Use setuptools-scm to determine versions (#1411) #1849

	# SPDX-FileCopyrightText: Copyright (c) 2024-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	#
	# SPDX-License-Identifier: Apache-2.0

	name: "Static Analysis: Bandit Scan"

	on:
	push:
	branches:
	- "pull-request/[0-9]+"
	- "main"
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
	cancel-in-progress: true

	jobs:
	analyze:
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

	- name: Install uv
	uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
	with:
	enable-cache: false

	- name: Get ignore codes
	id: ignore-codes
	# This are computed so that we can run only the `S` (bandit)
	# checks. Passing --select to ruff overrides any config files
	# (ruff.toml, pyproject.toml, etc), so to avoid having keep everything
	# in sync we grab them from the TOML programmatically
	run: \|
	set -euxo pipefail

	echo "codes=$(uvx toml2json ./ruff.toml \| jq -r '.lint.ignore \| map(select(test("^S\\d+"))) \| join(",")')" >> "$GITHUB_OUTPUT"
	- name: Perform Bandit Analysis using Ruff
	uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
	with:
	args: "check --select S --ignore ${{ steps.ignore-codes.outputs.codes }} --output-format sarif --output-file results.sarif"
	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: results.sarif

Provide feedback