From 4270230377db49fe896f6059c02ab51291589dbe Mon Sep 17 00:00:00 2001
From: nandgator <38415384+nandgator@users.noreply.github.com>
Date: Thu, 22 Oct 2026 07:28:12 +0530
Subject: [PATCH] ci: run bandit from the locked sast group instead of
 bandit-action

PyCQA/bandit-action v1 hardcodes Python 3.8 (v1.0.1: 3.9), which the
ubuntu-latest runner no longer provides, so the sast job failed during
setup on every run before bandit started.

Run the bandit pinned in uv.lock with the pyproject.toml configuration,
the same way tox -e sast does. Findings now fail the job; the action
ignored bandit's exit code and only uploaded SARIF results.
---
 .github/workflows/sast.yaml | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/sast.yaml b/.github/workflows/sast.yaml
index ce70dee1..4a0dc34f 100644
--- a/.github/workflows/sast.yaml
+++ b/.github/workflows/sast.yaml
@@ -11,11 +11,20 @@ on:
 jobs:
   sast:
     permissions:
-      security-events: write
+      contents: read
     runs-on: ubuntu-latest
     steps:
-      - name: Bandit
-        uses: PyCQA/bandit-action@v1
+      # checkout repository
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      # set up uv and a specific python version
+      - name: Set up uv with Python v3.14
+        uses: astral-sh/setup-uv@v10.3.0
         with:
-          targets: src/validators
-          exclude: .github,.pytest_cache,.venv,.vscode,site,tests
+          python-version: "3.14"
+          enable-cache: true
+      # bandit, pinned by uv.lock and configured in pyproject.toml
+      - name: Install 'sast' dependencies
+        run: uv sync --locked --group sast
+      - name: Bandit
+        run: uv run --no-sync bandit -c pyproject.toml -r src/validators