|
1 | | -# This workflow uses actions that are not certified by GitHub. |
2 | | -# They are provided by a third-party and are governed by |
3 | | -# separate terms of service, privacy policy, and support |
4 | | -# documentation. |
5 | | - |
6 | | -# Bandit is a security linter designed to find common security issues in Python code. |
7 | | -# This action will run Bandit on your codebase. |
8 | | -# The results of the scan will be found under the Security tab of your repository. |
9 | | - |
10 | | -# https://github.com/marketplace/actions/bandit-scan is ISC licensed, by abirismyname |
11 | | -# https://pypi.org/project/bandit/ is Apache v2.0 licensed, by PyCQA |
12 | | - |
13 | | -name: Bandit |
| 1 | +# Static Application Security Testing |
| 2 | +name: sast |
14 | 3 | on: |
15 | 4 | workflow_dispatch: |
16 | 5 | push: |
17 | 6 | branches: ["master"] |
18 | 7 | pull_request: |
19 | | - # The branches below must be a subset of the branches above |
20 | 8 | branches: ["master"] |
21 | 9 | schedule: |
22 | | - - cron: "28 12 * * 2" |
23 | | - |
| 10 | + - cron: "00 00 * * 0" |
24 | 11 | jobs: |
25 | | - bandit: |
| 12 | + sast: |
26 | 13 | permissions: |
27 | 14 | contents: read # for actions/checkout to fetch code |
28 | 15 | security-events: write # for github/codeql-action/upload-sarif to upload SARIF results |
29 | 16 | actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status |
30 | | - |
31 | 17 | runs-on: ubuntu-latest |
32 | 18 | steps: |
33 | 19 | - uses: actions/checkout@v2 |
34 | | - - name: Bandit Scan |
35 | | - uses: shundor/python-bandit-scan@9cc5aa4a006482b8a7f91134412df6772dbda22c |
36 | | - with: # optional arguments |
| 20 | + - name: Bandit |
| 21 | + uses: mdegis/bandit-action@85fcc340c3b0bf5d86029abb49b9aac916d807b2 |
| 22 | + with: |
37 | 23 | # exit with 0, even with results found |
38 | | - exit_zero: true # optional, default is DEFAULT |
| 24 | + # exit_zero: true # optional, default is DEFAULT |
39 | 25 | # Github token of the repository (automatically created by Github) |
40 | 26 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information. |
41 | 27 | # File or directory to run bandit on |
42 | | - path: ./validators # optional, default is . |
| 28 | + path: ./src/validators # optional, default is . |
43 | 29 | # Report only issues of a given severity level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything) |
44 | 30 | # level: # optional, default is UNDEFINED |
45 | 31 | # Report only issues of a given confidence level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything) |
46 | 32 | # confidence: # optional, default is UNDEFINED |
47 | 33 | # comma-separated list of paths (glob patterns supported) to exclude from scan (note that these are in addition to the excluded paths provided in the config file) (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg) |
48 | | - excluded_paths: tests,docs,.github # optional, default is DEFAULT |
| 34 | + excluded_paths: .github,.pytest_cache,.venv,.vscode,site,tests # optional, default is DEFAULT |
49 | 35 | # comma-separated list of test IDs to skip |
50 | 36 | # skips: # optional, default is DEFAULT |
51 | 37 | # path to a .bandit file that supplies command line arguments |
52 | 38 | # ini_path: # optional, default is DEFAULT |
| 39 | +# https://github.com/marketplace/actions/bandit-scan is ISC licensed, by abirismyname |
| 40 | +# https://pypi.org/project/bandit/ is Apache v2.0 licensed, by PyCQA |
0 commit comments