Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test #1

Merged
merged 6 commits into from
Dec 30, 2020
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions action.yml
Original file line number Diff line number Diff line change
@@ -2,9 +2,20 @@
name: 'kics Github Action'
description: 'Run kics scan against IaC projects'
inputs:
directory:
description: 'directory with IaC to scan'
path:
description: 'path to file or directory to scan'
required: true
output_path:
description: 'file path to store result in json format'
required: false
payload_path:
description: 'file path to store source internal representation in JSON format'
required: false
queries:
description: 'path to directory with queries (default "./assets/queries")'
required: false
verbose:
description: 'verbose scan'
outputs:
results:
description: 'the result of kics scan'
@@ -13,4 +24,10 @@ branding:
color: 'green'
runs:
using: 'docker'
image: 'Dockerfile'
image: 'Dockerfile'
args:
- ${{ inputs.path }}
- ${{ inputs.output_path }}
- ${{ inputs.payload_path }}
- ${{ inputs.queries }}
- ${{ inputs.versbose }}
28 changes: 21 additions & 7 deletions entrypoint.sh
Original file line number Diff line number Diff line change
@@ -1,12 +1,26 @@
#!/bin/sh -l
#!/bin/bash
DATETIME="`date '+%H:%M'`"

if [ -z "$INPUT_PATH" ]
then
echo "${DATETIME} - ERR input path can't be empty"
exit 1
else
INPUT_PARAM="-p $INPUT_PATH"
fi

[[ ! -z "$INPUT_OUTPUT_PATH" ]] && OUTPUT_PATH_PARAM="-o $INPUT_OUTPUT_PATH"
[[ ! -z "$INPUT_PAYLOAD_PATH" ]] && PAYLOAD_PATH_PARAM="-d $INPUT_PAYLOAD_PATH"
[[ ! -z "$INPUT_QUERIES" ]] && QUERIES_PARAM="-q $INPUT_QUERIES"
[[ ! -z "$INPUT_VERBOSE" ]] && VERBOSE_PARAM="-v"

tag=`curl --silent "https://api.github.com/repos/Checkmarx/kics/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/'`
echo 'latest tag is' $tag
echo "${DATETIME} - INF latest tag is $tag"
version=`echo $tag | sed -r 's/^.{1}//'`
echo 'version is' $version
echo "${DATETIME} - INF version is $version"

echo "Downloading latest kics binaries"
wget -c "https://github.com/Checkmarx/kics/releases/download/${tag}/kics_${version}_linux_x64.tar.gz" -O - | tar -xz
echo "${DATETIME} - INF downloading latest kics binaries kics_${version}_linux_x64.tar.gz"
wget -q -c "https://github.com/Checkmarx/kics/releases/download/${tag}/kics_${version}_linux_x64.tar.gz" -O - | tar -xz &>/dev/null

echo "about to scan directory" $INPUT_DIRECTORY
./kics -p $INPUT_DIRECTORY -o results.json
echo "${DATETIME} - INF : about to scan directory $INPUT_PATH"
./kics $INPUT_PARAM $OUTPUT_PATH_PARAM $PAYLOAD_PATH_PARAM $QUERIES_PARAM $VERBOSE_PARAM