Implementation of GitHub Bandit action #6
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| name: Bandit Code Scan | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: [ main ] | ||
|
|
||
| permissions: | ||
| pull-requests: write | ||
| jobs: | ||
| bandit-action: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
| - name: Run Bandit Scan | ||
| uses: ./ | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| path: "." | ||
| recursive: "true" | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,10 +1,19 @@ | ||||||
| FROM ghcr.io/pycqa/bandit/bandit:latest | ||||||
|
|
||||||
| ENV GITHUB_TOKEN="" | ||||||
| ENV GITHUB_REPOSITORY="" | ||||||
|
|
||||||
| # Install additional dependencies if necessary | ||||||
| RUN apk add --no-cache git bash python3 py3-pip && \ | ||||||
| pip install pygithub | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| # Copy the entrypoint script | ||||||
| COPY entrypoint.sh /entrypoint.sh | ||||||
|
|
||||||
| # Make the entrypoint script executable | ||||||
| RUN chmod +x /entrypoint.sh | ||||||
|
|
||||||
| # Assuming the Dockerfile is located at the root of the repository | ||||||
| COPY post_comment.py /post_comment.py | ||||||
|
|
||||||
| ENTRYPOINT ["/entrypoint.sh"] | ||||||
|
|
||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -1,2 +1,114 @@ | ||||||
| # GitHub Action for Bandit | ||||||
|
|
||||||
| This is the official GitHub Action for running [Bandit](https://bandit.readthedocs.io/en/latest/), | ||||||
| developed by the maintainers of Bandit. It is designed to be configurable and | ||||||
| easy to use. | ||||||
|
There was a problem hiding this comment. The line breaks here are a little off. Maybe limit to 80 chars. |
||||||
|
|
||||||
| ## Features | ||||||
|
|
||||||
| - :gear: Fully configurable with input parameters and support for config files. | ||||||
| - :speech_balloon: Posts scan results as a comment on pull requests. | ||||||
|
|
||||||
| ## Inputs | ||||||
|
|
||||||
| | Name | Description | Default | | ||||||
| |----------------------|-------------------------------------------------------------|---------| | ||||||
| | `recursive` | Find and process files in subdirectories. | `false` | | ||||||
| | `aggregate` | Aggregate output by vulnerability or by filename. | `vuln` | | ||||||
| | `context_lines` | Maximum number of code lines to output for each issue. | | | ||||||
| | `config_file` | Optional config file to use for selecting plugins. | | | ||||||
| | `profile` | Profile to use, defaults to executing all tests. | | | ||||||
| | `tests` | Comma-separated list of test IDs to run. | | | ||||||
| | `skips` | Comma-separated list of test IDs to skip. | | | ||||||
| | `severity_level` | Report only issues of a given severity level or higher. | `low` | | ||||||
| | `confidence_level` | Report only issues of a given confidence level or higher. | `low` | | ||||||
| | `verbose` | Output extra information like excluded and included files. | `false` | | ||||||
| | `debug` | Turn on debug mode. | `false` | | ||||||
| | `quiet` | Only show output in the case of an error. | `false` | | ||||||
| | `ignore_nosec` | Do not skip lines with `# nosec` comments. | `false` | | ||||||
| | `exclude_paths` | Comma-separated list of paths to exclude from scan. | | | ||||||
| | `baseline` | Path of a baseline report to compare against. | | | ||||||
| | `ini_path` | Path to a `.bandit` file that supplies command line args. | | | ||||||
| | `exit_zero` | Exit with 0 even with results found. | ||||||
|
|
||||||
| | :memo: | We do not expose args for output/format,message_template, as we need to hardcore the report for the PR comment feature| | ||||||
| |---------------|:----------------------------------------------------------------------------------------------------------------------| | ||||||
|
|
||||||
| ## Usage | ||||||
|
|
||||||
| To use the action, add the following to a GitHub workflow file (e.g. `.github/workflows/bandit.yml`): | ||||||
|
|
||||||
| ### Basic Example | ||||||
|
|
||||||
| ```yaml | ||||||
| name: Bandit Code Scan | ||||||
|
|
||||||
| on: | ||||||
| pull_request: | ||||||
| branches: [ main ] | ||||||
|
|
||||||
| permissions: | ||||||
| pull-requests: write | ||||||
|
|
||||||
| jobs: | ||||||
| bandit-action: | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - uses: actions/checkout@v2 | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| - name: Run Bandit Scan | ||||||
| uses: ./ | ||||||
| env: | ||||||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||||||
| with: | ||||||
| path: "." | ||||||
| exit_zero: "true" | ||||||
| recursive: "true" | ||||||
| ``` | ||||||
|
|
||||||
| ```yaml | ||||||
| name: Bandit Code Scan | ||||||
|
|
||||||
| on: [push, pull_request] | ||||||
|
|
||||||
| permissions: | ||||||
| pull-requests: write | ||||||
|
|
||||||
| jobs: | ||||||
| bandit-action: | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - uses: actions/checkout@v2 | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| - name: Run Bandit Scan | ||||||
| uses: ./ | ||||||
| env: | ||||||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||||||
| with: | ||||||
| path: "." | ||||||
| exit_zero: true | ||||||
| recursive: true | ||||||
| aggregate: vuln | ||||||
| context_lines: 3 | ||||||
| config_file: .bandit | ||||||
| profile: bandit | ||||||
| tests: B101,B102 | ||||||
| skips: B101 | ||||||
| severity_level: low | ||||||
| confidence_level: low | ||||||
| verbose: true | ||||||
| debug: true | ||||||
| quiet: false | ||||||
| ignore_nosec: false | ||||||
| exclude_paths: tests,docs | ||||||
| baseline: baseline.json | ||||||
| ini_path: .bandit | ||||||
| exit_zero: false | ||||||
| ``` | ||||||
|
|
||||||
| ## Contributing | ||||||
|
|
||||||
| If you would like to contribute to this project, please open an issue or a pull | ||||||
| request. | ||||||
|
|
||||||
| ## License | ||||||
|
|
||||||
| This GitHub Action is distributed under the Apache License, Version 2.0, see [LICENSE](LICENSE) for more information. | ||||||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,82 +1,95 @@ | ||
| name: 'Bandit Code Scan' | ||
|
There was a problem hiding this comment. I don't think the YAML file here would require single quotes for strings. |
||
| description: 'Run Bandit code scans on your Python codebase' | ||
| inputs: | ||
| GITHUB_TOKEN: | ||
| description: 'GitHub token' | ||
|
There was a problem hiding this comment. I believe GitHub now refers these to "personal access tokens". And the latest version have fine-grained permissions that can be assigned. Therefore guidance on what minimal set of permissions needed here would be useful. There was a problem hiding this comment. Ah right, this is an inbuilt Token that is created for each workflow run and then destroyed at the end. No need for the user to do anything: |
||
| required: true | ||
| recursive: | ||
| description: 'Find and process files in subdirectories' | ||
| required: false | ||
| default: 'false' | ||
| aggregate: | ||
| description: 'Aggregate output by vulnerability or by filename' | ||
| required: false | ||
| default: 'vuln' | ||
| context_lines: | ||
| description: 'Maximum number of code lines to output for each issue' | ||
| required: false | ||
| config_file: | ||
| description: 'Optional config file to use' | ||
| required: false | ||
| profile: | ||
| description: 'Profile to use' | ||
| required: false | ||
| tests: | ||
| description: 'Comma-separated list of test IDs to run' | ||
| required: false | ||
| skips: | ||
| description: 'Comma-separated list of test IDs to skip' | ||
| required: false | ||
| severity_level: | ||
| description: 'Report only issues of a given severity level or higher' | ||
| required: false | ||
| confidence_level: | ||
| description: 'Report only issues of a given confidence level or higher {all,low,medium,high}' | ||
| required: false | ||
| verbose: | ||
| description: 'Output extra information like excluded and included files' | ||
| required: false | ||
| default: 'false' | ||
| debug: | ||
| description: 'Turn on debug mode' | ||
| required: false | ||
| default: 'false' | ||
| quiet: | ||
| description: 'Only show output in the case of an error' | ||
| required: false | ||
| default: 'false' | ||
| ignore_nosec: | ||
| description: 'Do not skip lines with # nosec comments' | ||
| required: false | ||
| default: 'false' | ||
| exclude_paths: | ||
| description: 'Comma-separated list of paths to exclude from scan' | ||
| required: false | ||
| baseline: | ||
| description: 'Path of a baseline report to compare against' | ||
| required: false | ||
| ini_path: | ||
| description: 'Path to a .bandit file that supplies command line arguments' | ||
| required: false | ||
| path: | ||
| description: 'Path to scan' | ||
| required: true | ||
| default: '.' | ||
| level: | ||
| description: 'Report only issues of a given severity level or higher' | ||
| required: false | ||
| default: 'low' | ||
| exit_zero: | ||
| description: 'Exit with 0, even with results found' | ||
| required: false | ||
| default: 'false' | ||
| runs: | ||
| using: 'docker' | ||
| image: 'Dockerfile' | ||
| args: | ||
| - ${{ inputs.recursive }} | ||
| - ${{ inputs.aggregate }} | ||
| - ${{ inputs.context_lines }} | ||
| - ${{ inputs.config_file }} | ||
| - ${{ inputs.profile }} | ||
| - ${{ inputs.tests }} | ||
| - ${{ inputs.skips }} | ||
| - ${{ inputs.severity_level }} | ||
| - ${{ inputs.confidence_level }} | ||
| - ${{ inputs.verbose }} | ||
| - ${{ inputs.debug }} | ||
| - ${{ inputs.quiet }} | ||
| - ${{ inputs.ignore_nosec }} | ||
| - ${{ inputs.exclude_paths }} | ||
| - ${{ inputs.baseline }} | ||
| - ${{ inputs.ini_path }} | ||
| - ${{ inputs.path }} | ||
| - ${{ inputs.level }} | ||
| - ${{ inputs.exit_zero }} | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The latest version for checkout is v4