Fail CI Pipeline on KICS Severity Threshold Using jq Exit Code

This snippet runs KICS, captures the JSON report, then uses jq to count findings at or above a chosen severity and exits non-zero if any are present, giving you a hard CI gate independent of KICS's own --fail-on flag semantics. Internally, KICS writes a results.json containing a queries array; each entry has a severity field with values TRACE, INFO, LOW, MEDIUM, HIGH, or CRITICAL. The jq filter selects entries whose severity matches the target set and prints the length; a shell test then translates that count into an exit status. This two-step approach lets you apply custom logic, such as ignoring specific query IDs or files, before failing.

Use this in Jenkins declarative pipelines, GitHub Actions, or any runner where you need auditable, explicit gating logic rather than relying on a tool's built-in exit behavior. It is also invaluable when you must allow a documented exception list (for example, a known-accepted MEDIUM finding) while still blocking HIGH and CRITICAL regressions. Teams often store the jq filter in a shared script so all repositories enforce identical thresholds.

A key pitfall is that KICS may exit 0 even when findings exist unless --fail-on is set, so relying solely on the container exit code can produce false greens. Also ensure jq is installed on the runner; minimal Alpine images lack it by default. Store the JSON report as a CI artifact for trend analysis and to satisfy audit requirements, and never echo the raw report to logs if IaC files contain embedded secrets or internal hostnames.

> System.Execute()

docker run --rm -v "$(pwd):/src:ro" checkmarx/kics:v1.7.13 scan \
  -p /src --report-formats json -o /src/kics-out --silent || true

BLOCKING=$(jq '[.queries[] | select(.severity=="HIGH" or .severity=="CRITICAL")] | length' \
  kics-out/results.json)

echo "Blocking findings: ${BLOCKING}"
if [ "${BLOCKING}" -gt 0 ]; then
  echo "KICS gate failed: HIGH/CRITICAL issues detected"
  exit 1
fi
exit 0

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-1CA25FA4B016