kics.yml

name: kics

on:
  pull_request:
    branches: [main]
    paths:
      - 'charts/**'
      - '.github/workflows/kics.yml'
  push:
    branches: [main]
    paths:
      - 'charts/**'
      - '.github/workflows/kics.yml'

permissions:
  security-events: write

jobs:
  kics:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run KICS Scan
        uses: checkmarx/kics-github-action@530ac1f8efe6202b0f12c9a6e952597ae707b755 # v2.1.2
        with:
          path: 'charts'
          ignore_on_exit: results
          output_path: report-dir/
          output_formats: 'sarif'
          token: ${{ secrets.GITHUB_TOKEN }}
          enable_jobs_summary: true
          platform_type: 'kubernetes'
          disable_secrets: true
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.26.8
        with:
          sarif_file: report-dir/results.sarif