kubescape/Kubescape
Run Kubescape scan
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 1, 2026
- License
- Apache 2.0
Pinned Snippet
uses: kubescape/github-action@c9749b84d138c0cbbb702b258774954f5463b82e # v3.0.21tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| failedThreshold | Failure threshold is the percent above which the command fails and returns exit code 1 (default 0 i.e, action fails if any control fails) | no | — |
| complianceThreshold | Compliance threshold is the percent bellow which the command fails and returns exit code 1 (example: if set to 100 the command will fail if any control fails) | no | — |
| severityThreshold | Severity threshold is the severity of a failed control at or above which the command terminates with an exit code 1 (default is "high", i.e. the action fails if any High severity control fails) | no | high |
| files | Path to the configuration yaml to scan | no | — |
| outputFile | Name of the output file, without the extension. Default is "results". Kubescape adds the appropriate extension automatically to support both single and multiple output formats. | no | — |
| verbose | Display all of the input resources and not only failed resources | no | — |
| frameworks | List of all frameworks to scan. Run kubescape list frameworks with the Kubescape CLI to get a list of all frameworks. Either frameworks have to be specified or controls. | no | — |
| controls | List of all controls to scan. Run kubescape list controls with the Kubescape CLI to get a list of all frameworks. Either frameworks have to be specified or controls. | no | — |
| controlsConfig | Path to the file containing controls configuration. | no | — |
| account | Kubescape Portal client id. Use for integrating with third-party servers. | no | — |
| accessKey | Kubescape Portal accessKey. Use for integrating with third-party servers. | no | — |
| server | Kubescape Portal URL. Use for integrating with third-party servers. | no | — |
| exceptions | Path to the json file containing exceptions. | no | — |
| format | Output format. Can take one or more formats. To use one format, omit the comma, e.g `format: json`. To produce results in multiple formats, separate them with a comma: `format: sarif,json`. For example, when using `output: "results"` and `format: "sarif,json"`, Kubescape will produce 2 files: `results.sarif` and `results.json`. You can then use `results.sarif` to publish results to Github Code Scanning and `results.json` to suggest automatic fixes. Run `kubescape scan -h` to see a list of supported formats. | no | junit |
| fixFiles | Whether Kubescape will automatically fix files or not. If enabled, Kubescape will make fixes to the input files. You can then use these fixes to open Pull Requests from your CI/CD pipeline. | no | false |
| version | The version of Kubescape to use. Can be a specific version (e.g. "v3.0.21") or "latest". | yes | latest |
| image | An image to scan. This option runs an image scan instead of the usual configuration scan. Example: "nginx" or "bitnami/redis" or "quay.io/kubescape/kubescape" | no | — |
| registryUsername | A username for a private registry that contains the image to be scanned. | no | — |
| registryPassword | A password for a private registry that contains the image to be scanned. | no | — |
Outputs
no outputs