Merge pull request #233 from intel/dependabot/github_actions/actions/… #256

	name: Bandit Python Scans
	on:
	push:
	pull_request:
	schedule:
	# Tuesdays at 9AM PST. GitHub Actions run in UTC.
	- cron: '0 16 * * 2'

	# Read only default permissions.
	permissions: read-all

	jobs:
	bandit:
	runs-on: ubuntu-latest
	permissions:
	# Needed to upload the results to code-scanning dashboard.
	security-events: write

	steps:
	- name: "Checkout code"
	uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

	- name: Set up Python 3.x
	uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
	with:
	python-version: "3.x"

	- name: Install Python dependencies
	run: pip install -r requirements.txt

	- name: Run Bandit
	run: \|
	bandit -r -c .github/bandit.yml \
	-f sarif -o bandit_scan_results.sarif \
	scripts
	# Bandit will exit 1 if it detects issues. Our goal is to triage issues with the GitHub
	# code scanning dashboard. Always continue to the archive and dashboard upload steps.
	continue-on-error: true

	- name: Archive scan results
	uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
	with:
	name: bandit_scan_results
	path: bandit_scan_results.sarif
	retention-days: 10

	- name: Upload to code-scanning dashboard
	uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b # v3.26.13
	with:
	sarif_file: bandit_scan_results.sarif

Provide feedback