[cx-artur-ribeiro]

Reason for Proposed Changes:

• The scan path and the other path-valued inputs (payload_path, config_path, exclude_paths, libraries_path, secrets_regexes_path, queries, output_path) were expanded unquoted, so a value with a space was split into several arguments.
• KICS treats each of these as one literal path, and splits list values only on commas.
• With split arguments KICS either failed (for example stat /ws/my: no such file) or silently did the wrong thing, such as ignoring exclude_paths or writing the output to a directory called my.

Proposed Changes:

• Quote the scan path (-p "$INPUT_PATH") and the line that strips surrounding quotes.
• Pass the other path flags to kics as quoted positional parameters, so each value stays one argument.
• Quote cd "$GITHUB_WORKSPACE".
• Remove knownBug from the path-with-spaces test, add a test for each path input, and update the expected flag order in the baseline command-line test.

[stepsecurity-app]

✅ Resolved — a later workflow run passed this policy check.

Original alert (resolved)

Security Policy Alert: Secret Policy Violation

This workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch.

Secret references detected:

• secrets.ECHO_LIBRARIES_ACCESS_KEY at line 29

To approve this workflow, please add the workflows-approved label to this PR.

Note: The label must be added by someone other than the PR author (cx-artur-ribeiro) or automation bots to ensure proper security review.

After the label is added, you can re-run the blocked workflow to proceed.

This workflow will be automatically approved once merged into the default branch.

For more information, see StepSecurity's Secret Exfiltration Policy documentation.

[github-actions]

KICS version: v2.1.20

Category Results CRITICAL 0 HIGH 1 MEDIUM 3 LOW 1 INFO 0 TRACE 0 TOTAL 5	Metric Values Files scanned 2 Files parsed 2 Files failed to scan 0 Total executed queries 1100 Queries failed to execute 0 Execution time 23

Queries Results

Query Name Query Id Severity Platform Cwe Risk Score Category Experimental Description File Name Line Issue Type Search Key Expected Value Actual Value Resource Type Resource Name Remediation Remediation Type Passwords And Secrets - Generic Password 487f4be7-3fd9-4506-a07a-eae252180c08 HIGH Common 798 7.8 Secret Management false Query to find passwords and secrets in infrastructure code. test/samples/positive1.tf 12 RedundantAttribute Hardcoded secret key should not appear in source Hardcoded secret key appears in source AD Admin Not Configured For SQL Server a3a055d2-9a2e-4cc9-b9fb-12850a1a3a4b MEDIUM Terraform 732 5.9 Insecure Configurations false The Active Directory Administrator is not configured for a SQL server test/samples/positive1.tf 6 MissingAttribute azurerm_sql_server[positive2] A 'azurerm_sql_active_directory_administrator' should be defined for 'azurerm_sql_server[positive2]' A 'azurerm_sql_active_directory_administrator' is not defined for 'azurerm_sql_server[positive2]' azurerm_sql_server mysqlserver1 Admin User Enabled For Container Registry b897dfbf-322c-45a8-b67c-1e698beeaa51 MEDIUM Terraform 732 5.4 Access Control false Admin user is enabled for Container Registry test/samples/positive2.tf 11 IncorrectValue azurerm_container_registry[positive2].admin_enabled 'admin_enabled' equal 'false' 'admin_enabled' equal 'true' azurerm_container_registry containerRegistry1 {"after":"false","before":"true"} replacement SQL Server Auditing Disabled f7e296b0-6660-4bc5-8f87-22ac4a815edf MEDIUM Terraform 778 6.4 Observability false Make sure that for SQL Servers, 'Auditing' is set to 'On' test/samples/positive1.tf 6 MissingAttribute azurerm_sql_server[positive2] 'azurerm_sql_server.positive2.extended_auditing_policy' should exist 'azurerm_sql_server.positive2.extended_auditing_policy' does not exist azurerm_sql_server mysqlserver1 SQL Server Predictable Active Directory Account Name bcd3fc01-5902-4f2a-b05a-227f9bbf5450 LOW Terraform 522 2.9 Best Practices false Azure SQL Server must avoid using predictable Active Directory Administrator Account names, like 'Admin', which means the attribute 'login' must be set to a name that is not easy to predict test/samples/positive1.tf 18 IncorrectValue azurerm_sql_active_directory_administrator[positive3].login 'azurerm_sql_active_directory_administrator[positive3].login' should not be predictable' 'azurerm_sql_active_directory_administrator[positive3].login' is predictable azurerm_sql_active_directory_administrator positive3