chore: refresh pixi lockfiles (#2943) #5854

	# SPDX-FileCopyrightText: Copyright (c) 2024-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	#
	# SPDX-License-Identifier: Apache-2.0

	name: "Static Analysis: Bandit Scan"

	on:
	push:
	branches:
	- "pull-request/[0-9]+"
	- "ctk-next"
	- "main"
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
	cancel-in-progress: true

	jobs:
	analyze:
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- name: Install uv
	uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
	with:
	enable-cache: false

	- name: Get ignore codes
	id: ignore-codes
	# This are computed so that we can run only the `S` (bandit)
	# checks. Passing --select to ruff overrides any config files
	# (ruff.toml, pyproject.toml, etc), so to avoid having keep everything
	# in sync we grab them from the TOML programmatically
	run: \|
	set -euxo pipefail

	echo "codes=$(uvx toml2json ./ruff.toml \| jq -r '.lint.ignore \| map(select(test("^S\\d+"))) \| join(",")')" >> "$GITHUB_OUTPUT"
	- name: Perform Bandit Analysis using Ruff
	uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
	with:
	args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif"
	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
	with:
	sarif_file: results.sarif

Navigation Menu