fix(bedrock): adopt best practices #2272

	# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".

	name: bandit
	on:
	pull_request: {}
	workflow_dispatch: {}
	push:
	branches:
	- main
	schedule:
	- cron: 20 17 * * *
	jobs:
	bandit:
	name: bandit/ci
	runs-on: ubuntu-latest
	permissions:
	contents: read
	pull-requests: read
	security-events: write
	actions: read
	if: (github.actor != 'dependabot[bot]')
	steps:
	- name: Checkout project
	uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
	- name: Setup Python
	uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
	with:
	python-version: 3.x
	- name: Run Bandit
	run: pip install bandit && bandit --recursive --format html --output bandit-report.html --exit-zero .
	- name: Store Bandit as Artifact
	uses: actions/upload-artifact@18bf333cd2249fbbbdb605fd9d9ed57efd7adf34
	with:
	name: bandit-report.html
	path: bandit-report.html

Provide feedback