LCORE-595: Fix bandit GH actions - use GH actions from PyQCA#38
LCORE-595: Fix bandit GH actions - use GH actions from PyQCA#38tisnik merged 1 commit intolightspeed-core:mainfrom
Conversation
WalkthroughUpdates the Bandit GitHub Actions workflow: switches action to PyCQA/bandit-action@v1, changes input key from path to targets, removes exit_zero, and adds permissions for security-events: write and actions: read. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as GitHub Actions Runner
participant Bandit as PyCQA/bandit-action@v1
participant GHAct as GitHub Actions API (read)
participant Sec as GitHub Code Scanning (security-events:write)
Dev->>Bandit: Run bandit with targets="src"
Bandit->>GHAct: Read workflow/context (actions:read)
Bandit->>Bandit: Analyze source and produce SARIF
Bandit->>Sec: Upload SARIF (security-events:write)
Note over Sec,Dev: Results available in Code Scanning alerts
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/bandit.yaml (1)
15-19: Bandit likely runs against an empty workspace — missing actions/checkout and no SARIF upload.Without checking out the repo, the action won’t see your source. Also, you granted security-events: write but don’t upload SARIF to Code Scanning. Add checkout and an upload-sarif step, and configure Bandit to emit SARIF.
Apply this diff:
steps: - - uses: PyCQA/bandit-action@v1 - with: - targets: "src" + - uses: actions/checkout@v4 + - name: Run Bandit and generate SARIF + uses: PyCQA/bandit-action@v1 + with: + targets: "src" + options: "-f sarif -o bandit.sarif -q" + - name: Upload Bandit SARIF to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: bandit.sarifNotes:
- options passes through to Bandit CLI. If you prefer action-native inputs (format/output) and they’re supported by your pinned version, switch to those instead.
- Remove -q if you want console logs in CI.
🧹 Nitpick comments (3)
.github/workflows/bandit.yaml (3)
11-12: Permissions look good only if you upload SARIF; otherwise drop security-events: write.Principle of least privilege: keep security-events: write only when an upload step is present.
If you decide not to upload SARIF, trim the permission:
permissions: - security-events: write - actions: read + actions: read contents: read pull-requests: read
16-16: Pin the action to a commit SHA for supply‑chain safety.Tags like @v1 can be retagged. Pin to a specific commit and update on a schedule.
Apply this diff (replace with the latest for v1):
- - uses: PyCQA/bandit-action@v1 + - uses: PyCQA/bandit-action@<commit-sha> + # TODO: periodically refresh the pinned SHATo find the current commit for v1, check the action’s releases/tags and resolve to a commit.
16-18: Pipeline will now fail on Bandit findings — confirm this is intentional and set severity threshold if needed.You removed exit_zero behavior. If you want to fail only on high-severity issues, pass a stricter level to Bandit.
Minimal tweak:
- options: "-f sarif -o bandit.sarif -q" + options: "-lll -f sarif -o bandit.sarif -q"-lll reports only High severity with High confidence; adjust per your policy.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/bandit.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build-and-push-dev
- GitHub Check: Pylinter
🔇 Additional comments (1)
.github/workflows/bandit.yaml (1)
18-18: Bandit scan target path verified
- The
srcdirectory exists at the repository root.- It contains 8 Python files, so
targets: "src"is correctly configured.No further changes are needed.
3 participants
Description
LCORE-595: Fix bandit GH actions - use GH actions from PyQCA
Type of change
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit