-
Notifications
You must be signed in to change notification settings - Fork 23
108 lines (97 loc) · 3.46 KB
/
kics.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: "KICS"
on:
push:
branches: main
paths-ignore:
- '**/*.md'
- '**/*.txt'
pull_request:
branches: main
paths-ignore:
- '**/*.md'
- '**/*.txt'
schedule:
- cron: "0 0 * * *"
jobs:
analyze-frontend:
name: Analyze frontend
runs-on: ubuntu-latest
defaults:
run:
working-directory: frontend
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v3
- name: KICS scan
uses: checkmarx/kics-github-action@master
with:
# Scanning directory .
path: "./frontend"
# Excluded paths:
# - docker-compose.yml - used only on local env
# - in cypress dir docker related files used only on local env
exclude_paths: "docker-compose.yml,cypress/docker-compose.yml,cypress/Dockerfile"
# Fail on HIGH severity results
fail_on: high
# Disable secrets detection - we use GitGuardian
disable_secrets: true
# when provided with a directory on output_path
# it will generate the specified reports file named 'results.{extension}'
# in this example it will generate:
# - results-dir/results.json
# - results-dir/results.sarif
output_path: kicsResults/
output_formats: "json,sarif"
# If you want KICS to ignore the results and return exit status code 0 unless a KICS engine error happens
# ignore_on_exit: results
# GITHUB_TOKEN enables this github action to access github API and post comments in a pull request
# token: ${{ secrets.GITHUB_TOKEN }}
# enable_comments: true
# Upload findings to GitHub Advanced Security Dashboard
- name: Upload SARIF file for GitHub Advanced Security Dashboard
if: always()
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: kicsResults/results.sarif
analyze-backend:
name: Analyze backend
runs-on: ubuntu-latest
defaults:
run:
working-directory: tx-backend
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v3
- name: KICS scan
uses: checkmarx/kics-github-action@master
with:
# Scanning directory .
path: "./tx-backend"
# Fail on HIGH severity results
fail_on: high
# Disable secrets detection - we use GitGuardian
disable_secrets: true
# when provided with a directory on output_path
# it will generate the specified reports file named 'results.{extension}'
# in this example it will generate:
# - results-dir/results.json
# - results-dir/results.sarif
output_path: kicsResults/
output_formats: "json,sarif"
# If you want KICS to ignore the results and return exit status code 0 unless a KICS engine error happens
# ignore_on_exit: results
# GITHUB_TOKEN enables this github action to access github API and post comments in a pull request
# token: ${{ secrets.GITHUB_TOKEN }}
# enable_comments: true
# Upload findings to GitHub Advanced Security Dashboard
- name: Upload SARIF file for GitHub Advanced Security Dashboard
if: always()
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: kicsResults/results.sarif