Add CodeQL and Bandit Static Analysis Scans

.github/workflows/bandit.yml

@@ -0,0 +1,19 @@
+name: "Static Analysis: Bandit Scan"
+
+on:
+ push:
+ branches:
+ - "pull-request/[0-9]+"
+ - "main"
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+ cancel-in-progress: true
+
+jobs:
+ analyze:
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ steps:
+ - name: Perform Bandit Analysis
+ uses: PyCQA/bandit-action@8a1b30610f61f3f792fe7556e888c9d7dffa52de # v1.0.0

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: "Static Analysis: CodeQL Scan"
+
+on:
+ push:
+ branches:
+ - "pull-request/[0-9]+"
+ - "main"
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+ cancel-in-progress: true
+
+jobs:
+ analyze:
+ name: Analyze (${{ matrix.language }})
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - language: python
+ build-mode: none
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v3
+ with:
+ languages: ${{ matrix.language }}
+ build-mode: ${{ matrix.build-mode }}
+ queries: security-extended
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v3
+ with:
+ category: "/language:${{matrix.language}}"

.pre-commit-config.yaml

@@ -6,16 +6,20 @@ ci:
  autoupdate_branch: ''
  autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
  autoupdate_schedule: quarterly
- skip: []
+ skip: [bandit]
  submodules: false
 
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
- rev: v0.11.4
+ rev: 971923581912ef60a6b70dbf0c3e9a39563c9d47 #v0.11.4
  hooks:
  - id: ruff
  args: [--fix, --show-fixes]
  - id: ruff-format
+ - repo: https://github.com/PyCQA/bandit
+ rev: 8ff25e07e487f143571cc305e56dd0253c60bc7b #v1.8.3
+ hooks:
+ - id: bandit
 
 default_language_version:
  python: python3