bug(githubactions): github actions relative path detected as not pinned

[cw-alexcroteau]

Expected Behavior

KICS should not detect rule "Unpinned Actions Full Length Commit SHA" when a relative path is used in the uses field in a Github Actions workflow.

Actual Behavior

The "Action is not pinned to a full length commit SHA." rule (555ab8f9-2001-455e-a077-f2d0f41e2fb9) shows as failed for action at step relative-path, which has a relative path in the same repository.

Steps to Reproduce the Problem

1. Create a minimal github action (.github/workflows/sample.yml):

name: Sample
on:
  workflow_call:
permissions: read-all
jobs:
  sample:
    name: Sample
    runs-on: ubuntu-latest
    steps:
      - name: Relative path action
        id: relative-path
        uses: ./any-action

2. Run KICS docker run -t -v $(pwd)/.github:/path checkmarx/kics:latest scan -p /path -o "/path/" --report-formats "json,sarif,html"
3. Look at the findings, a finding is listed as described above

Specifications

(N/A if not applicable)

• Version: v1.7.13, through the latest tag in Docker
• Platform: macOS 13.6 (22G120)
• Subsystem: N/A

[JoaoAtGit]

Hi @cw-alexcroteau

How are you?
Thanks for your contribution.
Just request for our AppSec to review the issue.

Br,
João Martins
[ APPSEC-2397 ]