Bandit Python Security Scanner

Bandit Python Security Scanner - Reusable Workflow

Runs the Bandit scanner via the argus Python CLI. Equivalent to: python -m argus scan bandit

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/sast-only.yml

uses: huntridge-labs/argus/.github/workflows/scanner-bandit.yml@1.12.2

Triggers

• Manual dispatch
• Reusable (called by other workflows)

Permissions

Scope	Access
contents	read
security-events	write
actions	read
pull-requests	write

Inputs

Input	Description	Required	Default
allow_failure	When true (default) the scan never fails the job (non-blocking); when false, a scan crash or a fail_on_severity breac... boolean	No	True
post_pr_comment	Whether to post PR comments boolean	No	True
enable_code_security	Whether GitHub Code Security is enabled for this repository boolean	No	False
fail_on_severity	Fail the job if any issue is found. Bandit does not support severity-based filtering - any value other than "none" wi... string	No	none
python_version	Python version to use string	No	3.12

Bandit Options

Input	Description	Required	Default
bandit_config_file	Path to Bandit configuration file (e.g. pyproject.toml, .bandit). Passed as bandit -c flag. string	No	—

Jobs

bandit-analysis — Bandit Python Security

Runs on: ubuntu-latest · Timeout: 15 minutes · Continue on error: Yes

Steps:

1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
2. Set up Python — actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
3. Install Argus — huntridge-labs/argus/.github/actions/setup-argus@1.12.2
4. Run scan
5. Upload artifacts — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
6. Build scanner summary
7. Upload scanner summary — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
8. Upload SARIF — github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
9. Comment PR with results — huntridge-labs/argus/.github/actions/comment-pr@1.12.2