Skip to content

Added kics integration #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iamgp21 merged 3 commits into from
Aug 18, 2025
Merged

Added kics integration #5

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
93a8937
Added kics integration
iamgp21 Aug 18, 2025
6b92d04
Updated workflow with Kics integration
iamgp21 Aug 18, 2025
3daf799
Updated workflow to test scan of github actions workflow using kics
iamgp21 Aug 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 32 additions & 2 deletions .github/workflows/dbac-deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,38 @@

jobs:

infra_scan:
name: 'Infra Scan'
runs-on: ubuntu-latest

permissions:
# required for all workflows
security-events: write
contents: 'read'

steps:
# Checkout the repository to the GitHub Actions runner
- name: Checkout
uses: 'actions/checkout@v4'

- name: Make Infra Scan Directory
run: mkdir -p infra_scan_results

- name: run kics Scan
uses: Checkmarx/[email protected]

Check warning on line 34 in .github/workflows/dbac-deploy.yaml

View workflow job for this annotation

GitHub Actions / Infra Scan

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
path: '.github/workflows/'
ignore_on_exit: results #dont fail on results (overwrite default behaviour fails)
output_path: 'infra_scan_results' # when provided with a directory on output_path it will generate the specified reports file named 'results.{extension}'
output_formats: 'json,sarif'

- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v3

Check warning on line 42 in .github/workflows/dbac-deploy.yaml

View workflow job for this annotation

GitHub Actions / Infra Scan

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
sarif_file: infra_scan_results/results.sarif

docs:
needs: [infra_scan]
runs-on: ubuntu-latest

permissions:
Expand All @@ -25,7 +56,7 @@
ref: ${{ github.event.pull_request.head.ref }} # Use the PR branch for checkout

- name: Render terraform docs inside the README.md and push changes back to PR branch
uses: terraform-docs/[email protected]

Check warning on line 59 in .github/workflows/dbac-deploy.yaml

View workflow job for this annotation

GitHub Actions / Infra Scan

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
working-dir: .
output-file: README.md
Expand All @@ -34,7 +65,7 @@

dbac_deploy:
runs-on: DbaC
needs: [docs]
needs: [infra_scan, docs]

defaults:
run:
Expand All @@ -42,7 +73,7 @@

permissions:
contents: 'read'
id-token: 'write'

Check warning on line 76 in .github/workflows/dbac-deploy.yaml

View workflow job for this annotation

GitHub Actions / Infra Scan

[HIGH] Passwords And Secrets - Generic Token 

Query to find passwords and secrets in infrastructure code.
pull-requests: 'read'

steps:
Expand All @@ -51,7 +82,7 @@
uses: 'actions/checkout@v4'

- name: Detect changes
uses: dorny/paths-filter@v3

Check warning on line 85 in .github/workflows/dbac-deploy.yaml

View workflow job for this annotation

GitHub Actions / Infra Scan

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
id: detect-changes
with:
filters: |
Expand All @@ -62,7 +93,6 @@
- 'entrypoint.tf'
- 'modules/**'
- .github/workflows/dbac-deploy.yaml
continue-on-error: false

# Install Node.js
- name: Setup Node.js
Expand All @@ -72,7 +102,7 @@

# Install the latest version of Terraform CLI and configure the Terraform CLI configuration file with a Terraform Cloud user API token
- name: "Setup Terraform"
uses: hashicorp/setup-terraform@v3

Check warning on line 105 in .github/workflows/dbac-deploy.yaml

View workflow job for this annotation

GitHub Actions / Infra Scan

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
terraform_version: "1.9.0"

Expand Down