GitHub actions never fail

[kralablee]

The tool works really well & I'd love to adopt it across the board, however, it doesn't matter what I put into the: soft_fail: setting it never fails & never feeds back to the pull request. The snip of the output of the tool shows this:

"ARM/" "" "CKV_AZURE_17" "true" "false" "arm" "" "" "github_failed_only" "true" "WARNING" input_soft_fail:false running checkov on directory: ARM/

Which does indicate that the entrypoint.sh is getting the setting correctly, but it just doesn't feedback a failure.

[joferrao]

I have a similar issue: the output shows many errors, I have soft_fail: false but still both the job and the step where the action is used show as successful. Is there a way to force the action to make the job/step fail for failures found?

[dhishan]

Another tip to make it more friendly: The tool should also generate and upload the SARIF file. This way the security vulnerabilities are captured in the securities tab.

[HariSekhon]

@dhishan The SARIF upload functionality was added since your comment as I'm using this successfully to get the alerts in my GitHub repo's Security tab.

[gruebel]

support for SARIF output was added quite a while ago and it works correctly for a while.