feature/investigate-bandit #1

	name: Python CI

	on:
	pull_request:
	types: [opened, edited, reopened, synchronize]
	branches: [main, master, dev]
	workflow_dispatch:

	jobs:
	# Bandit has it's own github action, however it always installs the latest version and doesn't allow version pinning
	run-bandit:
	env:
	python-version: "3.13"
	bandit-version: "1.8.6"
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	actions: read
	contents: read
	steps:
	- name: Set up Python
	uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
	with:
	python-version: ${{env.python-version}}

	- name: Install Bandit
	shell: bash
	run: pip install 'bandit[sarif,toml]==${{env.bandit-version}}'

	- name: Checkout repository
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

	- name: Run Bandit
	shell: bash
	run: \|
	bandit -r . --severity-level=high -f sarif -o results.sarif -x '.svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg,.venv,tests'

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb
	with:
	sarif_file: results.sarif

Provide feedback