Run CI when a draft PR is marked ready for review #626

	---
	name: KICS Security Scan
	on:
	workflow_dispatch:
	inputs:
	logLevel:
	description: 'Log level'
	required: true
	default: 'warning'
	type: choice
	options:
	- info
	- warning
	- debug
	pull_request:
	types: [opened, synchronize, reopened, ready_for_review]

	# Cancel outdated pipeline runs when a new push occurs in the pull request and a new pipeline starts.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	security_scan:
	# For non-PR events (workflow_dispatch, schedule, etc.), github.event.pull_request.draft is null.
	# GitHub Actions coerces null == false to true (null → 0, false → 0), so the job runs for all non-draft events.
	if: github.event.pull_request.draft == false
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v7
	- name: Mkdir results-dir
	# make sure results dir is created
	run: mkdir -p results-dir
	- name: run kics Scan
	uses: Checkmarx/kics-github-action@bcd2aff52160bfe5a72608452d00326e90da7a9a # v2.1.19
	with:
	# path: 'roles,plugins'
	path: '.'
	# fail_on: high
	ignore_on_exit: results
	output_formats: 'json,sarif'
	output_path: results-dir
	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@af56b044b5d41c317aef5d19920b3183cb4fbbec # v3
	with:
	sarif_file: results-dir/results.sarif

Provide feedback