feature/readd-bandit-scanner #9

	name: Bandit scanning

	on:
	pull_request:
	types: [opened, edited, reopened, synchronize]
	branches: [main, master, dev]

	jobs:
	security-vulnerability-scan:
	# Bandit has it's own github action, however it always installs the latest version and doesn't allow version pinning
	env:
	python-version: "3.13.9"
	bandit-version: "1.9.1"
	results-file: "results.sarif"
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	actions: read
	contents: read
	steps:
	- name: Set up Python
	uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c
	with:
	python-version: ${{env.python-version}}

	- name: Install Bandit
	shell: bash
	run: pip install 'bandit[sarif,toml]==${{env.bandit-version}}'

	- name: Checkout repository
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8

	- name: Run Bandit
	shell: bash
	run: \|
	bandit -r . --confidence-level=high --severity-level=medium -f sarif -o ${{env.results-file}} -x './.venv,./tests,./test' \|\| true

	- name: Check for any failures
	id: check-failures
	shell: bash
	run: \|
	has_errors=$( jq '.runs[0].results != []' ${{env.results-file}})
	echo "Check failure result: $has_errors"
	echo "has_errors=$has_errors" >> $GITHUB_OUTPUT

	- name: Upload SARIF file
	if: ${{steps.check-failures.outputs.has_errors == 'true'}}
	uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb
	with:
	sarif_file: ${{env.results-file}}

Provide feedback