From debbd0ad1e733bb55e375ee88b0c555a1b7f9b83 Mon Sep 17 00:00:00 2001 From: cryptorugmunch Date: Fri, 3 Jul 2026 00:36:44 +0200 Subject: [PATCH 1/2] ci: isolate bandit venv outside repo scan path --- .forgejo/workflows/ci.yml | 6 +++--- PYEOF | 0 2 files changed, 3 insertions(+), 3 deletions(-) create mode 100644 PYEOF diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 2035180..0b1d540 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -150,7 +150,7 @@ jobs: ln -sf /root/.local/bin/uv /usr/local/bin/uv ln -sf /root/.local/bin/uvx /usr/local/bin/uvx uv python install 3.11 - uv venv --python 3.11 .venv - uv pip install --python .venv/bin/python bandit + uv venv --python 3.11 /tmp/bandit-venv + uv pip install --python /tmp/bandit-venv/bin/python bandit - name: Bandit (high+medium severity) - run: source .venv/bin/activate && bandit -r . -x tests/,.venv,__pycache__ -ll + run: source /tmp/bandit-venv/bin/activate && bandit -r . -x tests/,.venv,__pycache__ -ll diff --git a/PYEOF b/PYEOF new file mode 100644 index 0000000..e69de29 From f29112e8b92202d5a05b7cbdcdfabacaf5d179be Mon Sep 17 00:00:00 2001 From: cryptorugmunch Date: Fri, 3 Jul 2026 00:36:44 +0200 Subject: [PATCH 2/2] ci: isolate bandit venv outside repo scan path --- .forgejo/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 2035180..0b1d540 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -150,7 +150,7 @@ jobs: ln -sf /root/.local/bin/uv /usr/local/bin/uv ln -sf /root/.local/bin/uvx /usr/local/bin/uvx uv python install 3.11 - uv venv --python 3.11 .venv - uv pip install --python .venv/bin/python bandit + uv venv --python 3.11 /tmp/bandit-venv + uv pip install --python /tmp/bandit-venv/bin/python bandit - name: Bandit (high+medium severity) - run: source .venv/bin/activate && bandit -r . -x tests/,.venv,__pycache__ -ll + run: source /tmp/bandit-venv/bin/activate && bandit -r . -x tests/,.venv,__pycache__ -ll