starter-workflows icon indicating copy to clipboard operation
starter-workflows copied to clipboard
verified publisher icon actions

Update bandit.yml with version bump

Open reactive-firewall opened this issue 1 year ago • 3 comments

Migrate to latest, maintained, version of bandit code-scanning action.

Noteworthy changes:

  • Maintained action is a fork of the unmaintained previous version. - Versions are still pinnable ( including bug-for-bug compatible v1.0 ) - Maintained project now utilizes @dependabot to keep sub-dependencies current.
  • Maintained action is already released on marketplace.
  • Credits updated with both original and maintainer with no change to licensing.
  • Updated to use checkout@v4 now.
📋 TL;DR - PR Template with checklist from code owners

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.

Tasks

For all workflows, the workflow:

  • [x] Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
  • [x] Should use sentence case for the names of workflows and steps (for example, "Run tests").
  • [x] Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
  • [x] Should include comments in the workflow for any parts that are not obvious or could use clarification.
  • [x] Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For Code Scanning workflows, the workflow:

  • [x] Should be preserved under the code-scanning directory.
  • [x] Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
    • [x] name: Name of the Code Scanning integration.
    • [ ] creator: Name of the organization/user producing the Code Scanning integration. PLEASE ADVISE does this need to be changed?
    • [x] description: Short description of the Code Scanning integration.
    • [x] categories: Array of languages supported by the Code Scanning integration.
    • [x] iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
  • [x] Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

Some general notes:

  • [x] This workflow must only use actions that are produced by GitHub, in the actions organization, or
  • [x] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file: 
    # This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
  • [x] Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
  • [x] Automation and CI workflows cannot be dependent on a paid service or product.

reactive-firewall avatar Sep 10 '24 22:09 reactive-firewall

Tagging possible community stakeholders ( i.e. Request for Comment )

TL;DR:

Regarding which version to pin for actions/checkout (i.e. leave as actions/checkout@v4 versus change to actions/[email protected]

Regarding Included fixes from overlapping, related, or similar work (i.e. relevant community):

Regarding Possible Overlap with other PRs in this repo:

reactive-firewall avatar Sep 11 '24 00:09 reactive-firewall

Another rebase to keep this current with main.

💁🏻 LGTM! No conflicts from rebasing (from actions:main to remain current).

reactive-firewall avatar Dec 14 '24 06:12 reactive-firewall

@alexisabril is there a chance of someone looking this PR anytime soon?

reactive-firewall avatar Jan 06 '25 19:01 reactive-firewall

@actions/actions-workflow-development-reviewers is there a chance of someone looking this PR anytime soon?

reactive-firewall avatar Jul 24 '25 23:07 reactive-firewall

@actions/actions-workflow-development-reviewers is there a chance of someone looking this PR anytime soon?

Art39print avatar Jul 27 '25 20:07 Art39print