Checkov Scan #12

	---
	name: Checkov Scan

	on:
	# Allows this workflow to be run manually from the Actions tab in GitHub.
	workflow_dispatch:

	# Runs the workflow on a schedule, every 12 hours.
	schedule:
	- cron: "33 /12 * *"

	jobs:
	scan:
	name: Checkov Scan
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- name: Clone repo
	uses: actions/checkout@v4

	- name: Checkov Scan
	uses: bridgecrewio/checkov-action@v12
	with:
	# This will add both a CLI output to the console and create a results.sarif file
	output_format: cli,sarif
	output_file_path: console,results.sarif

	# Ensures that the scan will continue even if there are errors
	soft_fail: true

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v3
	# Results are generated only on a success or failure
	# this is required since GitHub by default won't run the next step
	# when the previous one has failed. Security checks that do not pass will 'fail'.
	# An alternative is to add `continue-on-error: true` to the previous step
	# Or 'soft_fail: true' to checkov.
	if: success() \|\| failure()
	with:
	sarif_file: results.sarif

Provide feedback