Skip to content

Commit c8f094f

Browse files
ericwbericwb
authored
Convert to a composite action (#10)
Convert the current docker container based action into a composite action. A composite action no longer requires a Dockerfile or entrypoint script. The actual action YAML now parameterizes the key selected arguments of Bandit into official inputs into the action. The output of the code scan is to generate a JSON file using Bandit's SARIF format. This can be uploaded and rendered nicely into GitHub's ecosystem as a "Code Scanning" application. https://docs.github.com/en/actions/creating-actions/creating-a-composite-action Signed-off-by: Eric Brown <[email protected]>
1 parent f4a579f commit c8f094f

File tree

3 files changed

+131
-84
lines changed

3 files changed

+131
-84
lines changed

‎Dockerfile‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎action.yml‎

Lines changed: 131 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,82 +1,144 @@
11
name: Bandit
22
description: Run Bandit
3-
author: '@ericwb'
3+
author: '@PyCQA'
4+
5+
branding:
6+
icon: 'shield'
7+
color: 'yellow'
48

59
inputs:
6-
args:
10+
configfile:
11+
description: |
12+
Optional config file to use for selecting plugins and overriding defaults
13+
required: false
14+
default: 'DEFAULT'
15+
profile:
16+
description: |
17+
Profile to use (defaults to executing all tests)
18+
required: false
19+
default: 'DEFAULT'
20+
tests:
21+
description: |
22+
Comma-separated list of test IDs to run
23+
required: false
24+
default: 'DEFAULT'
25+
skips:
26+
description: |
27+
Comma-separated list of test IDs to skip
28+
required: false
29+
default: 'DEFAULT'
30+
severity:
31+
description: |
32+
Report only issues of a given severity level or higher. "all" and "low"
33+
are likely to produce the same results, but it is possible for rules to
34+
be undefined which will not be listed in "low". Options include:
35+
{all, high, medium, low}
36+
required: false
37+
default: 'DEFAULT'
38+
confidence:
39+
description: |
40+
Report only issues of a given confidence level or higher. "all" and "low"
41+
are likely to produce the same results, but it is possible for rules to
42+
be undefined which will not be listed in "low". Options include:
43+
{all, high, medium, low}
44+
required: false
45+
default: 'DEFAULT'
46+
exclude:
47+
description: |
48+
Comma-separated list of paths (glob patterns supported) to exclude from
49+
scan (note that these are in addition to the excluded paths provided in
50+
the config file)
51+
required: false
52+
default: '.svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg'
53+
baseline:
54+
description: |
55+
Path of a baseline report to compare against (only JSON-formatted files
56+
are accepted)
57+
required: false
58+
default: 'DEFAULT'
59+
ini:
760
description: |
8-
Optional arguments:
9-
-r, --recursive find and process files in subdirectories
10-
-a {file,vuln}, --aggregate {file,vuln}
11-
aggregate output by vulnerability (default) or by
12-
filename
13-
-n CONTEXT_LINES, --number CONTEXT_LINES
14-
maximum number of code lines to output for each issue
15-
-c CONFIG_FILE, --configfile CONFIG_FILE
16-
optional config file to use for selecting plugins and
17-
overriding defaults
18-
-p PROFILE, --profile PROFILE
19-
profile to use (defaults to executing all tests)
20-
-t TESTS, --tests TESTS
21-
comma-separated list of test IDs to run
22-
-s SKIPS, --skip SKIPS
23-
comma-separated list of test IDs to skip
24-
-l, --level report only issues of a given severity level or higher
25-
(-l for LOW, -ll for MEDIUM, -lll for HIGH)
26-
--severity-level {all,low,medium,high}
27-
report only issues of a given severity level or higher.
28-
"all" and "low" are likely to produce the same results,
29-
but it is possible for rules to be undefined which will
30-
not be listed in "low".
31-
-i, --confidence report only issues of a given confidence level or
32-
higher (-i for LOW, -ii for MEDIUM, -iii for HIGH)
33-
--confidence-level {all,low,medium,high}
34-
report only issues of a given confidence level or higher.
35-
"all" and "low" are likely to produce the same results,
36-
but it is possible for rules to be undefined which will
37-
not be listed in "low".
38-
-f {csv,custom,html,json,screen,txt,xml,yaml}, --format {csv,custom,html,json,screen,txt,xml,yaml}
39-
specify output format
40-
--msg-template MSG_TEMPLATE
41-
specify output message template (only usable with
42-
--format custom), see CUSTOM FORMAT section for list
43-
of available values
44-
-o [OUTPUT_FILE], --output [OUTPUT_FILE]
45-
write report to filename
46-
-v, --verbose output extra information like excluded and included
47-
files
48-
-d, --debug turn on debug mode
49-
-q, --quiet, --silent
50-
only show output in the case of an error
51-
--ignore-nosec do not skip lines with # nosec comments
52-
-x EXCLUDED_PATHS, --exclude EXCLUDED_PATHS
53-
comma-separated list of paths (glob patterns
54-
supported) to exclude from scan (note that these are
55-
in addition to the excluded paths provided in the
56-
config file) (default:
57-
.svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)
58-
-b BASELINE, --baseline BASELINE
59-
path of a baseline report to compare against (only
60-
JSON-formatted files are accepted)
61-
--ini INI_PATH path to a .bandit file that supplies command line
62-
arguments
63-
--exit-zero exit with 0, even with results found
64-
--version show program's version number and exit
61+
Path to a .bandit file that supplies command line arguments
6562
required: false
66-
default: '-h'
63+
default: 'DEFAULT'
6764
targets:
6865
description: |
6966
Source file(s) or directory(s) to be tested
7067
required: true
68+
default: '.'
7169

7270
runs:
73-
using: docker
74-
image: Dockerfile
75-
args:
76-
- ${{ inputs.args }}
77-
env:
78-
TARGETS: ${{ inputs.targets }}
71+
using: composite
72+
steps:
73+
- name: Set up Python 3.8
74+
uses: actions/setup-python@v5
75+
with:
76+
python-version: 3.8
7977

80-
branding:
81-
icon: 'shield'
82-
color: 'yellow'
78+
- name: Install Bandit
79+
shell: bash
80+
run: pip install bandit[sarif]
81+
82+
- name: Checkout repository
83+
uses: actions/checkout@v4
84+
85+
- name: Run Bandit
86+
shell: bash
87+
run: |
88+
if [ "$INPUT_CONFIGFILE" == "DEFAULT" ]; then
89+
CONFIGFILE=""
90+
else
91+
CONFIGFILE="-c $INPUT_CONFIGFILE"
92+
fi
93+
if [ "$INPUT_PROFILE" == "DEFAULT" ]; then
94+
PROFILE=""
95+
else
96+
PROFILE="-p $INPUT_PROFILE"
97+
fi
98+
if [ "$INPUT_TESTS" == "DEFAULT" ]; then
99+
TESTS=""
100+
else
101+
TESTS="-t $INPUT_TESTS"
102+
fi
103+
if [ "$INPUT_SKIPS" == "DEFAULT" ]; then
104+
SKIPS=""
105+
else
106+
SKIPS="-s $INPUT_SKIPS"
107+
fi
108+
if [ "$INPUT_SEVERITY" == "DEFAULT" ]; then
109+
SEVERITY=""
110+
else
111+
SEVERITY="--severity-level $INPUT_SEVERITY"
112+
fi
113+
if [ "$INPUT_CONFIDENCE" == "DEFAULT" ]; then
114+
CONFIDENCE=""
115+
else
116+
CONFIDENCE="--confidence-level $INPUT_CONFIDENCE"
117+
fi
118+
if [ "$INPUT_BASELINE" == "DEFAULT" ]; then
119+
BASELINE=""
120+
else
121+
BASELINE="-b $INPUT_BASELINE"
122+
fi
123+
if [ "$INPUT_INI" == "DEFAULT" ]; then
124+
INI=""
125+
else
126+
INI="--ini $INPUT_INI"
127+
fi
128+
bandit $CONFIGFILE $PROFILE $TESTS $SKIPS $SEVERITY $CONFIDENCE -x $INPUT_EXCLUDE $BASELINE $INI -r $INPUT_TARGETS -f sarif -o results.sarif || true
129+
env:
130+
INPUT_CONFIGFILE: ${{ inputs.configfile }}
131+
INPUT_PROFILE: ${{ inputs.profile }}
132+
INPUT_TESTS: ${{ inputs.tests }}
133+
INPUT_SKIPS: ${{ inputs.skips }}
134+
INPUT_SEVERITY: ${{ inputs.severity }}
135+
INPUT_CONFIDENCE: ${{ inputs.confidence }}
136+
INPUT_EXCLUDE: ${{ inputs.exclude }}
137+
INPUT_BASELINE: ${{ inputs.baseline }}
138+
INPUT_INI: ${{ inputs.ini }}
139+
INPUT_TARGETS: ${{ inputs.targets }}
140+
141+
- name: Upload SARIF file
142+
uses: github/codeql-action/upload-sarif@v3
143+
with:
144+
sarif_file: results.sarif

‎entrypoint.sh‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)