security.helm.yml

---
name: Security (Helm)
on: # yamllint disable-line rule:truthy
  pull_request:
    types: [opened, synchronize]
    paths:
      - .github/workflows/security.helm.yml
      - charts/**

jobs:
  # Analyze statically Helm charts to identify any policy violations.
  checkov:
    name: Checkov
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 # v4.0.0
      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
        with:
          python-version: '3.8'
          check-latest: true

      - uses: bridgecrewio/checkov-action@a6b06158ca30c135b38291f4fa0da67d188ca8f4
        with:
          directory: charts/gitlab-ci-runner-exporter
          framework: helm
          skip_check: CKV_K8S_11,CKV_K8S_15,CKV_K8S_21,CKV_K8S_35,CKV_K8S_43
      - uses: github/codeql-action/upload-sarif@43750fe4fc4f068f04f2215206e6f6a29c78c763 # tag=codeql-bundle-20221211
        if: always()
        with:
          category: checkov-helm
          sarif_file: results.sarif