kics.yml

# Copyright © TUM AET 2025 - 2025
#
# Licensed under the MIT License
#
# Authors: Benedikt Hofmann, Patrick Stoeckle, and other contributors
#
# SPDX-FileCopyrightText: 2025 TUM AET
#
# SPDX-License-Identifier: MIT

name: security linting using kics

on:
  workflow_call:

jobs:
  kics:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Lint Everything
        uses: checkmarx/kics-github-action@c06a133a98c75c2f920014d688015a5fb18095a4
        id: kics-action-scan
        with:
          path: ${{ github.workspace }}
          fail_on: critical,high,medium
          output_path: ${{ github.workspace }}
          token: ${{ github.token }}
          enable_comments: true
          output_formats: "sarif"
        continue-on-error: true

      - name: Upload SARIF report files to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

      # Ensure the workflow eventually fails if files did not pass the checks.
      - name: Verify kics succeeded
        shell: bash
        run: |
          echo "If this step fails, kics found issues. Check the output of the scan step above."
          [[ "${{ steps.kics-action-scan.outcome }}" == "success" ]]