Skip to content

Commit ba51d0c

Browse files
Improved Usage Example (#6) Fixed deprecation issue, and added community features
> [!NOTE] > > Due to the backup, upstream with [actions/starter-workflows#2497](actions/starter-workflows#2497) not yet resolved, this PR will include at-least two minor version bumps: > > * [v2.2](637c5c4) @ [637c5c4](637c5c4) > * [v2.3](f8cf05e) @ [f8cf05e](f8cf05e) ---
2 parents ff1a646 + c56ff8d commit ba51d0c

File tree

2 files changed

+18
-6
lines changed

2 files changed

+18
-6
lines changed

README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,15 @@ Bandit is a tool designed to find common security issues in Python code. This ac
1111
To run a bandit scan include a step like this:
1212

1313
```yaml
14-
uses: reactive-firewall/python-bandit-scan@v2.1
14+
uses: reactive-firewall/python-bandit-scan@v2.3
1515
with: # optional arguments
1616
# Github token of the repository (automatically created by Github)
1717
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information.
1818
path: "."
19-
level: high
19+
level: low
2020
confidence: high
2121
# exit with 0, even with results found
22-
exit_zero: true # optional, default is DEFAULT
22+
# exit_zero: true # optional, default is DEFAULT
2323
```
2424

2525
## Inputs
@@ -71,5 +71,5 @@ The action will create an artifact containing the sarif output.
7171

7272
- :bow: This action is based on [bandit-action](https://github.com/mdegis/bandit-action) by [Melih Değiş](https://github.com/mdegis/).
7373
- :bow: This action is _also_ based on [python-bandit-scan](https://github.com/shundor/python-bandit-scan) by [shundor](https://github.com/shundor).
74-
- :bow: This fork includes fixes proposed by [Kenta Nakase](https://github.com/parroty) and [Thiago Grisolfi](https://github.com/Grisolfi) ... 🎉 but automated by @dependabot
74+
- :bow: This fork includes fixes proposed by [Kenta Nakase](https://github.com/parroty) and [Thiago Grisolfi](https://github.com/Grisolfi) and ["MrFired"](https://github.com/MrFired) ... 🎉 but automated by [@dependabot[bot]](https://github.com/apps/dependabot)
7575

action.yml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ inputs:
3232
description: 'path to a .bandit file that supplies command line arguments'
3333
required: false
3434
default: 'DEFAULT'
35+
config_path:
36+
description: 'path to a YAML or TOML file that supplies command line arguments'
37+
required: false
38+
default: 'DEFAULT'
3539
GITHUB_TOKEN:
3640
description: 'Github token of the repository (automatically created by Github)'
3741
required: true
@@ -102,21 +106,29 @@ runs:
102106
else
103107
INI_PATH="--ini $INPUT_INI_PATH"
104108
fi
105-
bandit -f sarif -o results.sarif -r $INPUT_PATH $LEVEL $CONFIDENCE $EXCLUDED_PATHS $EXIT_ZERO $SKIPS $INI_PATH
109+
110+
if [ "$INPUT_CONFIG_PATH" == "DEFAULT" ]; then
111+
CONFIG_PATH=""
112+
else
113+
CONFIG_PATH="-c $INPUT_CONFIG_PATH"
114+
fi
115+
bandit -f sarif -o results.sarif -r $INPUT_PATH $LEVEL $CONFIDENCE $EXCLUDED_PATHS $EXIT_ZERO $SKIPS $INI_PATH $CONFIG_PATH
106116
env:
107117
INPUT_PATH: ${{ inputs.path }}
108118
INPUT_LEVEL: ${{ inputs.level }}
109119
INPUT_CONFIDENCE: ${{ inputs.confidence }}
110120
INPUT_EXCLUDED_PATHS: ${{ inputs.excluded_paths }}
111121
INPUT_EXIT_ZERO: ${{ inputs.exit_zero }}
112122
INPUT_SKIPS: ${{ inputs.skips }}
113-
INPUT_INI_PATH: ${{ inputs.ini_path }}
123+
INPUT_INI_PATH: ${{ inputs.ini_path }}
124+
INPUT_CONFIG_PATH: ${{ inputs.config_path }}
114125

115126
- name: Upload artifact
116127
uses: actions/upload-artifact@v4
117128
with:
118129
name: results.sarif
119130
path: results.sarif
131+
overwrite: true
120132

121133
- name: Upload SARIF file
122134
uses: github/codeql-action/upload-sarif@v3

0 commit comments

Comments
 (0)