Repository: bridgecrewio/checkov

Issue:
CKV_GIT_4 always fail with terraform_plan
**Describe the issue**
Once a GitHub org/repo secret is created and stored in the terraform state, the check CKV_GIT_4 will always fail when scanning terraform plans even if the value was created using an encrypted value.

It seems like the check consider `"plaintext_text": ""` to be a hard-coded secret because if I remove that line from the plan or change it to `"plaintext_text": null`, the check passes.

```
      "resources": [
        {
          "address": "github_actions_organization_secret.my_github_secret",
          "mode": "managed",
          "type": "github_actions_organization_secret",
          "name": "my_github_secret",
          "provider_name": "registry.terraform.io/integrations/github",
          "schema_version": 0,
          "values": {
            "created_at": "2023-05-17 13:54:59 +0000 UTC",
            "encrypted_value": "MIr5c6eSzTJeGW/uyB0u...",
            "id": "MY_GITHUB_SECRET",
            "plaintext_value": "",
            "secret_name": "MY_GITHUB_SECRET",
            "selected_repository_ids": [],
            "updated_at": "2023-05-17 13:54:59 +0000 UTC",
            "visibility": "all"
          },
          "sensitive_values": {
            "selected_repository_ids": []
          }
        }
```

**Examples**


**Version (please complete the following information):**
 - Checkov Version 2.3.223

**Additional context**
Add any other context about the problem here.



Discussion:

Resolving patch:
diff --git a/checkov/terraform/checks/resource/github/SecretsEncrypted.py b/checkov/terraform/checks/resource/github/SecretsEncrypted.py
--- a/checkov/terraform/checks/resource/github/SecretsEncrypted.py
+++ b/checkov/terraform/checks/resource/github/SecretsEncrypted.py
@@ -25,6 +25,10 @@ def scan_resource_conf(self, conf: Dict[str, List[Any]]) -> CheckResult:
         if plaintext and self._is_variable_dependant(plaintext[0]):
             return CheckResult.UNKNOWN
 
+        if isinstance(plaintext, list) and not plaintext[0]:
+            # this happens mainly in TF plan files, because the value is just an empty string
+            return CheckResult.PASSED
+
         return super().scan_resource_conf(conf)
 
     def get_inspected_key(self) -> str:


Test patch:
diff --git a/tests/terraform/checks/resource/github/example_SecretsEncrypted/main.tf b/tests/terraform/checks/resource/github/example_SecretsEncrypted/main.tf
--- a/tests/terraform/checks/resource/github/example_SecretsEncrypted/main.tf
+++ b/tests/terraform/checks/resource/github/example_SecretsEncrypted/main.tf
@@ -40,6 +40,13 @@ resource "github_actions_secret" "pass" {
   encrypted_value   = "WOULDBEENCRYPTED"
 }
 
+resource "github_actions_organization_secret" "pass_empty_value" {
+  environment       = "example_environment"
+  secret_name       = "example_secret_name"
+  encrypted_value   = "WOULDBEENCRYPTED"
+  plaintext_value   = ""
+}
+
 # value ref
 
 resource "azuread_service_principal_password" "gh_actions" {
diff --git a/tests/terraform/checks/resource/github/test_SecretsEncrypted.py b/tests/terraform/checks/resource/github/test_SecretsEncrypted.py
--- a/tests/terraform/checks/resource/github/test_SecretsEncrypted.py
+++ b/tests/terraform/checks/resource/github/test_SecretsEncrypted.py
@@ -20,6 +20,7 @@ def test(self):
         passing_resources = {
             "github_actions_environment_secret.pass",
             "github_actions_organization_secret.pass",
+            "github_actions_organization_secret.pass_empty_value",
             "github_actions_secret.pass",
         }
         failing_resources = {
@@ -36,7 +37,7 @@ def test(self):
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
         # github_actions_secret.value_ref is dependent on azuread_service_principal_password.gh_actions
-        self.assertEqual(summary["resource_count"], 8)  # 2 extra
+        self.assertEqual(summary["resource_count"], 9)  # 2 extra
 
         self.assertEqual(passing_resources, passed_check_resources)
         self.assertEqual(failing_resources, failed_check_resources)