Skip to content

Merge pull request #317 from eclipse-tractusx/release/v3.0.0-update-h… #866

Merge pull request #317 from eclipse-tractusx/release/v3.0.0-update-h…

Merge pull request #317 from eclipse-tractusx/release/v3.0.0-update-h… #866

Workflow file for this run

#################################################################################
# Tractus-X - Digital Product Passport Application
#
# Copyright (c) 2022, 2024 BMW AG, Henkel AG & Co. KGaA
# Copyright (c) 2023, 2024 CGI Deutschland B.V. & Co. KG
# Copyright (c) 2022, 2024 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
# either express or implied. See the
# License for the specific language govern in permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
#################################################################################
name: "KICS"
on:
push:
branches: [ main ]
paths-ignore:
- '**/*.md'
- '**/*.txt'
pull_request:
branches: [ main ]
paths-ignore:
- "**/*.md"
- "**/*.txt"
schedule:
- cron: "0 0 * * *" # Once a day
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- name: KICS scan
uses: checkmarx/kics-github-action@master
with:
# Scanning directory .
path: "."
# Fail on HIGH severity results
fail_on: high
# Disable secrets detection - we use GitGuardian
disable_secrets: true
# when provided with a directory on output_path
# it will generate the specified reports file named 'results.{extension}'
# in this example it will generate:
# - results-dir/results.json
# - results-dir/results.sarif
output_path: kicsResults/
output_formats: "json,sarif"
# If you want KICS to ignore the results and return exit status code 0 unless a KICS engine error happens
# ignore_on_exit: results
# GITHUB_TOKEN enables this github action to access github API and post comments in a pull request
# token: ${{ secrets.GITHUB_TOKEN }}
# enable_comments: true
# Upload findings to GitHub Advanced Security Dashboard
- name: Upload SARIF file for GitHub Advanced Security Dashboard
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: kicsResults/results.sarif
- name: Archive results
uses: actions/upload-artifact@v4
if: always()
with:
name: kicsResults.json
path: kicsResults/results.json