### Summary SAST KICS does not match `Dockerfile-dev` as a Dockerfile anymore, resulting in that no vulnerabilities are reported anymore and potential security issues can not be addressed anymore, as the files are silently skipped. As Dockerfiles with `-` dash notation were matched before, this is a **regression** with **security** implications. Renaming Dockerfiles, even as a workaround, is not an option when repositories are forked or cloned broadly and/or other implementations rely on the naming. ### Steps to reproduce 1. ~~Have a project with `kics-iac-sast` enabled in the pipeline~~ 2. ~~Have a `Dockerfile` and a known vulnerability\* in the project OR: Create a `Dockerfile` with a known vulnerability in the project~~ 3. ~~Copy the `Dockerfile` file as `Dockerfile-dev`~~ 4. ~~Run the pipeline, including `kics-iac-sast`~~ ~~\* As a known vulnerability use e.g. a `COPY --chown=0:0 ...` instruction in the Dockerfile ("Chown Flag Exists") or a Dockerfile without a `HEALTHCHECK` instruction ("Healthcheck Instruction Missing") etc.~~ After further investigation the issue turned out to be more complex than described before. Therefore, we have created the below repository to reproduce the behavior: https://gitlab.com/aidigy.com/issue-630002 The [README.md](https://gitlab.com/aidigy.com/issue-630002) contains two snippets for running the scan with `registry.gitlab.com/security-products/kics:6.13.0` image: the first using `/analyzer run`, the second using `kics scan -p` directly. **Since both tests behave identically, the problem clearly lies with Checkmarx/kics and needs to be fixed upstream**. However, since SAST KICS is a feature provided and shipped by GitLab, tracking and resolving it here (e.g. via an image/version bump) remains relevant. ### What is the current _bug_ behavior? ~~SAST KICS matches and will report the vulnarability for `Dockerfile` but not `Dockerfile-dev` or other Dockerfiles with `-` notation or generally not when the filename is not named exactly `Dockerfile`.~~ Running the scan on the differently named and shaped Dockerfiles reveals interesting behaviors: 1. If the Dockerfile contains only a `FROM` and a `COPY` instruction, the `Dockerfile-dev` is **not** scanned (test-1) 2. If the Dockerfile contains only a `FROM` and a `RUN` instruction, the `Dockerfile-dev` is scanned (test-2) 3. If the Dockerfile contains a `FROM` and at least one `RUN` instruction, the `Dockerfile-dev` is scanned (test-3) 4. If the Dockerfile is multi-stage and contains a `FROM dhi.io/...`, i.e. FQIN notation, and a `RUN` instruction in a stage, the `Dockerfile-dev` is scanned (test-4) 5. If the Dockerfile is multi-stage and contains a `FROM ${DHI_IMAGE}`, i.e. ARG expansion, and a `RUN` instruction in a stage, the `Dockerfile-dev` is **not** scanned (test-5) Exactly the test-5 case is why we just noticed it: We refactored a lot of repositories recently for using `ARG` to set the base image. As these repositories contain both a `Dockerfile` and different `Dockerfile-*` the absences of vulnerabilities for just some Dockerfiles was not noticed directly. ### What is the expected _correct_ behavior? SAST KICS should match and report vulnerabilities for `Dockerfile-dev` as well as other Dockerfiles using `-` naming, as it did before and independent of the contents of the Dockerfile. ### Possible fixes ~~Requesting an upstream fix at Checkmarx/kics as the issue is very likely related to~~ ~~https://github.com/Checkmarx/kics/pull/8114~~ During further investigation we noticed the GitLab KICS analyzer was not even upgraded to KICS 2.2.0 yet - hence, **the changes from** **https://github.com/Checkmarx/kics/pull/8114** **are not the cause, but likely the fix**: ``` [INFO] [kics] [2026-09-20T11:41:11Z] ▶ GitLab kics analyzer v6.13.0 ... ``` ``` docker run --rm registry.gitlab.com/security-products/kics:6.13.0 kics version Keeping Infrastructure as Code Secure v2.1.20 ``` Unfortunately, we could not test against KICS 2.2.0 directly, as no corresponding image has been published yet. In addition to the potential fix provided with the latest KICS version, we'd like to propose that additional `-p` arguments to `kics scan` can be configured through the pipeline template. ### Workaround As pushed to the repository, below workaround can be used. For a `Dockerfile-dev` with just `COPY` statements add **after** the first `FROM`: ``` RUN echo "kics-trigger" ``` For a multi-stage `Dockerfile-dev` with `FROM ${IMAGE}` ARG expansion **no workaround for v2.1.20 is possible** by changing the Dockerfile alone. As we depend on the `ARG` expansion pattern and cannot simply switch to a literal FQIN, and since third-party forks rely on the file being named `Dockerfile-dev` (making renaming a breaking change), we have implemented a workaround by overriding the `kics-iac-sast` job. I'll share the details in the comments below.