security.yml

name: Security

on:
  push:
    branches:
      - main
    tags:
      - '*'
  pull_request:
    branches:
      - '*'

jobs:
  security:
    name: Check security concerns with bandit on Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [ 3.11 ]
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install dependencies
        run: |
          python3 -m pip install --upgrade pip
          pip3 install bandit>=1.7 tox
        shell: bash
      - name: Run bandit (via tox)
        run: tox -e check-security
        shell: bash