bandit.yml

name: security checks
on:
  push:
    paths-ignore:
      - "README.md"
      - "docs/**"
      - "**/README.md"
  pull_request:
    paths-ignore:
      - "README.md"
      - "docs/**"
      - "**/README.md"
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: ./.github/actions/setup
      - name: Simple bandit security checks
        run: make security
      - name: Show Report in Action Output
        if: always()
        run: cat bandit-report.json
      - name: Upload Bandit Scan Artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # pin@v7.0.1
        if: always()
        with:
          name: bandit-findings
          path: bandit-report.json