diff --git a/.github/workflows/bandit_security_test.yml b/.github/workflows/bandit_security_test.yml new file mode 100644 index 000000000..a26912690 --- /dev/null +++ b/.github/workflows/bandit_security_test.yml @@ -0,0 +1,27 @@ +name: Security check - Bandit # Name of the GitHub Actions workflow + +on: [push, pull_request] # Trigger the workflow + +jobs: + build: + runs-on: ubuntu-latest # Executes the job on the latest version of Ubuntu + strategy: + matrix: + os: [ubuntu-latest, macos-latest] # Running matrix jobs on both Ubuntu and macOS + name: Python ${{ matrix.os }} # Name the job based on the OS being used + + steps: + - uses: actions/checkout@v2 # Checks out your repository's code + + - name: Security check - Bandit # Run Bandit security check + uses: ioggstream/bandit-report-artifacts@v0.0.2 # Using Bandit for security checks + with: + project_path: . # Path to the project to scan + ignore_failure: true # Continue the workflow even if Bandit reports issues + + # This step is optional, it uploads the Bandit report as an artifact + - name: Security check report artifacts + uses: actions/upload-artifact@v1 + with: + name: Security report # Name of the artifact + path: output/security_report.txt # Path to the Bandit security report diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml new file mode 100644 index 000000000..3369b397f --- /dev/null +++ b/.github/workflows/mypy.yml @@ -0,0 +1,28 @@ +name: "mypy check" # Name of the GitHub Actions workflow + +on: [push, pull_request] # Trigger the workflow + +jobs: + + static-type-check: + runs-on: ubuntu-latest # Executes the job on the latest version of Ubuntu + + steps: + - uses: actions/checkout@v2 # Checks out your repository's code + - uses: actions/setup-python@v3 # Sets up Python for the job + with: + python-version: '3.x' # Specifies Python version 3.x + + - run: pip install mypy # Installs mypy for static type checking, you can specify a version here + + - name: Get Python changed files # Identifies changed Python files + id: changed-py-files + uses: tj-actions/changed-files@v23 + with: + files: | + *.py + **/*.py + + - name: Run if any of the listed files above is changed # Runs mypy on changed files + if: steps.changed-py-files.outputs.any_changed == 'true' # Conditional execution if any Python files changed + run: mypy ${{ steps.changed-py-files.outputs.all_changed_files }} --ignore-missing-imports