security.yml

name: Lint
on:
  push:
    branches:
      - develop
#      - master
#      - staging
#      - releases/*
  pull_request:
    branches: [develop, master]
    types: [synchronize, opened, reopened, ready_for_review]

defaults:
  run:
    shell: bash


concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true


permissions:
  contents: read

jobs:
  changes:
    if: (github.event_name != 'pull_request' && ! github.event.pull_request.head.repo.fork) || (github.event_name == 'pull_request' && (github.event.pull_request.head.repo.fork || startsWith(github.head_ref, 'dependabot/')))
    name: check files
    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      lint: ${{ steps.changes.outputs.lint }}
      docker: ${{ steps.changes.outputs.docker_base }}
    steps:
      - run: git config --global --add safe.directory $(realpath .)
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - id: changes
        name: Check for backend file changes
        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
        with:
          base: ${{ github.ref }}
          token: ${{ github.token }}
          filters: .github/file-filters.yml

  bandit:
    needs: changes
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false && needs.changes.outputs.lint
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v2
        with:
          python-version: '3.12'
      - name: Install requirements
        run: pip install bandit
      - name: bandit
        run: bandit src/