Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ci bandit #149

Merged
merged 3 commits into from
Mar 11, 2024
Merged

Add ci bandit #149

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1001e92
Merge pull request #148 from tattle-made/hotfix
dennyabrain Mar 11, 2024
5ecd5da
ci: Added bandit SAST scanning
duggalsu Mar 11, 2024
4802bea
ci: Disabled bandit level
duggalsu Mar 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/pr-security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,3 +85,21 @@ jobs:
if: always()
with:
sarif_file: 'trivy-results.sarif'

- name: Bandit Scan
uses: shundor/python-bandit-scan@9cc5aa4a006482b8a7f91134412df6772dbda22c
with: # optional arguments
# exit with 0, even with results found
exit_zero: false # optional, default is DEFAULT
# File or directory to run bandit on
path: ./src/ # optional, default is .
# Report only issues of a given severity level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything)
# level: HIGH # optional, default is UNDEFINED
# Report only issues of a given confidence level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything)
# confidence: # optional, default is UNDEFINED
# comma-separated list of paths (glob patterns supported) to exclude from scan (note that these are in addition to the excluded paths provided in the config file) (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)
# excluded_paths: # optional, default is DEFAULT
# comma-separated list of test IDs to skip
# skips: # optional, default is DEFAULT
# path to a .bandit file that supplies command line arguments
# ini_path: # optional, default is DEFAULT
Loading