scan-kics.yaml

name: Scan CVEs - KICS

permissions:
  contents: read

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
jobs:
  kics:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      
      - name: run kics Scan
        uses: checkmarx/kics-github-action@5a6152ef88416063435cebadfec9de28bcfd041d # v2.1.4
        with:
          path: 'demo,src'
          output_formats: 'sarif'
     
      - name: display kics results
        run: |
          cat results.sarif
      
      - name: Upload artifact
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
        with:
          sarif_file: results.sarif