Rendering errors in helm charts

[jghal]

I have a helm chart based off of https://github.com/runatlantis/helm-charts/tree/main/charts/atlantis when I try to scan with Kics (both 1.7.x in GitLab CI's IaC scan docker image and 2.1.0 in the official checkmarx/kics docker image) I get a bunch of parsing errors. To give you something reproducible, If I clone the runatlantis/helm-charts repo, cd into the charts/atlantis directory and run this

$ docker run --rm -it -u $(id -u):$(id -u) -v $(pwd):/work -w /work checkmarx/kics scan --ci -t Kubernetes -p /work/

It prints out an error like below for basically every yaml file in the templates directory.

4:01PM ERR failed to parse file content: /work/templates/configmap-config.yaml error="failed to parse yaml: invalid yaml"

This particular file looks like this

{{- if .Values.repoConfig -}}
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ template "atlantis.fullname" . }}-repo-config
  labels:
    app: {{ template "atlantis.name" . }}
    chart: {{ template "atlantis.chart" . }}
    release: {{ .Release.Name }}
    heritage: {{ .Release.Service }}
data:
  repos.yaml: |
{{ .Values.repoConfig | indent 4 }}
{{- end -}}

What do I need to do to get my chart to be scannable?

[dmitryp-devops]

Any workarounds?

[jghal]

Not that I've been made aware of. I posted #7161 after there was no activity here, and that hasn't received any response from Checkmarx either.

[dmitryp-devops]

Turns out you need to provide a rendered Helm chat already (as the documentation says so). I wish they state it explicitly as one might think kics can render a template on it's own.