From f7fb479631b4dd30a0a2f601e3706a9d55b06f61 Mon Sep 17 00:00:00 2001 From: swaphb Date: Tue, 11 Aug 2026 17:45:29 -0400 Subject: [PATCH] normalize kube-bench output before validation --- .github/workflows/kube-bench-scan.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/kube-bench-scan.yml b/.github/workflows/kube-bench-scan.yml index 30ebe5e..d9e00d8 100644 --- a/.github/workflows/kube-bench-scan.yml +++ b/.github/workflows/kube-bench-scan.yml @@ -74,11 +74,19 @@ jobs: kubectl apply -f ci/kube-bench-k3s-job.yaml kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s job_rc=$? - kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true + kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.raw || true + awk ' + BEGIN {capture = 0} + !capture && index($0, "{") > 0 { + sub(/^.*\{/, "{") + capture = 1 + } + capture {print} + ' artifacts/kube-bench-k3s-cis-1.7.raw > artifacts/kube-bench-k3s-cis-1.7.json if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then echo "kube-bench did not produce valid JSON" >&2 - cat artifacts/kube-bench-k3s-cis-1.7.json + cat artifacts/kube-bench-k3s-cis-1.7.raw exit 1 fi