kics.yml

name: kics

on:
  pull_request:
    branches: [main]
    paths:
      - 'charts/**'
      - '.github/workflows/kics.yml'
  push:
    branches: [main]
    paths:
      - 'charts/**'
      - '.github/workflows/kics.yml'

permissions:
  security-events: write

jobs:
  kics:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      - name: Run KICS Scan
        uses: checkmarx/kics-github-action@530ac1f8efe6202b0f12c9a6e952597ae707b755 # v2.1.2
        with:
          path: 'charts'
          ignore_on_exit: results
          output_path: report-dir/
          output_formats: 'sarif'
          token: ${{ secrets.GITHUB_TOKEN }}
          enable_jobs_summary: true
          platform_type: 'kubernetes'
          disable_secrets: true
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.26.8
        with:
          sarif_file: report-dir/results.sarif