kics.yml

name: kics

on:
  pull_request:
    branches: [master]
    paths:
      - 'docker-compose/**'
      - 'helm/**'
      - '.github/workflows/kics.yml'
  push:
    branches: [master]
    paths:
      - 'docker-compose/**'
      - 'helm/**'
      - '.github/workflows/kics.yml'

permissions:
  security-events: write

jobs:
  kics:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: run kics Scan
        uses: checkmarx/kics-github-action@94469746ec2c43de89a42fb9d2a80070f5d25b16 # v2.1.3
        with:
          path: 'docker-compose,helm'
          ignore_on_exit: results
          output_path: report-dir/
          output_formats: 'sarif'
          token: ${{ secrets.GITHUB_TOKEN }}
          enable_jobs_summary: true
          platform_type: 'dockercompose,kubernetes'
          disable_secrets: true
          config_path: .github/kics.yml
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
        with:
          sarif_file: report-dir/results.sarif