developmentseed/Python Security Auditing

Run bandit and pip-audit security scans on Python code and report findings

Trust Signals

name	description	required	default
tools	Comma-separated tools to run (bandit, pip-audit)	—	bandit,pip-audit
bandit_scan_dirs	Comma-separated directories for bandit to scan	—	.
bandit_severity_threshold	Minimum bandit severity that blocks the job (high, medium, low)	—	high
pip_audit_block_on	When to block on pip-audit findings — fixable, all, or none	—	fixable
package_manager	How to resolve dependencies for pip-audit (uv, pip, poetry, pipenv, requirements)	—	requirements
requirements_file	Path to requirements file when package_manager=requirements	—	requirements.txt
comment_on	When to post a PR comment — never, blocking (only when issues block the job), or always	—	never
github_token	GitHub token used for posting PR comments	—	${{ github.token }}
working_directory	Directory to run the audit from (useful when the project is in a subdirectory)	—	.
artifact_name	Name of the artifact uploaded by the action	—	security-audit-reports
debug	Enable debug logging for the Python audit module	—	false

no outputs