diff --git a/.github/workflows/bandit.yaml b/.github/workflows/bandit.yaml index f59d153..faf45ca 100644 --- a/.github/workflows/bandit.yaml +++ b/.github/workflows/bandit.yaml @@ -27,4 +27,31 @@ jobs: pip install bandit - name: Run Bandit - run: bandit -r . + id: bandit + run: bandit -r . --format json -o bandit_results.json + + - name: Determine Badge URL + id: determine_badge + run: | + python3 - < 0 or results['metrics']['_totals']['issue_severity']['MEDIUM'] > 0 or results['metrics']['_totals']['issue_severity']['LOW'] > 0: + badge_url = 'https://img.shields.io/badge/Bandit-Issues%20Detected-red?label=high%3A{}%20medium%3A{}%20low%3A{}'.format( + results['metrics']['_totals']['issue_severity']['HIGH'], + results['metrics']['_totals']['issue_severity']['MEDIUM'], + results['metrics']['_totals']['issue_severity']['LOW'] + ) + else: + badge_url = 'https://img.shields.io/badge/Bandit-No%20Issues%20Found-brightgreen' + + print(badge_url) + EOF + + - name: Update README with Badge + run: | + badge_url=$(echo "${{ steps.determine_badge.outputs.stdout }}") + sed -i "s|!\[Bandit Workflow\]\([^)]+\)|![Bandit Workflow](${badge_url})|" README.md