fix: support vendored Kubescape artifacts

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+paths:
+  .github/workflows/example-fix-pr-review.yaml:
+    ignore:
+      # actionlint 1.7.12 metadata predates this actions/checkout input.
+      - 'input "allow-unsafe-pr-checkout" is not defined in action "actions/checkout@v5"'

.github/workflows/example-fix-pr-review.yaml

@@ -6,14 +6,20 @@ jobs:
   kubescape-fix-pr-reviews:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
 
     steps:
-    - uses: actions/checkout@v3
+    # This workflow only scans the checked-out manifests; it does not execute
+    # code from the pull request. Keep the explicit opt-in visible because
+    # pull_request_target otherwise refuses fork pull request checkouts.
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
-        ref: ${{github.event.pull_request.head.ref}}
+        ref: ${{github.event.pull_request.head.sha}}
         repository: ${{github.event.pull_request.head.repo.full_name}}
+        persist-credentials: false
+        allow-unsafe-pr-checkout: true
     - name: Get changed files
       id: changed-files
       uses: tj-actions/changed-files@v35

.github/workflows/test.yaml

@@ -0,0 +1,21 @@
+name: Entrypoint tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  entrypoint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: Check entrypoint syntax
+        run: bash -n entrypoint.sh
+      - name: Run entrypoint tests
+        run: bash tests/entrypoint_test.sh
+      - name: Run action command-construction tests
+        run: bash tests/action_test.sh

README.md

@@ -53,14 +53,20 @@ jobs:
   kubescape-fix-pr-reviews:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
 
     steps:
-    - uses: actions/checkout@v3
+    # This workflow only scans the checked-out manifests; it does not execute
+    # code from the pull request. Keep the explicit opt-in visible because
+    # pull_request_target otherwise refuses fork pull request checkouts.
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
-        ref: ${{github.event.pull_request.head.ref}}
+        ref: ${{github.event.pull_request.head.sha}}
         repository: ${{github.event.pull_request.head.repo.full_name}}
+        persist-credentials: false
+        allow-unsafe-pr-checkout: true
     - name: Get changed files
       id: changed-files
       uses: tj-actions/changed-files@v35
@@ -194,14 +200,41 @@ jobs:
 | verbose | Display all of the input resources and not only failed resources. Default is off | No |
 | exceptions | The JSON file containing at least one resource and one policy. Refer [exceptions](https://hub.armo.cloud/docs/exceptions) docs for more info. Objects with exceptions will be presented as exclude and not fail. | No |
 | controlsConfig | The file containing controls configuration. Use `kubescape download controls-inputs` to download the configured controls-inputs. | No |
+| artifacts | Workspace-relative path to a vendored Kubescape artifacts directory. The directory must resolve inside the workspace and cannot be used with `image`. | No |
 | image | The image you wish to scan. Launches an image scan, which cannot run together with configuration scans. | No |
 | registryUsername | Username to a private registry that hosts the scanned image. | No |
 | registryPassword | Password to a private registry that hosts the scanned image. | No |
 | version | The version of Kubescape to use. Can be a specific version (e.g. "v3.0.21") or "latest". | No (default is `latest`) |
 
 ## Examples
 
-> **Note:** The `version` input defaults to `latest`, so it is omitted from the examples below. For reproducible scans, pin a specific Kubescape release with e.g. `version: v3.0.21`.
+> **Note:** The `version` input defaults to `latest`, but pinning a Kubescape version alone does not pin the policy library used by a scan. Use a reviewed artifact bundle as described below when policy stability is required.
+
+### Reproducible policy evaluation
+
+Create the artifacts outside the CI run, review them, and commit the directory alongside the manifests that will be scanned:
+
+```bash
+kubescape download artifacts --output kubescape-artifacts
+```
+
+Then pin the action commit and Kubescape version, and scan a path that does not contain the artifact JSON files:
+
+```yaml
+- uses: actions/checkout@v3
+- uses: kubescape/github-action@<full-commit-sha>
+  with:
+    version: v4.0.13
+    frameworks: nsa
+    files: manifests/
+    artifacts: kubescape-artifacts/
+```
+
+The `artifacts` path must be relative to the checked-out workspace and must resolve inside it. Downloading the bundle during every CI run would fetch the current policy library again and defeat policy reproducibility.
+
+The bundle includes `exceptions.json` and `controls-inputs.json`. Kubescape v4.0.13 prefers explicit `exceptions` and `controlsConfig` inputs when they are supplied together with `artifacts`; older versions such as v3.0.21 prefer the files in the artifact bundle. When `account`, `accessKey`, or `server` are also supplied, they are still forwarded, but the vendored artifacts remain the policy source. Ensure that any required custom policies are present in the bundle.
+
+Pinning the action commit, Kubescape version, scanned manifests, and reviewed artifact bundle makes policy and rule evaluation reproducible. It does not make the entire container build reproducible because the action currently retrieves Kubescape's installer separately.
 
 #### Scan and submit results to the [Kubescape Cloud](https://cloud.armosec.io/)
 
@@ -344,4 +377,3 @@ jobs:
         with:
           sarif_file: results.sarif
 ```
-

action.yml

@@ -51,6 +51,11 @@ inputs:
     description: |
       Path to the file containing controls configuration.
     required: false
+  artifacts:
+    description: |
+      Workspace-relative path to a vendored Kubescape artifacts directory.
+      The directory is used as the policy source for configuration scans.
+    required: false
   account:
     description: |
       Kubescape Portal client id.
@@ -136,6 +141,8 @@ runs:
           ${{ github.action_path }}
     - name: Run Kubescape scan
       shell: bash
+      env:
+        INPUT_ARTIFACTS: ${{ inputs.artifacts }}
       run: |
         docker run --rm \
           -e GITHUB_ACTIONS=true \
@@ -154,6 +161,7 @@ runs:
           -e INPUT_FRAMEWORKS="${{ inputs.frameworks }}" \
           -e INPUT_CONTROLS="${{ inputs.controls }}" \
           -e INPUT_CONTROLSCONFIG="${{ inputs.controlsConfig }}" \
+          -e INPUT_ARTIFACTS="$INPUT_ARTIFACTS" \
           -e INPUT_ACCOUNT="${{ inputs.account }}" \
           -e INPUT_ACCESSKEY="${{ inputs.accessKey }}" \
           -e INPUT_SERVER="${{ inputs.server }}" \

entrypoint.sh

@@ -56,6 +56,34 @@ fi
 
 exceptions=$([ -n "$INPUT_EXCEPTIONS" ] && echo "--exceptions ${INPUT_EXCEPTIONS}" || echo "")
 controls_config=$([ -n "$INPUT_CONTROLSCONFIG" ] && echo "--controls-config ${INPUT_CONTROLSCONFIG}" || echo "")
+artifacts_opt=""
+if [ -n "${INPUT_ARTIFACTS}" ]; then
+  case "${INPUT_ARTIFACTS}" in
+    /*)
+      echo "Artifacts path must be relative to the GitHub workspace"
+      exit 1
+      ;;
+  esac
+  if [ -n "${INPUT_IMAGE}" ]; then
+    echo "Artifacts cannot be used with image scans"
+    exit 1
+  fi
+  if [ ! -d "${INPUT_ARTIFACTS}" ]; then
+    echo "Artifacts directory '${INPUT_ARTIFACTS}' does not exist"
+    exit 1
+  fi
+
+  workspace_path=$(pwd -P)
+  resolved_artifacts_path=$(cd -- "${INPUT_ARTIFACTS}" && pwd -P)
+  case "${resolved_artifacts_path}" in
+    "${workspace_path}"|"${workspace_path}"/*) ;;
+    *)
+      echo "Artifacts directory must resolve inside the GitHub workspace"
+      exit 1
+      ;;
+  esac
+  printf -v artifacts_opt ' --use-artifacts-from %q' "${resolved_artifacts_path}"
+fi
 account_opt=$([ -n "${INPUT_ACCOUNT}" ] && echo --account "${INPUT_ACCOUNT}" || echo "")
 access_key_opt=$([ -n "${INPUT_ACCESSKEY}" ] && echo --access-key "${INPUT_ACCESSKEY}" || echo "")
 server_opt=$([ -n "${INPUT_SERVER}" ] && echo --server "${INPUT_SERVER}" || echo "")
@@ -86,7 +114,7 @@ if [ -n "${INPUT_IMAGE}" ]; then
   scan_input="${image_arg}"
 fi
 
-scan_command="kubescape scan ${image_subcmd} ${frameworks_cmd} ${controls_cmd} ${scan_input} ${account_opt} ${access_key_opt} ${server_opt} ${fail_threshold_opt} ${compliance_threshold_opt} ${severity_threshold_opt} --format ${output_formats} --output ${output_file} ${verbose} ${exceptions} ${controls_config}"
+scan_command="kubescape scan ${image_subcmd} ${frameworks_cmd} ${controls_cmd} ${scan_input} ${account_opt} ${access_key_opt} ${server_opt} ${fail_threshold_opt} ${compliance_threshold_opt} ${severity_threshold_opt} --format ${output_formats} --output ${output_file} ${verbose} ${exceptions} ${controls_config}${artifacts_opt}"
 
 echo "Running: ${scan_command}"
 eval "${scan_command}"

tests/action_test.sh

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+set -u
+
+repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd -P)
+test_root=$(mktemp -d)
+trap 'rm -rf "${test_root}"' EXIT
+
+passed=0
+failed=0
+
+pass() {
+  passed=$((passed + 1))
+  printf 'ok - %s\n' "$1"
+}
+
+fail() {
+  failed=$((failed + 1))
+  printf 'not ok - %s\n' "$1"
+}
+
+run_script="${test_root}/run.sh"
+bin_dir="${test_root}/bin"
+args_file="${test_root}/docker-args"
+mkdir -p "${bin_dir}"
+
+# Extract the composite step that constructs the docker command. Replacing
+# GitHub expressions with inert values lets this test execute that boundary
+# without needing a GitHub runner or Docker daemon.
+awk '
+  /^    - name: Run Kubescape scan$/ { in_step=1; next }
+  in_step && /^      run: \|$/ { in_run=1; next }
+  in_run && /^        / { sub(/^        /, ""); print; next }
+  in_run { exit }
+' "${repo_root}/action.yml" |
+  sed -E 's/\$\{\{[^}]+\}\}/test/g' > "${run_script}"
+
+cat > "${bin_dir}/docker" <<'STUB'
+#!/bin/bash
+printf '%s\n' "$@" > "${DOCKER_ARGS_FILE}"
+STUB
+chmod +x "${bin_dir}/docker"
+
+artifact_input='artifacts;touch PWNED'
+if (
+  cd "${test_root}" &&
+    PATH="${bin_dir}:${PATH}" \
+    DOCKER_ARGS_FILE="${args_file}" \
+    INPUT_ARTIFACTS="${artifact_input}" \
+    bash "${run_script}"
+) &&
+  grep -Fxq -- "INPUT_ARTIFACTS=${artifact_input}" "${args_file}" &&
+  [ ! -e "${test_root}/PWNED" ]; then
+  pass "composite action keeps artifact input data-only"
+else
+  fail "composite action keeps artifact input data-only"
+fi
+
+printf '%s passed, %s failed\n' "${passed}" "${failed}"
+[ "${failed}" -eq 0 ]