Skip to content

Commit ff37c88

Browse files
bsgrigorovbsgrigorov
committed
feat: add kics and trivy scan
1 parent 9c5c260 commit ff37c88

File tree

2 files changed

+186
-0
lines changed

2 files changed

+186
-0
lines changed

‎.github/workflows/kics.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# KICS (Keeping Infrastructure as Code Secure) – whole repo IaC scan.
2+
# Run alongside Trivy (trivy.yml) to compare findings.
3+
# Scans: Kubernetes, Helm, Dockerfile, etc.
4+
#
5+
# ADVANCED_SECURITY (same as trivy.yml): when "true", upload SARIF + artifacts.
6+
#
7+
name: KICS IaC Scan
8+
9+
permissions:
10+
contents: read
11+
security-events: write
12+
actions: read
13+
14+
on:
15+
push:
16+
branches: [main]
17+
paths:
18+
- "**/*.yaml"
19+
- "**/*.yml"
20+
- "**/*.tpl"
21+
- "**/Chart.yaml"
22+
- "**/Dockerfile"
23+
- ".github/workflows/kics.yml"
24+
pull_request:
25+
branches: [main]
26+
paths:
27+
- "**/*.yaml"
28+
- "**/*.yml"
29+
- "**/*.tpl"
30+
- "**/Chart.yaml"
31+
- "**/Dockerfile"
32+
- ".github/workflows/kics.yml"
33+
34+
concurrency:
35+
group: ${{ github.workflow }}-${{ github.ref }}
36+
cancel-in-progress: true
37+
38+
env:
39+
ADVANCED_SECURITY: "false"
40+
41+
jobs:
42+
kics:
43+
name: kics-iac
44+
runs-on: ubuntu-latest
45+
steps:
46+
- name: Checkout
47+
uses: actions/checkout@v6
48+
49+
- name: Create results dir
50+
run: mkdir -p results-dir
51+
52+
- name: Run KICS scan
53+
uses: Checkmarx/kics-github-action@v2.1.19
54+
with:
55+
path: "."
56+
output_path: "results-dir"
57+
output_formats: "json,sarif"
58+
ignore_on_exit: "results"
59+
enable_jobs_summary: "true"
60+
enable_annotations: "true"
61+
62+
- name: Upload KICS SARIF
63+
if: env.ADVANCED_SECURITY == 'true'
64+
uses: github/codeql-action/upload-sarif@v3
65+
continue-on-error: true
66+
with:
67+
sarif_file: "results-dir/results.sarif"
68+
category: "kics-iac"
69+
token: ${{ secrets.GITHUB_TOKEN }}
70+
71+
- name: Upload KICS results as artifacts
72+
if: env.ADVANCED_SECURITY == 'true'
73+
uses: actions/upload-artifact@v4
74+
with:
75+
name: kics-results
76+
path: results-dir/

‎.github/workflows/trivy.yml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Trivy IaC scan: Helm charts (Kubernetes misconfig).
2+
# Whole-repo scan of charts/ and config files.
3+
#
4+
# ADVANCED_SECURITY (env below):
5+
# "true" – SARIF → Security tab + artifacts (public / GHAS).
6+
# "false" – Table → job summary only (private, no GHAS). Default.
7+
#
8+
name: Trivy IaC (Kubernetes / Helm)
9+
10+
permissions:
11+
contents: read
12+
security-events: write
13+
actions: read
14+
15+
on:
16+
push:
17+
branches: [main]
18+
paths:
19+
- "**/*.yaml"
20+
- "**/*.yml"
21+
- "**/*.tpl"
22+
- "**/Chart.yaml"
23+
- "**/Dockerfile"
24+
- ".github/workflows/trivy.yml"
25+
pull_request:
26+
branches: [main]
27+
paths:
28+
- "**/*.yaml"
29+
- "**/*.yml"
30+
- "**/*.tpl"
31+
- "**/Chart.yaml"
32+
- "**/Dockerfile"
33+
- ".github/workflows/trivy.yml"
34+
35+
concurrency:
36+
group: ${{ github.workflow }}-${{ github.ref }}
37+
cancel-in-progress: true
38+
39+
env:
40+
ADVANCED_SECURITY: "false"
41+
TRIVY_SKIP_DIRS: "**/.git,**/node_modules"
42+
43+
jobs:
44+
trivy-config:
45+
name: trivy-iac
46+
runs-on: ubuntu-latest
47+
steps:
48+
- uses: actions/checkout@v6
49+
50+
- name: Trivy config scan (SARIF)
51+
if: env.ADVANCED_SECURITY == 'true'
52+
uses: aquasecurity/trivy-action@0.34.0
53+
with:
54+
scan-type: "config"
55+
scan-ref: "."
56+
skip-dirs: ${{ env.TRIVY_SKIP_DIRS }}
57+
format: "sarif"
58+
output: "trivy-config.sarif"
59+
severity: "CRITICAL,HIGH"
60+
exit-code: "0"
61+
hide-progress: "true"
62+
63+
- name: Trivy config scan (table)
64+
if: env.ADVANCED_SECURITY != 'true'
65+
uses: aquasecurity/trivy-action@0.34.0
66+
with:
67+
scan-type: "config"
68+
scan-ref: "."
69+
skip-dirs: ${{ env.TRIVY_SKIP_DIRS }}
70+
format: "table"
71+
output: "trivy-config.txt"
72+
severity: "CRITICAL,HIGH"
73+
exit-code: "0"
74+
hide-progress: "true"
75+
76+
- name: Post Trivy config to job summary
77+
if: env.ADVANCED_SECURITY != 'true'
78+
run: |
79+
{
80+
echo "### Trivy IaC (Kubernetes / Helm)"
81+
echo ""
82+
if [[ -s trivy-config.txt ]]; then
83+
echo "<details><summary>Click to expand</summary>"
84+
echo ""
85+
echo '```'
86+
cat trivy-config.txt
87+
echo '```'
88+
echo ""
89+
echo "</details>"
90+
else
91+
echo "No CRITICAL/HIGH findings."
92+
fi
93+
echo ""
94+
} >> $GITHUB_STEP_SUMMARY
95+
96+
- name: Upload Trivy config SARIF
97+
if: env.ADVANCED_SECURITY == 'true'
98+
uses: github/codeql-action/upload-sarif@v3
99+
continue-on-error: true
100+
with:
101+
sarif_file: "trivy-config.sarif"
102+
category: "trivy-iac-k8s-helm"
103+
token: ${{ secrets.GITHUB_TOKEN }}
104+
105+
- name: Upload Trivy SARIF as artifacts
106+
if: env.ADVANCED_SECURITY == 'true'
107+
uses: actions/upload-artifact@v4
108+
with:
109+
name: trivy-iac-sarif
110+
path: trivy-config.sarif

0 commit comments

Comments
 (0)