Fix ci

Author: anhthii

.github/workflows/ci.yml

@@ -64,6 +64,10 @@ jobs:
   security-scan:
     runs-on: ubuntu-latest
     name: Security Vulnerability Scan
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     steps:
       - name: Checkout code
@@ -94,16 +98,19 @@ jobs:
         run: govulncheck ./...
 
       - name: Install gosec
-        run: go install github.com/securecodewarrior/gosec/v2/cmd/gosec@latest
+        run: go install github.com/securego/gosec/v2/cmd/gosec@latest
 
       - name: Run gosec security scanner
-        run: gosec -fmt sarif -out gosec-results.sarif ./...
+        run: |
+          gosec -fmt sarif -out gosec-results.sarif ./...
+        continue-on-error: true
 
       - name: Upload gosec results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: gosec-results.sarif
+          category: gosec
 
   # CodeQL Analysis
   codeql-analysis:
@@ -124,7 +131,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
@@ -153,14 +160,18 @@ jobs:
           go build -v ./cmd/mpcium-cli
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{matrix.language}}"
 
   # SBOM Generation
   sbom:
     runs-on: ubuntu-latest
     name: Generate SBOM
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     steps:
       - name: Checkout code
@@ -222,12 +233,14 @@ jobs:
           fail-build: false
           output-format: sarif
           output-file: grype-results.sarif
+        continue-on-error: true
 
       - name: Upload Grype results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: grype-results.sarif
+          category: grype
 
       - name: Display SBOM summary
         run: |