Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(githubactions): ignore official/known actions #6971

Open
baruchiro opened this issue Mar 26, 2024 · 0 comments
Open

feat(githubactions): ignore official/known actions #6971

baruchiro opened this issue Mar 26, 2024 · 0 comments
Labels
community Community contribution docker Docker query feature request Community: new feature request query New query feature

Comments

@baruchiro
Copy link
Contributor

Is your feature request related to a problem? Please describe.
As a Kics user, I encounter challenges when dealing with the “Unpinned Actions Full Length Commit SHA” query. While pinning actions is essential for security, there are scenarios where certain actions can be trusted without the need for manual pinning. Specifically, actions from well-known sources like actions/, github/, and docker/ fall into this category.
However, the current process requires me to either disable the query entirely or manually exclude trusted actions by # kics-scan ignore-line, which is cumbersome and error-prone.

Describe the solution you'd like
I propose enhancing the query to allow users to specify trusted prefixes for actions.
When evaluating whether an action should be pinned, Kics should skip actions with these trusted prefixes.
This feature would streamline the process, improve workflow efficiency, and reduce the need for manual intervention.

Describe alternatives you've considered
Currently, I manually exclude trusted action lines. However, this approach is time-consuming and prone to oversight.

Additional context
https://github.com/Checkmarx/2ms/pull/223/files

@baruchiro baruchiro added community Community contribution feature request Community: new feature request labels Mar 26, 2024
@github-actions github-actions bot added query New query feature docker Docker query labels Mar 26, 2024
baruchiro pushed a commit to Checkmarx/2ms that referenced this issue Mar 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
community Community contribution docker Docker query feature request Community: new feature request query New query feature
Projects
None yet
Development

No branches or pull requests

1 participant