Skip to content
shield

GitHub Action

Bridgecrew Github Action

v1.177.2 Latest version
Use latest version
shield

Bridgecrew Github Action

Find and fix security and compliance issues in infrastructure code using Bridgecrew Action

Installation

Copy and paste the following snippet into your .yml file.

- name: Bridgecrew Github Action
  uses: bridgecrewio/[email protected]
Learn more about this action in bridgecrewio/bridgecrew-action
Choose a version

Bridgecrew GitHub Action

The Bridgecrew GitHub Action

Use the Bridgecrew GitHub action to scan for infrastructure-as-code errors in your GitHub action pipeline. By utilizing this GitHub action in your project workflow, you can automatically start to find, fix and monitor your project for configuration errors in Terraform, CloudFormation and kubernetes. By signing up for a free Bridgecrew Community plan you can also view dashboards and reports. The community plan does not limit the number of scans or users you can invite to view the results. ​

How to use the Bridgecrew GitHub Action

In fact, it is very easy to start using the GitHub action. All you need to do is:

  1. Follow the instructions at GitHub configuration a workflow to enable Github Action in your repository.
  2. Set up an environment variable with your Bridgecrew API key, which you can get from your Bridgecrew account.
  3. In the app build job, uses the bridgecrewio/[email protected]
  4. Optionally, supply parameters to customize GitHub action behaviour

Usage Examples

Scan IaC in your repository

      - name: Run Bridgecrew 
        id: Bridgecrew
        uses: bridgecrewio/[email protected]
        with:
         api-key: ${{ secrets.BRIDGECREW_API_KEY }}
         directory: "example/examplea"
         check: CKV_AWS_1 # optional: run only a specific check_id. can be comma separated list
         skip_check: CKV_AWS_1 # optional: skip a specific check_id. can be comma separated list
         soft_fail: false
         framework: terraform # optional: run only on a specific infrastructure {cloudformation,terraform,kubernetes,all}
         output_format: cli
         quiet: false
         external_checks_dir: ./checkov
         download_external_modules: true # optional: download external terraform modules from public git repositories and terraform registry
         log_level: DEBUG # optional: set log level. Default WARNING

Github code scanning

Bridgecrew supports github code scanning. An example workflow configuration can be found here.

GitHub action Parameters

Parameter Description Required Default Type
api-key Environment variable name of the Bridgecrew API key from Bridgecrew app No Secret parameter
directory IaC root directory to scan No "." Input parameter
soft_fail Runs checks without failing build No Input parameters
check filter scan to run only on a specific check identifier, You can specify multiple checks separated by comma delimiter No Input parameters
skip_check filter scan to run on all check but a specific check identifier(blacklist), You can specify multiple checks separated by comma delimiter, clashes with check No Input parameters
quiet display only failed checks No Input parameters
external_checks_dir Directory for custom checks to be loaded No Input parameters
output_format The format of the output - json - cli - sarif No Input parameters
framework run on a specific infrastructure No cloudformation,terraform,kubernetes,all
download_external_modules download external terraform modules from public git repositories and terraform registry No Input parameters
log_level set log level No WARNING Input parameters

Full reference docs here.

Screenshots

Reject pull requests containing infrastructure code configuration errors Find & fix resources that might be a risk