bandit.yml

name: security checks
on:
  push:
    paths-ignore:
      - "README.md"
      - "docs/**"
      - "**/README.md"
  pull_request:
    paths-ignore:
      - "README.md"
      - "docs/**"
      - "**/README.md"
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      - uses: ./.github/actions/setup
      - name: Simple bandit security checks
        run: make security
      - name: Show Report in Action Output
        if: always()
        run: cat bandit-report.json
      - name: Upload Bandit Scan Artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # pin@v6.0.0
        if: always()
        with:
          name: bandit-findings
          path: bandit-report.json