code-quality.yaml

name: Code Analysis
on: 
  push:
    branches:
      - 'master'
jobs:
  codeql:
    runs-on: ubuntu-latest
    steps:
      - run: echo "A ${{ github.event_name }} event happened, starting codeql job."
      - name: Check out repository code
        uses: actions/checkout@v3
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with: 
          languages: python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
      - run: echo "Job ended."
  bandit:
    runs-on: ubuntu-latest
    steps:
    - run: echo "A ${{ github.event_name }} event happened, starting bandit job."
    - uses: actions/checkout@v3
    - uses: actions/setup-python@v3
      with:
        python-version: '3.6'
    - run: pip install bandit_sarif_formatter
    - run: pip install bandit
    - run: bandit --format sarif --output out.sarif --exit-zero -r $GITHUB_WORKSPACE
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v2
      with:
        # Path to SARIF file relative to the root of the repository
        sarif_file: out.sarif
        # Optional category for the results
        # Used to differentiate multiple results for one commit
        category: my-analysis-tool