Bandit

Overview

A tool to inspect your Python projects for security issues using bandit.

This tool has been tested against the following:

1. GitHub Actions
2. Travis CI
3. CircleCI
4. BitBucket pipelines
5. Local command line

Because it is a plain Bash script, it should work on most CI platforms where you can run arbitrary commands.

Basic Usage

GitHub Actions

on: [push, pull_request]

jobs:
  build:
    name: Bandit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Run Bandit
        run: bash <(curl -s https://raw.githubusercontent.com/lupaxa-cicd-toolbox/bandit/master/src/pipeline.sh)

Local

./src/pipeline.sh

Or without cloning:

bash <(curl -s https://raw.githubusercontent.com/lupaxa-cicd-toolbox/bandit/master/src/pipeline.sh)

Configuration Options

The following environment variables customise the script:

Variable	Default	Purpose
INCLUDE_FILES	(empty)	Comma-separated path regexes to force-include
EXCLUDE_FILES	(empty)	Comma-separated path regexes to skip
NO_COLOR	false	Disable colour output
REPORT_ONLY	false	Report results but always exit 0
SHOW_ERRORS	true	Show detailed errors for failed files
SHOW_FILTERED	false	Show files skipped by exclude rules
SHOW_UNMATCHED	false	Show files that matched neither pattern
SCAN_ROOT	script default	Override scan directory without editing the script

Note

If you set INCLUDE_FILES, only matching paths are scanned (everything else is skipped, including paths that would match EXCLUDE_FILES).

You can combine any of the settings above:

on: [push, pull_request]

jobs:
  build:
    name: Bandit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Run Bandit
        env:
          REPORT_ONLY: true
          SHOW_ERRORS: true
        run: bash <(curl -s https://raw.githubusercontent.com/lupaxa-cicd-toolbox/bandit/master/src/pipeline.sh)

Example Output

--------------------------------------------------------------------- Stage 1: Parameters --
 No parameters given
---------------------------------------------------------- Stage 2: Install Prerequisites --
 [ OK ] python -m pip install --quiet --upgrade pip
 [ ✅ ] bandit is already installed
------------------------------------------------------------ Stage 3: Run bandit (v1.7.8) --
 [ ✅ ] tests/test.py
------------------------------------------------------------------------- Stage 4: Report --
 Total: 1, OK: 1, Failed: 0, Skipped: 0
----------------------------------------------------------------------- Stage 5: Complete --

File Identification

Target files are identified using the following code:

file -b "${filename}" | grep -qE '^Python script'

AND

[[ ${filename} =~ \.py$ ]]