Eliminate redundant scan calls by passing analysis object downstream … #74

	name: Security

	on:
	push:
	branches: [master]
	pull_request:
	branches: [master]
	schedule:
	- cron: "0 6 * * 1"

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	cache: pip
	- name: Install
	run: pip install ruff
	- name: Lint
	run: ruff check quale/

	typecheck:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	cache: pip
	- name: Install
	run: pip install -e ".[dev]"
	- name: Type check
	run: mypy quale/ --ignore-missing-imports \|\| true

	bandit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	cache: pip
	- name: Install
	run: pip install bandit
	- name: Scan
	run: bandit -r quale/ -c bandit.yml -q

	semgrep:
	runs-on: ubuntu-latest
	container:
	image: returntocorp/semgrep
	steps:
	- uses: actions/checkout@v4
	- name: Scan
	run: semgrep --config=auto --error --exclude=tests/ quale/ \|\| true

	audit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"
	cache: pip
	- name: Install
	run: pip install -e . pip-audit
	- name: Audit dependencies
	run: pip-audit

Navigation Menu