feat(security): add Bandit SAST to CI/CD pipeline#264
Merged
Conversation
mvillmow
commented
Jun 20, 2026
mvillmow
left a comment
mvillmow
left a comment
Contributor
Author
There was a problem hiding this comment.
LGTM — Bandit SAST added as required CI job + pixi/justfile/pre-commit/.bandit; clean B108 inline-suppressed, upload-artifact SHA-pinned, pass_filenames:false correct.
mvillmow
force-pushed
the
157-auto-impl
branch
2 times, most recently
from
77a5b09 to
8bcd211
Compare
Add Static Application Security Testing via Bandit (medium+ severity) as a required CI check, pre-commit hook, and local development task. This closes the gap where secrets (gitleaks) and dependency (pip-audit) scanning existed but no AST-level analyzer scanned Python source for injection, deserialization, and code-level vulnerabilities. **Changes:** - Create .bandit INI config (repo root) with targets=src/telemachy, recursive=true - Add bandit>=1.7.5 to pixi.toml dev dependencies - Add 'pixi run python -m bandit' task to pixi.toml and justfile - Wire bandit into 'just check' local CI gate after mypy - Add bandit pre-commit hook (language: system, pass_filenames: false) - Add security-sast-scan CI job to .github/workflows/_required.yml as required check - Suppress B108 (hardcoded /tmp) in models.py with rationale (ephemeral agent dir) - Fix pre-existing upload-artifact@v7 inconsistent pinning -> v5.0.0 SHA - Update CLAUDE.md with bandit guidance and new common commands **Verification:** - pixi run python -m bandit passes locally (1 nosec suppression for valid case) - All GitHub Actions now fully SHA-pinned (26/26) - Pre-commit hook executes and passes on all files - Existing tests all pass (48 passed) - Scopes equivalent: .pre-commit-config.yaml and CI job cover identical Python files **Follow-up:** Branch protection required checks will need manual update to include security/sast-scan. If day-1 false positives cannot be inline-suppressed, rollback procedure: revert security-sast-scan job from _required.yml, keep .bandit/pixi/pre-commit for opt-in use. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> Signed-off-by: mvillmow <4211002+mvillmow@users.noreply.github.com>
GHSA-4xgf-cpjx-pc3j) Signed-off-by: Micah Villmow <4211002+mvillmow@users.noreply.github.com> Signed-off-by: mvillmow <4211002+mvillmow@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add Static Application Security Testing (Bandit) as a required CI check, pre-commit hook, and local development task. Closes the gap where secrets (gitleaks) and dependency (pip-audit) scanning existed but no AST-level analyzer scanned Python source for injection, deserialization, and code-level vulnerabilities.
Tool choice — Bandit (PyCQA standard, AST-based, medium+ severity threshold):
Test plan
pixi run python -m bandit -ll --ini .bandit -r src/telemachypixi run pre-commit run bandit --all-filespixi run pytest(48 passed)pixi run ruff check src testsFollow-up actions
Branch protection required checks — manually update via admin command to include
security/sast-scan.GitHub issue will be opened to track this (prevents "silently forgotten" pattern).
Rollback path (if day-1 false positives cannot be inline-suppressed):
Revert only the
security-sast-scanjob block from.github/workflows/_required.ymland re-merge,leaving
.bandit/pixi/pre-commit in place for opt-in local use. Reference this PR in that issue.Closes #157
🤖 Generated with Claude Code