# Static Application Security Testing
name: sast

on:
  workflow_dispatch:
  push:
    branches: ["master"]
  pull_request:
    branches: ["master"]

jobs:
  sast:
    permissions:
      security-events: write
    runs-on: ubuntu-latest
    steps:
      - name: Bandit
        uses: PyCQA/bandit-action@v1
        with:
          targets: src/validators
          exclude: .github,.pytest_cache,.venv,.vscode,site,tests