_RepositoryVulnerabilityAlerts.py
@@ -19,6 +19,8 @@ def test(self):
             "github_repository.pass",
             "github_repository.pass2",
             "github_repository.pass3",
+            "github_repository.pass4",
+            "github_repository.pass5",
         }
         failing_resources = {
             "github_repository.fail",
@@ -28,7 +30,7 @@ def test(self):
         passed_check_resources = set([c.resource for c in report.passed_checks])
         failed_check_resources = set([c.resource for c in report.failed_checks])
 
-        self.assertEqual(summary["passed"], 3)
+        self.assertEqual(summary["passed"], 5)
         self.assertEqual(summary["failed"], 2)
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)