fix: add working directory

[lhoupert]

This pull request improves how the bandit_scan_dirs input is handled in the action, making directory scanning more robust and clarifying documentation. The main changes are focused on ensuring that directories specified for Bandit scans are correctly resolved relative to the working_directory, both in the action logic and in the documentation.

Improvements to Bandit scan directory handling:

• Added a new step in action.yml to resolve the bandit_scan_dirs input relative to the working_directory, ensuring Bandit scans the correct directories regardless of where the workflow is run. (action.yml)
• Updated the Bandit step to use the resolved directory list from the new step, instead of passing the raw input. (action.yml)

Documentation updates:

• Clarified in the README.md that bandit_scan_dirs is relative to working_directory in the input table. (README.md)
• Updated the Bandit example in the README.md to use a directory path relative to the working directory for consistency. (README.md)

[github-actions]

Security Audit Report

View workflow run

Bandit — Static Security Analysis (Security tab)

✅ No issues found.

pip-audit — Dependency Vulnerabilities (Security tab)

Package	Version	ID	Fix Versions	Description
pygments	2.19.2	CVE-2026-4539	none	A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file

1 vulnerability/vulnerabilities found (0 fixable) across 1 package(s).

---

Result: ✅ No blocking issues found.