Bandit step configuration

Scan code repositories with with Bandit.

You can scan your code repositories using Bandit and ingest your results into Harness STO.

Important notes for running Bandit scans in STO

Root access requirements

For more information

Bandit step settings for STO scans

The recommended workflow is to add a Bandit step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and Variant Detection

Name

Variant

Workspace (repository)

Ingestion File

Log Level

Additional CLI flags

You can use this field to run the bandit command with specific command-line flags. For example, you can skip certain tests using -skip followed by a list of test IDs: -skip testID_1, testID_3, testID_5.

Fail on Severity

Settings

Additional Configuration

Advanced settings

Proxy settings

YAML pipeline example

If you copy this example, replace the placeholder values with appropriate values for your project, organization, and connectors.

pipeline:
  name: your-first-pipeline-v2
  identifier: yourfirstpipelinev2
  projectIdentifier: YOUR_HARNESS_PROJECT_ID
  orgIdentifier: YOUR_HARNESS_ORGANIZATION_ID
  tags: {}
  stages:
    - stage:
        name: bandit_repo_scan
        identifier: bandit_repo_scan
        description: ""
        type: SecurityTests
        spec:
          cloneCodebase: true
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            steps:
              - step:
                  type: Bandit
                  name: bandit_repo_scan
                  identifier: bandit_repo_scan
                  spec:
                    mode: orchestration
                    config: default
                    target:
                      name: <+input>
                      type: repository
                      variant: <+input>
                    advanced:
                      log:
                        level: info
                      fail_on_severity: critical
  properties:
    ci:
      codebase:
        connectorRef: YOUR_CODEBASE_CONNECTOR_ID
        repoName: <+input>
        build: <+input>