Switch to upstream PyCQA/bandit-action once SHA pinning is merged
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 55/100
Research direction
Check PyCQA/bandit-action issue #28 and PR #29 first, then confirm that a new upstream release has been published with SHA-pinned dependencies. Update the uses reference in action.yml to the released upstream commit, retain its version comment, and verify that no fork reference remains.
Written by the indexing model from the issue text.
Description
Context
We currently pin to a fork (lhoupert/bandit-action) instead of the upstream
PyCQA/bandit-action because the upstream action pins its internal dependencies
(actions/setup-python, actions/checkout, github/codeql-action/upload-sarif)
to mutable version tags rather than full-length commit SHAs.
This breaks workflows in environments that enforce SHA pinning for all transitive
action dependencies — a policy enforced by StepSecurity and OpenSSF Scorecard.
Upstream issue: https://github.com/PyCQA/bandit-action/issues/28
Upstream fix PR: https://github.com/PyCQA/bandit-action/pull/29 (awaiting review)
Action required
Once PR #29 is merged and a new release of PyCQA/bandit-action is cut, update
action.yml to replace:
uses: lhoupert/bandit-action@<sha>
with the upstream pinned SHA:
uses: PyCQA/bandit-action@<new-sha> # vX.Y.Z
Then the fork can be retired.
- Dominant language
- Python
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from developmentseed/action-python-security-auditing
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
All issues in developmentseed/action-python-security-auditing
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100