bandit.yml

# Static Application Security Testing
name: "Bandit"

on:
    workflow_dispatch:
    push:
        branches: master
        paths:
            - ".github/workflows/bandit.yml"
            - "**/*.py"
    pull_request:
        branches: master

jobs:
    sast-scan:
        if: |
            github.actor != 'dependabot[bot]' &&
            github.actor != 'github-actions[bot]' &&
            github.actor != 'protected-auto-commits[bot]'
        name: Bandit Scan
        concurrency: sast-scan
        runs-on: ubuntu-latest

        steps:
          - name: Checkout Code
            uses: actions/checkout@v4

          - name: Set up Python
            uses: actions/setup-python@v5
            with:
                python-version: "3.x"
                cache: "pip"

          - name: Install Bandit
            run: pip install bandit

          - name: Run Bandit Scan
            run: bandit -r . -f json -o bandit-report.json

          - name: Upload Bandit Scan Results
            if: always()
            uses: actions/upload-artifact@v4
            with:
                name: bandit-scan-results
                path: bandit-report.json