|
1 | 1 | # Static Application Security Testing |
2 | 2 | name: sast |
| 3 | + |
3 | 4 | on: |
4 | 5 | workflow_dispatch: |
5 | 6 | push: |
6 | 7 | branches: ["master"] |
7 | 8 | pull_request: |
8 | 9 | branches: ["master"] |
9 | | - schedule: |
10 | | - - cron: "00 00 * * 0" |
| 10 | + |
11 | 11 | jobs: |
12 | 12 | sast: |
13 | 13 | permissions: |
14 | | - contents: read # for actions/checkout to fetch code |
15 | | - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results |
16 | | - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status |
| 14 | + security-events: write |
17 | 15 | runs-on: ubuntu-latest |
18 | 16 | steps: |
19 | | - - uses: actions/checkout@v4 |
20 | 17 | - name: Bandit |
21 | | - uses: mdegis/bandit-action@85fcc340c3b0bf5d86029abb49b9aac916d807b2 |
| 18 | + uses: PyCQA/bandit-action@v1 |
22 | 19 | with: |
23 | | - # exit with 0, even with results found |
24 | | - # exit_zero: true # optional, default is DEFAULT |
25 | | - # Github token of the repository (automatically created by Github) |
26 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information. |
27 | | - # File or directory to run bandit on |
28 | | - path: ./src/validators # optional, default is . |
29 | | - # Report only issues of a given severity level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything) |
30 | | - # level: # optional, default is UNDEFINED |
31 | | - # Report only issues of a given confidence level or higher. Can be LOW, MEDIUM or HIGH. Default is UNDEFINED (everything) |
32 | | - # confidence: # optional, default is UNDEFINED |
33 | | - # comma-separated list of paths (glob patterns supported) to exclude from scan (note that these are in addition to the excluded paths provided in the config file) (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg) |
34 | | - excluded_paths: .github,.pytest_cache,.venv,.vscode,site,tests # optional, default is DEFAULT |
35 | | - # comma-separated list of test IDs to skip |
36 | | - # skips: # optional, default is DEFAULT |
37 | | - # path to a .bandit file that supplies command line arguments |
38 | | - # ini_path: # optional, default is DEFAULT |
39 | | -# https://github.com/marketplace/actions/bandit-scan is ISC licensed, by abirismyname |
40 | | -# https://pypi.org/project/bandit/ is Apache v2.0 licensed, by PyCQA |
| 20 | + targets: src/validators |
| 21 | + exclude: .github,.pytest_cache,.venv,.vscode,site,tests |
0 commit comments