thadiust/Bandit SAST scan
Run Bandit static analysis on Python source
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| python_version | Python version to use | no | 3.11 |
| bandit_version | Exact bandit version to install | no | 1.9.4 |
| working_directory | Directory to run the scan from (repo root relative) | no | . |
| targets | Space-separated paths to scan (relative to working_directory), passed to bandit -r | no | . |
| bandit_config | Optional path to bandit config file (relative to working_directory) | no | "" |
| exclude | Optional comma-separated paths to exclude (Bandit --exclude) | no | "" |
| minimum_severity | Minimum issue severity to report (all, low, medium, high) | no | all |
| minimum_confidence | Minimum confidence to report (all, low, medium, high) | no | all |
| report_format | Human-readable report format when not using JSON-only output (txt, json, yaml, csv) | no | txt |
| report_file | Optional path to write the human-readable report (relative to working_directory) | no | "" |
| fail_on_findings | Fail the action when Bandit reports one or more findings | no | true |
| write_sarif | Write a SARIF report to sarif_filename (for GitHub Code Scanning upload; second Bandit pass) | no | false |
| sarif_filename | SARIF file path relative to working_directory (used when write_sarif is true) | no | bandit-results.sarif |
Outputs
| name | description |
|---|---|
| issue_count | Number of findings reported by Bandit |
| scan_status | Final scan status (clean, findings_found, scanner_error) |
| sarif_path | Repo-relative path to the SARIF report when write_sarif is true (empty otherwise) |