feat: pin bandit to the latest version

.github/workflows/test.yml

@@ -14,15 +14,35 @@ jobs:
     name: Test bandit
     steps:
       - name: Checkout
-        uses: actions/checkout@v3.5.0
+        uses: actions/checkout@v3
+
       - name: shellcheck
         uses: reviewdog/action-shellcheck@v1.17
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Docker Build
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          push: false
+          load: true
+          tags: ghcr.io/tj-actions/bandit:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Run bandit
         uses: ./
+
       - name: Run bandit with a single target
         uses: ./
         with:
           targets: "test_package"
+
       - name: Run bandit with a list of targets
         uses: ./
         with:

Dockerfile

@@ -2,8 +2,11 @@ FROM python:3.11.3-slim-buster
 
 LABEL maintainer="Tonye Jack <jtonye@ymail.com>"
 
+COPY requirements.txt .
+
 RUN python3 -m venv /venv && \
-  /venv/bin/pip3 install bandit
+  /venv/bin/pip3 install -U pip && \
+  /venv/bin/pip3 install -r requirements.txt
 
 ENV PATH="/venv/bin:${PATH}"
 

requirements.txt

@@ -0,0 +1 @@
+bandit==1.7.5