Bump github/codeql-action from 256d634097be96e792d6764f9edaefc4320557b1 to 38697555549f1db7851b81482ff19f1fa5c4fedc #793

	---
	name: Bandit Security Check
	on:
	workflow_dispatch:
	pull_request:
	push:
	branches:
	- main
	permissions: read-all
	jobs:
	bandit-check:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
	with:
	python-version: '3.x'

	- name: Install Bandit with Sarif extras
	run: pip install "bandit[sarif]"

	- name: Run Bandit
	id: bandit
	continue-on-error: true
	run: \|
	set +e
	set +x
	bandit -r . -f sarif -o bandit-output.sarif
	echo "exit_code=$?" >> $GITHUB_OUTPUT
	cat bandit-output.sarif

	- name: Upload Bandit scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4
	with:
	sarif_file: "bandit-output.sarif"

	- name: Fail if Bandit run had errors
	if: steps.bandit.outputs.exit_code != 0
	run: exit 1

Provide feedback