bandit.yml

# Copyright 2024-2025, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: Scan Python code with Bandit

on:
  workflow_dispatch:
  push:
  pull_request:
    paths:
      - '**/*.py'
      - '.github/workflows/bandit.*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  bandit:
    name: Bandit
    runs-on: ubuntu-latest

    steps:
      - name: Clone the git repo
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Install Bandit
        run: sudo apt-get update && sudo apt-get install python3-bandit

      - name: Run Bandit
        run: |
          bandit -c .github/workflows/bandit.config -r . -f txt -o bandit_output.txt

      - name: Upload Bandit text report as artifact
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        if: always()
        with:
          name: bandit-report
          path: bandit_output.txt