# Copyright 2024-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: Scan Python code with Bandit

on:
  workflow_dispatch:
  push:
  pull_request:
    paths:
      - '**/*.py'
      - '.github/workflows/bandit.*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  bandit:
    name: Bandit
    runs-on: ubuntu-latest

    steps:
      - name: Clone the git repo
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

      - name: Install Bandit
        run: sudo apt-get update && sudo apt-get install python3-bandit

      - name: Run Bandit
        run: |
          bandit -c .github/workflows/bandit.config -r . -f txt -o bandit_output.txt

      - name: Upload Bandit text report as artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: always()
        with:
          name: bandit-report
          path: bandit_output.txt