# Scan the Python code for vulnerabilities using Bandit.
name: Bandit

on:
  workflow_call:

env:
  # Python-based tools.
  PMREORDER: src/tools/pmreorder/*.py
  CALL_STACKS_ANALYSIS: utils/call_stacks_analysis/*.py

jobs:
  bandit:
    name: Bandit
    runs-on: ubuntu-latest
    steps:
      - name: Clone the git repo
        uses: actions/checkout@v4

      - name: Install Bandit
        run: sudo apt-get -y install bandit

      - name: Bandit scan
        run: bandit --version && bandit $PMREORDER $CALL_STACKS_ANALYSIS
