chore(deps): bump actions/setup-python from 5.6.0 to 7.0.0 #552
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: KICS Security Scan | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| logLevel: | |
| description: 'Log level' | |
| required: true | |
| default: 'warning' | |
| type: choice | |
| options: | |
| - info | |
| - warning | |
| - debug | |
| pull_request: | |
| types: [labeled] | |
| push: | |
| branches: | |
| - 'main' | |
| merge_group: | |
| schedule: | |
| - cron: '15 6 * * 4' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'pull_request' && github.event.label.name != 'ci:run' && github.run_id || 'ci' }} | |
| cancel-in-progress: true | |
| jobs: | |
| kics: | |
| if: ${{ github.event_name != 'pull_request' || github.event.label.name == 'ci:run' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Create results directory | |
| run: mkdir -p results-dir | |
| - name: Run KICS scan | |
| run: | | |
| docker run --rm \ | |
| -v "${{ github.workspace }}:/path" \ | |
| -v "${{ github.workspace }}/results-dir:/results" \ | |
| checkmarx/kics:latest scan \ | |
| --path /path \ | |
| --output-path /results \ | |
| --report-formats json,sarif \ | |
| --ignore-on-exit results | |
| # Workaround for Checkmarx/kics#7588: repeated CWE findings cause KICS | |
| # to emit duplicate entries in runs[].taxonomies[].taxa, which the SARIF | |
| # schema (uniqueItems: true) rejects, blocking the upload step. | |
| - name: Deduplicate SARIF taxa | |
| run: | | |
| jq '.runs |= map(.taxonomies |= (. // [] | map(.taxa |= (. // [] | unique_by(.id)))))' \ | |
| results-dir/results.sarif > results-dir/results.dedup.sarif | |
| mv results-dir/results.dedup.sarif results-dir/results.sarif | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@af56b044b5d41c317aef5d19920b3183cb4fbbec # v3 | |
| with: | |
| sarif_file: results-dir/results.sarif |