Merge pull request #245 from cisagov/bugfix/make-bandit-pre-commit-check-useful-again

Make the `bandit` `pre-commit` hook useful again

Author: jsf9k

.pre-commit-config.yaml

@@ -128,15 +128,27 @@ repos:
       - id: shellcheck
 
   # Python hooks
+  # Run bandit on the Molecule tests
   - repo: https://github.com/PyCQA/bandit
     rev: 1.9.1
     hooks:
       - id: bandit
-        # Bandit complains about the use of assert() in tests. This should cover
-        # the tests/ subdirectory for any molecule scenario.
-        exclude: molecule/[^/]+/tests
+        name: bandit (Molecule tests)
+        files: molecule/[^/]+/tests
         args:
-          - --config=.bandit.yml
+          # Skip "assert used" check since assertions are used
+          # frequently in pytests.
+          - --skip=B101
+  # Run bandit on everything except the Molecule tests
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.8.6
+    hooks:
+      - id: bandit
+        name: bandit (everything else)
+        # Bandit complains about the use of assert() in tests. This
+        # should cover the tests/ subdirectory for any molecule
+        # scenario.
+        exclude: molecule/[^/]+/tests
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 25.11.0
     hooks: