From 5ddb0f2fefc0ffc49156da661a19b48784740761 Mon Sep 17 00:00:00 2001
From: swaphb <s@swaphb.com>
Date: Tue, 11 Aug 2026 19:04:00 -0400
Subject: [PATCH] install jq for kube-bench report parsing

---
 .github/workflows/kube-bench-scan.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml
index 30ebe5e..f8b2a5f 100644
--- a/.github/workflows/kube-bench-scan.yml
+++ b/.github/workflows/kube-bench-scan.yml
@@ -38,6 +38,21 @@ jobs:
           install -m 0755 "$temp_dir/kubectl" /usr/local/bin/kubectl
           kubectl version --client
 
+      - name: Install jq
+        shell: bash
+        run: |
+          set -euo pipefail
+          jq_version=1.8.2
+          jq_sha256=b1c22172dd303f3be49e935aa56aa48a8b7a46e0bc838b4997d3bb451495870f
+          temp_dir="$(mktemp -d)"
+          trap 'rm -rf "$temp_dir"' EXIT
+          curl --fail --location --retry 3 \
+            --output "$temp_dir/jq" \
+            "https://github.com/jqlang/jq/releases/download/jq-${jq_version}/jq-linux-amd64"
+          printf '%s  %s\n' "$jq_sha256" "$temp_dir/jq" | sha256sum --check --strict -
+          install -m 0755 "$temp_dir/jq" /usr/local/bin/jq
+          jq --version
+
       - name: Create ephemeral K3s cluster
         run: |
           k3d cluster delete security-baseline-ci >/dev/null 2>&1 || true