RAGFlow Claude MCP Server

name: "Bandit Security Scan"

on:
  push:
    branches: [ "main", "master" ]
  pull_request:
    branches: [ "main", "master" ]
  schedule:
    - cron: '0 6 * * 2'  # Weekly on Tuesdays at 6 AM UTC

jobs:
  bandit:
    name: Security Analysis with Bandit
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install bandit[toml]

    - name: Run Bandit security scan
      run: |
        bandit -r src/ -f json -o bandit-report.json
        bandit -r src/ -f txt

    - name: Upload Bandit scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: bandit-report.sarif
      continue-on-error: true

    - name: Convert Bandit JSON to SARIF
      if: always()
      run: |
        pip install bandit[sarif]
        bandit -r src/ -f sarif -o bandit-report.sarif

    - name: Upload SARIF results
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: bandit-report.sarif

    - name: Upload Bandit report as artifact
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: bandit-security-report
        path: bandit-report.*
        retention-days: 30