chore: Update README.rst #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Organisation ruleset: Python CI" | |
| on: | |
| push: | |
| branches-ignore: | |
| - main | |
| paths: | |
| - .github/workflows/org.python-ci.yml | |
| pull_request: | |
| types: [opened, edited, reopened, synchronize] | |
| branches: [main, master, dev] | |
| jobs: | |
| security-scan: | |
| # Bandit has its own GitHub Action; however, it always installs the latest version and does not allow version pinning. | |
| env: | |
| python-version: "3.13.9" | |
| bandit-version: "1.9.1" | |
| results-file: "results.sarif" | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| ############# Bandit ################## | |
| # TODO: Create an ad-hoc DBT Bandit Action | |
| - name: Set up Python | |
| uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 | |
| with: | |
| python-version: ${{env.python-version}} | |
| - name: Install Bandit | |
| shell: bash | |
| run: pip install 'bandit[sarif,toml]==${{env.bandit-version}}' | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Run Bandit | |
| shell: bash | |
| run: | | |
| bandit -r . --confidence-level=high --severity-level=high -f sarif -o ${{env.results-file}} -x './.venv,./tests,./test' || true | |
| - name: Check for any failures | |
| id: check-failures | |
| shell: bash | |
| run: | | |
| has_errors=$( jq '.runs[0].results != []' ${{env.results-file}}) | |
| echo "Check failure result: $has_errors" | |
| echo "has_errors=$has_errors" >> $GITHUB_OUTPUT | |
| - name: Upload SARIF file | |
| if: ${{steps.check-failures.outputs.has_errors == 'true'}} | |
| uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 | |
| with: | |
| sarif_file: ${{env.results-file}} | |
| dependency-review: | |
| permissions: | |
| pull-requests: write | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: "Checkout Repository" | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: "Dependency Review" | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 | |
| with: | |
| comment-summary-in-pr: always | |
| warn-only: true | |
| license-check: false |