From 1e3ae948a24dc1cd186aec26f90e9b86f3bdbbd1 Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Thu, 13 Feb 2025 11:25:03 +0000
Subject: [PATCH] feat: add static code analysis

---
 .github/workflows/bandit.yaml | 39 +++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/bandit.yaml

diff --git a/.github/workflows/bandit.yaml b/.github/workflows/bandit.yaml
new file mode 100644
index 00000000..201d5586
--- /dev/null
+++ b/.github/workflows/bandit.yaml
@@ -0,0 +1,39 @@
+name: Bandit Security Scan
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  bandit_scan:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install bandit  # Bandit is needed for this action
+          if [ -f application/requirements.txt ]; then pip install -r application/requirements.txt; fi
+
+      - name: Run Bandit scan
+        uses: PyCQA/bandit-action@v1
+        with:
+          severity: MEDIUM
+          confidence: MEDIUM
+          targets: application/
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file