bandit.yml

# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "Static Analysis: Bandit Scan"

on:
  push:
    branches:
      - "pull-request/[0-9]+"
      - "ctk-next"
      - "main"
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install uv
        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
        with:
          enable-cache: false

      - name: Get ignore codes
        id: ignore-codes
        # This are computed so that we can run only the `S` (bandit)
        # checks. Passing --select to ruff overrides any config files
        # (ruff.toml, pyproject.toml, etc), so to avoid having keep everything
        # in sync we grab them from the TOML programmatically
        run: |
          set -euxo pipefail

          echo "codes=$(uvx toml2json ./ruff.toml | jq -r '.lint.ignore | map(select(test("^S\\d+"))) | join(",")')" >> "$GITHUB_OUTPUT"
      - name: Perform Bandit Analysis using Ruff
        uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89  # v4.1.0
        with:
          args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif"
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
        with:
          sarif_file: results.sarif