Skip to content

Bandit Python Security Scanner

Bandit Python Security Scanner - Reusable Workflow

THIN WRAPPER: This workflow delegates to the scanner-bandit composite action. All scanning logic is in: .github/actions/scanner-bandit/action.yml

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/sast-only.yml

uses: huntridge-labs/argus/.github/workflows/scanner-bandit.yml@0.6.7

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
pull-requests write

Inputs

Input Description Required Default
post_pr_comment Whether to post PR comments boolean No True
enable_code_security Whether GitHub Code Security is enabled for this repository boolean No False
fail_on_severity Fail the job if any issue is found. Bandit does not support severity-based filtering - any value other than "none" wi... string No none
python_version Python version to use string No 3.12

Bandit Options

Input Description Required Default
bandit_config_file Path to Bandit configuration file (e.g. pyproject.toml, .bandit). Passed as bandit -c flag. string No —

Jobs

bandit-analysis — Bandit Python Security

Runs on: ubuntu-latest · Timeout: 15 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Run Bandit Scanner — huntridge-labs/argus/.github/actions/scanner-bandit@0.6.7

Actions used:

All Composite Actions Referenced