security-sast-python.yml

name: Python SAST (Bandit)

on:
  workflow_call:
    inputs:
      exclude_dirs:
        description: 'Comma-separated directories to exclude'
        type: string
        default: 'tests,test,venv,.venv'
      skip_tests:
        description: 'Comma-separated Bandit test IDs to skip (e.g., B101,B601)'
        type: string
        default: ''
      severity_threshold:
        description: 'Minimum severity to report (low, medium, high)'
        type: string
        default: 'low'
    outputs:
      findings:
        description: 'Total Bandit findings'
        value: ${{ jobs.bandit.outputs.findings }}
      high:
        description: 'HIGH severity findings'
        value: ${{ jobs.bandit.outputs.high }}
      medium:
        description: 'MEDIUM severity findings'
        value: ${{ jobs.bandit.outputs.medium }}
      low:
        description: 'LOW severity findings'
        value: ${{ jobs.bandit.outputs.low }}

jobs:
  bandit:
    name: Bandit Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    outputs:
      findings: ${{ steps.scan.outputs.findings }}
      high: ${{ steps.scan.outputs.high }}
      medium: ${{ steps.scan.outputs.medium }}
      low: ${{ steps.scan.outputs.low }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: '3.x'

      - name: Install Bandit
        run: pip install bandit bandit-sarif-formatter

      - name: Run Bandit
        id: scan
        env:
          EXCLUDE_DIRS_INPUT: ${{ inputs.exclude_dirs }}
          SKIP_TESTS_INPUT: ${{ inputs.skip_tests }}
          SEVERITY_INPUT: ${{ inputs.severity_threshold }}
        run: |
          echo "::group::Bandit Security Scan"

          # Build exclude argument
          EXCLUDE_ARG=""
          if [ -n "$EXCLUDE_DIRS_INPUT" ]; then
            EXCLUDE_ARG="--exclude $EXCLUDE_DIRS_INPUT"
          fi

          # Build skip tests argument
          SKIP_ARG=""
          if [ -n "$SKIP_TESTS_INPUT" ]; then
            SKIP_ARG="--skip $SKIP_TESTS_INPUT"
          fi

          # Severity filter
          SEVERITY_ARG=""
          case "$SEVERITY_INPUT" in
            high)   SEVERITY_ARG="-lll" ;;
            medium) SEVERITY_ARG="-ll" ;;
            low)    SEVERITY_ARG="-l" ;;
          esac

          # Run Bandit with JSON output
          bandit -r . -f json -o bandit.json \
            $EXCLUDE_ARG $SKIP_ARG $SEVERITY_ARG \
            --confidence-level medium \
            || true

          # Run Bandit with SARIF output
          bandit -r . -f sarif -o bandit.sarif \
            $EXCLUDE_ARG $SKIP_ARG $SEVERITY_ARG \
            --confidence-level medium \
            || true

          # Parse results
          if [ -f bandit.json ]; then
            FINDINGS=$(jq '.results | length' bandit.json 2>/dev/null || echo "0")
            HIGH=$(jq '[.results[]? | select(.issue_severity == "HIGH")] | length' bandit.json 2>/dev/null || echo "0")
            MEDIUM=$(jq '[.results[]? | select(.issue_severity == "MEDIUM")] | length' bandit.json 2>/dev/null || echo "0")
            LOW=$(jq '[.results[]? | select(.issue_severity == "LOW")] | length' bandit.json 2>/dev/null || echo "0")

            echo "findings=$FINDINGS" >> $GITHUB_OUTPUT
            echo "high=$HIGH" >> $GITHUB_OUTPUT
            echo "medium=$MEDIUM" >> $GITHUB_OUTPUT
            echo "low=$LOW" >> $GITHUB_OUTPUT

            # Warnings for severity levels
            if [ "$HIGH" -gt 0 ]; then
              echo "::error::$HIGH HIGH severity Bandit finding(s)"
            fi
            if [ "$MEDIUM" -gt 0 ]; then
              echo "::warning::$MEDIUM MEDIUM severity Bandit finding(s)"
            fi
          else
            echo "findings=0" >> $GITHUB_OUTPUT
            echo "high=0" >> $GITHUB_OUTPUT
            echo "medium=0" >> $GITHUB_OUTPUT
            echo "low=0" >> $GITHUB_OUTPUT
          fi

          echo "::endgroup::"

          # Write summary
          echo "### Bandit Results" >> $GITHUB_STEP_SUMMARY
          echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| HIGH | $HIGH |" >> $GITHUB_STEP_SUMMARY
          echo "| MEDIUM | $MEDIUM |" >> $GITHUB_STEP_SUMMARY
          echo "| LOW | $LOW |" >> $GITHUB_STEP_SUMMARY
          echo "| **Total** | **$FINDINGS** |" >> $GITHUB_STEP_SUMMARY

      - name: Upload SARIF
        if: hashFiles('bandit.sarif') != ''
        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4
        with:
          sarif_file: bandit.sarif
          category: bandit
        continue-on-error: true

      - name: Upload artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: bandit-results
          path: |
            bandit.json
            bandit.sarif
          retention-days: 30
          if-no-files-found: ignore