bandit-scan.yml

# This is a basic workflow to help you get started with Actions

name: Bandit Source code analysis

# Controls when the action will run. Triggers the workflow on push or pull request
# events but only for the master branch
on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v2
    
    - name: Python security check using Bandit
      uses: willy00/bandit-report-artifacts@v1.3
      with:
        # Version range or exact version of a Python version to use, using SemVer's version range syntax.
        python_version: 3.7
        ignore_failure: true
        project_path: 'cybernetic'
        
    - name: Add & Commit
      uses: EndBug/add-and-commit@v4.2.1
      with:
        # Arguments for the git add command
        add: reports/bandit-report.html
        # The message for the commit
        message: "Bandit Security Report generated"