From c5150a28478dcd73a05dec0192befc3d4bf9c0bc Mon Sep 17 00:00:00 2001 From: "Mr. Walls" Date: Thu, 10 Apr 2025 21:53:56 -0700 Subject: [PATCH 1/4] Prepare to merge with upstream fork from shundor/bandit-scan#2 --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 3c2edb9..ea32979 100644 --- a/README.md +++ b/README.md @@ -12,11 +12,11 @@ To run a bandit scan include a step like this: ```yaml uses: shundor/bandit-action@v1 - with: + with: path: "." level: high confidence: high - exit_zero: true + exit_zero: true ``` ## Inputs @@ -66,4 +66,5 @@ The action will create an artifact containing the sarif output. ## Credits -- :bow: This action is based on [bandit-action](https://github.com/mdegis/bandit-action) by [Melih Değiş](https://github.com/mdegis/). \ No newline at end of file +- :bow: This action is based on [bandit-action](https://github.com/mdegis/bandit-action) by [Melih Değiş](https://github.com/mdegis/). +- :bow: This action also includes fixes proposed by [Kenta Nakase](https://github.com/parroty) and [Thiago Grisolfi](https://github.com/Grisolfi) and ["MrFired"](https://github.com/MrFired) ... 🎉 but automated by [@dependabot[bot]](https://github.com/apps/dependabot) From ad6fae3ac4fbb0afe7d4452ad933c3b86985b01e Mon Sep 17 00:00:00 2001 From: "Mr. Walls" Date: Thu, 10 Apr 2025 22:11:27 -0700 Subject: [PATCH 2/4] Backport of dependency automation from reactive-firewall/python-bandit-scan for use by shundor/python-bandit-scan --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7334f73..d95fe56 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ Bandit is a tool designed to find common security issues in Python code. This ac To run a bandit scan include a step like this: ```yaml - uses: shundor/bandit-action@v1 + uses: shundor/python-bandit-scan@v1 with: # optional arguments path: "." level: high From 11a72c7c18aab77758bf6f5d9456f1018ec107b0 Mon Sep 17 00:00:00 2001 From: "Mr. Walls" Date: Fri, 11 Apr 2025 16:52:16 -0700 Subject: [PATCH 3/4] [REVIEW] Simpler defaults for backported dependabot.yml * Oops! :hear_not_evil: The labels must already be present in the github project settings. (FIXED) * I also don't have write-access so I removed myself from the default assignee; this simplifies the configuration. These are not user-facing changes. --- .github/dependabot.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 926b470..cbcdbba 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,10 +11,7 @@ updates: rebase-strategy: "disabled" # Labels on pull requests for version updates only labels: - - "GitHub" - - "Testing" - assignees: - - "reactive-firewall" + - "enhancement" # choosen as closest exsisting label commit-message: prefix: "[UPDATE] " include: "scope" From 945f6f65922a079a92d1378c7828c9f731cfdcc8 Mon Sep 17 00:00:00 2001 From: Abir Majumdar <83433840+abirismyname@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:19:46 -0400 Subject: [PATCH 4/4] Apply batched suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Mr. Walls --- .github/dependabot.yml | 2 +- README.md | 4 ++-- action.yml | 20 ++++++++++++++------ 3 files changed, 17 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cbcdbba..cd38328 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,7 +11,7 @@ updates: rebase-strategy: "disabled" # Labels on pull requests for version updates only labels: - - "enhancement" # choosen as closest exsisting label + - "enhancement" # chosen as closest existing label commit-message: prefix: "[UPDATE] " include: "scope" diff --git a/README.md b/README.md index d95fe56..2012861 100644 --- a/README.md +++ b/README.md @@ -16,8 +16,8 @@ To run a bandit scan include a step like this: path: "." level: high confidence: high - # exit with 0, even with results found - exit_zero: true # optional, default is DEFAULT + # exit with 0, even with results found + exit_zero: true # optional, default is DEFAULT (exit with results-based value) ``` ## Inputs diff --git a/action.yml b/action.yml index 5a76acb..198a3e1 100644 --- a/action.yml +++ b/action.yml @@ -107,12 +107,20 @@ runs: INI_PATH="--ini $INPUT_INI_PATH" fi - if [ "$INPUT_CONFIG_PATH" == "DEFAULT" ]; then - CONFIG_PATH="" - else - CONFIG_PATH="-c $INPUT_CONFIG_PATH" - fi - bandit -f sarif -o results.sarif -r $INPUT_PATH $LEVEL $CONFIDENCE $EXCLUDED_PATHS $EXIT_ZERO $SKIPS $INI_PATH $CONFIG_PATH + CONFIG_PATH_ARG="" + if [ "$INPUT_CONFIG_PATH" == "DEFAULT" ]; then + # Clear both + CONFIG_PATH="" + CONFIG_PATH_ARG="" + unset CONFIG_PATH 2>dev/null || true # also try to unset + else + if [ -n "$INPUT_CONFIG_PATH" ] ; then + # Set both (but let bandit validate its own arguments) + CONFIG_PATH="$INPUT_CONFIG_PATH" # quote paths on assignment + CONFIG_PATH_ARG="-c" + fi + fi + bandit -f sarif -o results.sarif -r $INPUT_PATH $LEVEL $CONFIDENCE $EXCLUDED_PATHS $EXIT_ZERO $SKIPS $INI_PATH $CONFIG_PATH_ARG ${CONFIG_PATH:-} env: INPUT_PATH: ${{ inputs.path }} INPUT_LEVEL: ${{ inputs.level }}