LCORE-595: Fix bandit GH actions - use GH actions from PyQCA #453
Conversation
WalkthroughUpdated the Bandit GitHub Actions workflow: switched to PyCQA/bandit-action@v1, changed input from path to targets, removed exit_zero, and added permissions for security-events: write and actions: read. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub Actions
participant Job as bandit job
participant Act as PyCQA/bandit-action@v1
participant Sec as GitHub Security (SARIF)
Dev->>GH: Push/PR triggers workflow
GH->>Job: Start bandit job (with permissions)
Job->>Act: Run Bandit on targets="src"
Act->>Act: Scan code and produce report
Act-->>Sec: Upload SARIF (security-events: write)
Sec-->>Dev: Results visible in Security tab
note over Job,Act: exit_zero removed → non-zero exit on findings
note over Job: permissions added: actions: read, security-events: write
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (4)
.github/workflows/bandit.yaml (4)
12-12: Nit: actions: read is only needed for private repos.If this repository is public, you can drop
actions: readto minimize token scope; keep it if the repo is private.Rationale and examples are in the official docs and general GitHub Actions least-privilege guidance. (github.com, wellarchitected.github.com)
16-16: Pin the action to a stable release (or commit SHA) for supply-chain safety.Tag
@v1can drift. Prefer pinning to the latest stable release (e.g.,@v1.0.1as of Aug 1, 2025) or a full commit SHA.Apply this minimal change:
- - uses: PyCQA/bandit-action@v1 + - uses: PyCQA/bandit-action@v1.0.1Release reference: v1.0.1 noted in the repo’s Releases. (github.com)
18-18: targets input name is correct; verify the path and consider scanning the repo root.
targetsis the right input for PyCQA/bandit-action. ✔- Ensure the
srcdirectory exists in this repository; Bandit will error if the path is missing.- If code is spread across multiple dirs (e.g., also under
testsorscripts), consider scanning the repo root (".") or listing multiple targets.Two alternative tweaks:
Option A (scan whole repo):
- targets: "src" + targets: "."Option B (scan multiple top-level dirs):
- targets: "src" + targets: "src tests"Official inputs reference for
targets. (github.com, bandit.readthedocs.io)
18-18: Plan for failing builds now that exit_zero is gone.Dropping an “exit zero” behavior is good to enforce fixes, but it will fail builds if legacy Bandit findings exist. Consider one of:
- Set thresholds to reduce noise while still failing on meaningful issues:
severity: medium,confidence: medium.- Introduce a Bandit baseline (commit current findings), then fail only on regressions.
Here are minimal, optional inputs you can add under the same
with:block:targets: "src" + severity: "medium" + confidence: "medium" +# If needed: +# baseline: ".bandit-baseline.json"Inputs are supported by the official action. (github.com, bandit.readthedocs.io)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/bandit.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build-pr
- GitHub Check: e2e_tests
🔇 Additional comments (3)
.github/workflows/bandit.yaml (3)
11-11: Good: enabling SARIF upload with security-events: write.This permission is required for code scanning alerts to be uploaded. Matches the official Bandit action guidance.
See: PyCQA/bandit-action README and Bandit docs. (github.com, bandit.readthedocs.io)
16-16: Switch to the official PyCQA/bandit-action looks right.Using
PyCQA/bandit-action@v1aligns with upstream recommendations.Reference: official README/Marketplace. (github.com)
15-19: Sanity check: no explicit checkout step.The official example doesn’t show
actions/checkout, suggesting the action handles source retrieval internally. If you observe empty scans or unexpected “no files” behavior in CI, add an explicit checkout step before running Bandit.If needed, insert before the Bandit step:
steps: + - uses: actions/checkout@v4 - uses: PyCQA/bandit-action@v1 with: targets: "src"Official example (no checkout) and common practice references. (github.com)
|
/lgtm |
3 participants
Description
LCORE-595: Fix bandit GH actions - use GH actions from PyQCA
Type of change
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit