[Code Analysis] Bandit Security Scan #3

	---
	# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
	# SPDX-License-Identifier: Apache-2.0

	name: "[Code Analysis] Bandit Security Scan"
	run-name: "[Code Analysis] Bandit Security Scan"

	on:
	workflow_dispatch: {}
	pull_request:
	branches:
	- main
	- release-*
	types:
	- opened
	- synchronize
	- reopened
	push:
	branches:
	- main
	- release-*

	# Trigger workflow when enqueued to a merge group
	# (must be under 'on')
	merge_group:

	# Only run at most 1 workflow concurrently per PR or per branch to keep costs down
	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read # needed for actions/checkout

	jobs:
	bandit:
	name: "Run Bandit Security Scan"
	permissions:
	contents: read
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
	with:
	persist-credentials: false
	- name: Run Bandit scan
	uses: open-edge-platform/orch-ci/.github/actions/security/bandit@8b0ae64836f0395b21ff9dd7d9438284e8e8beda
	with:
	scan-scope: "changed"
	severity-level: "HIGH"
	confidence-level: "HIGH"
	output-format: "txt"
	config_file: ".github/resources/bandit.toml"

Provide feedback