Repository: Checkmarx/kics (language: python)

Issue:
bug(githubactions): github actions relative path detected as not pinned
### Expected Behavior

KICS should not detect rule "Unpinned Actions Full Length Commit SHA" when a relative path is used in the `uses` field in a Github Actions workflow.

### Actual Behavior

The "Action is not pinned to a full length commit SHA." rule (555ab8f9-2001-455e-a077-f2d0f41e2fb9) shows as failed for action at step `relative-path`, which has a relative path in the same repository.

### Steps to Reproduce the Problem

1.  Create a minimal github action (`.github/workflows/sample.yml`):
```
name: Sample
on:
  workflow_call:
permissions: read-all
jobs:
  sample:
    name: Sample
    runs-on: ubuntu-latest
    steps:
      - name: Relative path action
        id: relative-path
        uses: ./any-action
```
2.  Run KICS `docker run -t -v $(pwd)/.github:/path checkmarx/kics:latest scan -p /path -o "/path/" --report-formats "json,sarif,html"`
3.  Look at the findings, a finding is listed as described above

### Specifications
(N/A if not applicable)

-   Version: [v1.7.13](https://github.com/Checkmarx/kics/releases/tag/v1.7.13), through the `latest` tag in Docker
-   Platform: macOS 13.6 (22G120)
-   Subsystem: N/A



Discussion / hints:

Fix patch:
diff --git a/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/query.rego b/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/query.rego
index 32421fa9cf5..baacd90083f 100644
--- a/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/query.rego
+++ b/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/query.rego
@@ -7,6 +7,7 @@ CxPolicy[result] {
 	uses := input.document[i].jobs[j].steps[k].uses
 	not isAllowed(uses)
 	not isPinned(uses)
+	not isRelative(uses)
 	
 	result := {
 		"documentId": input.document[i].id,
@@ -28,3 +29,8 @@ isPinned(use){
 	regex.match("@[a-f0-9]{40}$", use)
 }
 
+isRelative(use){
+	allowed := ["./"]
+    startswith(use,allowed[i])
+}
+
diff --git a/docs/queries/cicd-queries/555ab8f9-2001-455e-a077-f2d0f41e2fb9.md b/docs/queries/cicd-queries/555ab8f9-2001-455e-a077-f2d0f41e2fb9.md
index 3f826ceca15..0e4cd13cfdf 100644
--- a/docs/queries/cicd-queries/555ab8f9-2001-455e-a077-f2d0f41e2fb9.md
+++ b/docs/queries/cicd-queries/555ab8f9-2001-455e-a077-f2d0f41e2fb9.md
@@ -83,4 +83,4 @@ jobs:
       with:
         persist-credentials: false
 
-```
+```
\ No newline at end of file


Test patch:
diff --git a/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/test/negative3.yaml b/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/test/negative3.yaml
new file mode 100644
index 00000000000..8d866b9af4e
--- /dev/null
+++ b/assets/queries/cicd/github/unpinned_actions_full_length_commit_sha/test/negative3.yaml
@@ -0,0 +1,12 @@
+name: test-negative3
+on:
+  pull_request:
+    types: [opened, synchronize, edited, reopened]
+    branches:
+      - master
+jobs:
+  test-negative3:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Local action
+      uses: ./test.yml