checkmarx/KICS Github Action
Run KICS scan against IaC projects
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | The GITHUB_TOKEN for the current workflow run | no | ${{github.token}} |
| enable_annotations | Enable annotations report | no | true |
| enable_comments | Enable pull request report comments | no | false |
| enable_jobs_summary | Enable report as jobs summary | no | false |
| comments_with_queries | Add queries in th pull request report comments (available when enable_comments = true) | no | false |
| excluded_column_for_comments_with_queries | Excluded columns for the comment with queries, accepts a comma separated list | no | description_id,similarity_id,search_line,search_value |
| path | paths to a file or directories to scan, accepts a comma separated list | yes | — |
| ignore_on_exit | defines which non-zero exit codes should be ignored (all, results, errors, none) | no | — |
| fail_on | comma separated list of which severities returns exit code !=0 | no | — |
| timeout | number of seconds the query has to execute before being canceled | no | — |
| profiling | turns on profiler that prints resource consumption in the logs during the execution (CPU, MEM) | no | — |
| config_path | path to configuration file | no | — |
| platform_type | case insensitive list of platform types to scan | no | — |
| exclude_paths | exclude paths from scan, supports glob, quoted comma separated string example: './shouldNotScan/*,somefile.txt' | no | — |
| exclude_queries | exclude queries by providing the query ID | no | — |
| exclude_categories | exclude categories by providing its name, can be provided multiple times or as a comma separated string | no | — |
| exclude_results | exclude results by providing the similarity ID of a result | no | — |
| exclude_severities | exclude results by providing the severity of a result | no | — |
| exclude_gitignore | disables the exclusion of paths specified within .gitignore file | no | — |
| output_formats | formats in which the results report will be exported (json, sarif) | no | — |
| output_path | directory to store results report | no | — |
| payload_path | file path to store source internal representation in JSON format | no | — |
| queries | path to directory with queries (default "./assets/queries") | no | — |
| secrets_regexes_path | path to secrets regex rules configuration file | no | — |
| libraries_path | path to directory with Rego libraries | no | — |
| disable_full_descriptions | disable request for full descriptions and use default vulnerability descriptions | no | — |
| disable_secrets | disable secrets detection | no | — |
| type | case insensitive comma-separated list of platform types to scan (Ansible, AzureResourceManager, CloudFormation, Dockerfile, Kubernetes, OpenAPI, Terraform) | no | — |
| verbose | verbose scan | no | — |
| include_queries | comma separated list of queries ID's to include, cannot be provided with query exclusion flags | no | — |
| bom | include bill of materials (BoM) in results output | no | — |
| cloud_provider | list of cloud providers to scan (alicloud, aws, azure, gcp) | no | — |
Outputs
no outputs