##
# Copyright (C) 2026 Intel Corporation
#
# SPDX-License-Identifier: MIT
#
##

name: Python Bindings - Security Scan

on:
  pull_request:
    branches:
      - '**'
    paths:
      - 'bindings/sysman/python/**'
  push:
    branches:
      - main
      - master
      - python_bindings
    paths:
      - 'bindings/sysman/python/**'
  workflow_dispatch:

jobs:
  bandit:
    name: Bandit Security Analysis
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: bindings/sysman/python
    permissions:
      contents: read
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      
      - name: Install Bandit
        run: |
          python -m pip install --upgrade pip
          pip install bandit
      
      - name: Run Bandit security scan
        run: |
          bandit -r source/ test/ -f json -o bandit-report.json
          bandit -r source/ test/ -ll -f screen
      
      - name: Upload Bandit results as artifact
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: bandit-security-report
          path: bandit-report.json
          retention-days: 30