feat: Enable Bandit security scanning

.pre-commit-config.yaml

@@ -4,6 +4,15 @@
 repos:
   - repo: local
     hooks:
+      - id: bandit
+        name: bandit
+        description: 'Bandit is a tool for finding common security issues in Python code'
+        entry: bandit
+        args: ['--configfile', 'pyproject.toml']
+        language: system
+        types: [python]
+        stages: [commit]
+
       - id: black
         name: black
         entry: black

README.md

@@ -16,6 +16,7 @@
 [![Python: 3.9](https://img.shields.io/badge/Python-3.9-blue)](https://www.python.org/)
 [![shellcheck: passing](https://img.shields.io/badge/shellcheck-passing-brightgreen)](https://www.shellcheck.net/)
 [![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)
+[![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
 
 Central storage, management and access solution for important geospatial datasets. Developed by
 [Toitū Te Whenua Land Information New Zealand](https://github.com/linz).

pyproject.toml

@@ -2,6 +2,9 @@
 requires = ["poetry-core>=1.0.0"]
 build-backend = "poetry.core.masonry.api"
 
+[tool.bandit]
+exclude_dirs = [".venv", "cdk.out", "node_modules", "tests"]
+
 [tool.black]
 line-length = 100
 
@@ -102,6 +105,7 @@ strict-rfc3339 = {optional = true, version = "*"}
 typer = "*"
 
 [tool.poetry.dev-dependencies]
+bandit = {version = "*", extras = ["toml"]}
 black = "*"
 boto3-stubs = {version = "*", extras = ["batch", "dynamodb", "events", "lambda", "lambda-python", "s3", "s3control", "sns", "sqs", "ssm", "stepfunctions", "sts"]}
 gitlint = "*"