Code Scanning #462

	name: Code Scanning
	permissions: read-all

	on:
	workflow_dispatch: # run on request (no need for PR)
	schedule:
	# every UTC 6PM from Mon to Fri
	- cron: "0 18 * * 1-5"

	jobs:
	Bandit:
	runs-on: ubuntu-20.04
	steps:
	- name: CHECKOUT REPOSITORY
	uses: actions/checkout@v4
	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.10"
	- name: Install dependencies
	run: python -m pip install tox
	- name: Bandit Scanning
	run: tox -e bandit-scan
	- name: UPLOAD BANDIT REPORT
	uses: actions/upload-artifact@v4
	with:
	name: bandit-report
	path: .tox/bandit-report.txt
	# Use always() to always run this step to publish scan results when there are test failures
	if: ${{ always() }}
	Trivy-scan:
	runs-on: ubuntu-20.04
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.10"
	- name: Install dependencies
	run: python -m pip install tox
	- name: Trivy Scanning
	env:
	TRIVY_DOWNLOAD_URL: ${{ vars.TRIVY_DOWNLOAD_URL }}
	run: tox -vv -e trivy-scan
	- name: Upload Trivy results artifact
	uses: actions/upload-artifact@v4
	with:
	name: trivy-results
	path: \|
	.tox/trivy-scan-results.txt
	.tox/trivy-spdx-anomalib.json

Provide feedback