0hardik1/kubesplaining
Kubernetes security assessment with multi-hop RBAC privilege-escalation graphs. Runs against a live cluster (via kubeconfig) or a pre-collected snapshot JSON, emits SARIF for GitHub code scanning, and optionally fails the build on critical findings.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 1, 2026
- License
- Apache 2.0
Pinned Snippet
uses: 0hardik1/kubesplaining@b7d5629d3e3f97e579502e690c7a7c26128cdf69 # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | GHCR image tag to pull. Defaults to `main` while the release pipeline is bootstrapping; switch to `latest` or a pinned `vX.Y.Z` after v1.0.0. | no | main |
| kubeconfig | Base64-encoded kubeconfig for live-cluster scans. Leave empty when using `input-file`. The action writes it to a temporary file inside the runner and exports `KUBECONFIG` so the CLI picks it up; the file is removed after the scan regardless of exit status. | no | "" |
| input-file | Path (relative to the repo checkout) to a pre-collected snapshot JSON produced by `kubesplaining download`. When set, the action skips live collection and runs `scan --input-file` against the snapshot instead. | no | "" |
| severity-threshold | Minimum severity to include in the report: critical, high, medium, low, or info. Forwarded verbatim to `--severity-threshold`. | no | medium |
| output-dir | Directory (relative to the repo checkout) where the report artifacts will be written. Created if it does not exist. | no | ./kubesplaining-report |
| fail-on-critical | When true, the underlying CLI is invoked with `--ci-mode --ci-max-critical 0` so the workflow step exits non-zero on any critical finding. Set to false to surface findings without failing the build. | no | true |
| upload-sarif | When true, the SARIF result is uploaded to GitHub code scanning via `github/codeql-action/upload-sarif@v3`. Requires the calling workflow to grant `security-events: write` permission. | no | true |
| compliance | Optional compliance filter, forwarded to `--compliance`. Supported values are `cis` and `nsa`. Leave empty to skip the filter. | no | "" |
Outputs
| name | description |
|---|---|
| report-dir | Absolute path to the directory containing the generated reports. |
| sarif-file | Absolute path to the SARIF report (only set when SARIF is emitted). |