Skip to content

KICS security and vulnerability scanner #1988

KICS security and vulnerability scanner

KICS security and vulnerability scanner #1988

Workflow file for this run

name: "KICS security and vulnerability scanner"
on:
push:
branches: main
paths-ignore:
- '**/*.md'
- '**/*.txt'
pull_request:
branches: main
paths-ignore:
- '**/*.md'
- '**/*.txt'
schedule:
- cron: '0 0 * * *' # Once a day
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- name: KICS scan
uses: checkmarx/kics-github-action@master
with:
# Scanning directory .
path: "."
# Exclude paths or files from scan
# full-irs is a demonstration and not intended to run in a production environment, it can be excluded
exclude_paths: local/deployment/docker-compose.yml,docs/src/api/irs-api.yaml,local/testing/api-tests/irs-api-tests.tavern.yaml,charts/irs-environments/local/*,local/deployment/full-irs
# Fail on HIGH severity results
fail_on: high
# when provided with a directory on output_path
# it will generate the specified reports file named 'results.{extension}'
# in this example it will generate:
# - results-dir/results.json
# - results-dir/results.sarif
output_path: kicsResults/
output_formats: "json,sarif"
# If you want KICS to ignore the results and return exit status code 0 unless a KICS engine error happens
# ignore_on_exit: results
# GITHUB_TOKEN enables this github action to access github API and post comments in a pull request
# token: ${{ secrets.GITHUB_TOKEN }}
# enable_comments: true
# Exclude accepted results from the build
exclude_results: "03df1ef13c69b0ada26fc5bbf35eabca288c5c3c93c0f5d918e41f4951ca8795,8bdf179adec9aee0035149315b63a3f8afd684076358433767758a4a9aeac922" # application-local.yml - local env minio password
# Exclude accepted queries from the build
# Exclude 8d29754a-2a18-460d-a1ba-9509f8d359da - IAM Access Analyzer Not Enabled. This is a false positive for AWS configs which are not used
exclude_queries: "8d29754a-2a18-460d-a1ba-9509f8d359da"
# No secret scanning
disable_secrets: true
# Upload findings to GitHub Advanced Security Dashboard
- name: Upload SARIF file for GitHub Advanced Security Dashboard
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: kicsResults/results.sarif
- name: Archive results
uses: actions/upload-artifact@v4
if: always()
with:
name: kicsResults.json
path: kicsResults/results.json