使用 kubescape 扫描时，如何在 github 操作中获取“风险评分”output？

Question

I'm wondering if it's possible to get the risk-score output from a kubescape scan? I know that we can use the parameter "-t 25" in the command for github action, but I want to use a warning instead or returning an exit error if the risk-score is above the threshold value.

Here is a quick overview of what I want to have:

  jobs:
  warning_message:
    runs-on: ubuntu-latest
    #code for getting the risk-score output
    steps:
      - name: check_comparaison_risk-score
        if: ${{ risk_output }} > 25
        run: echo "::warning ::Risk-score is above 25%"

You can propose another solution/alternative to it.

Answer 1

You should use the official Kubescape GitHub actions , and add the failedThreshold as shown in the inputs section:

name: Kubescape scanning for misconfigurations
on: [push, pull_request]
jobs:
  kubescape:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: kubescape/github-action@main
      with:
        format: sarif
        outputFile: results.sarif
        # # Optional: Specify the Kubescape cloud account ID
        # account: ${{secrets.KUBESCAPE_ACCOUNT}}
        # Fail when the risk-score is higher than X 
        failedThreshold: 25

    - name: Upload Kubescape scan results to Github Code Scanning
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: results.sarif