normalize kube-bench output before validation

.github/workflows/kube-bench-scan.yml

@@ -74,11 +74,19 @@ jobs:
           kubectl apply -f ci/kube-bench-k3s-job.yaml
           kubectl wait --for=condition=complete job/kube-bench -n kube-bench --timeout=180s
           job_rc=$?
-          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.json || true
+          kubectl logs -n kube-bench job/kube-bench > artifacts/kube-bench-k3s-cis-1.7.raw || true
+          awk '
+            BEGIN {capture = 0}
+            !capture && index($0, "{") > 0 {
+              sub(/^.*\{/, "{")
+              capture = 1
+            }
+            capture {print}
+          ' artifacts/kube-bench-k3s-cis-1.7.raw > artifacts/kube-bench-k3s-cis-1.7.json
 
           if ! jq -e . artifacts/kube-bench-k3s-cis-1.7.json >/dev/null; then
             echo "kube-bench did not produce valid JSON" >&2
-            cat artifacts/kube-bench-k3s-cis-1.7.json
+            cat artifacts/kube-bench-k3s-cis-1.7.raw
             exit 1
           fi