{{- define "template.scan-kics" }}
- name: scan-kics
      container:
        image: checkmarx/kics:1.7.14
        command:
          - sh
          - -c
        args:
          - |
            set -eu
            mkdir -p /workspace/reports
            kics scan -p /workspace -o /workspace/reports --report-formats sarif,json --output-name kics || true
            if [ -f /workspace/reports/kics.sarif ]; then
              exit 0
            fi
            if [ -f /workspace/reports/kics.json ]; then
              cp /workspace/reports/kics.json /workspace/reports/kics.sarif
            fi
      volumeMounts:
        - name: workspace
          mountPath: /workspace
{{- end }}