sync with gh #71

	name: Python Code Scanning

	on: [push, pull_request]

	permissions:
	contents: read
	security-events: write

	jobs:

	bandit:
	name: Bandit Scan
	runs-on: ubuntu-latest
	env:
	BANDIT_REPORT_FILE: bandit_report.sarif
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Install Bandit + SARIF formatter
	run: pip install bandit bandit-sarif-formatter
	- name: Run Bandit (SARIF)
	run: >
	bandit --format sarif --exit-zero --recursive
	--output ${{ env.BANDIT_REPORT_FILE }} .
	- name: Upload SARIF to GitHub Security
	uses: github/codeql-action/upload-sarif@v3
	if: always()
	with:
	sarif_file: ${{ env.BANDIT_REPORT_FILE }}
	- name: Upload Bandit SARIF as artifact
	uses: actions/upload-artifact@v4
	with:
	name: bandit_report.sarif
	path: ${{ env.BANDIT_REPORT_FILE }}

	ruff:
	name: Ruff Scan
	runs-on: ubuntu-latest
	env:
	RUFF_REPORT_FILE: ruff-results.sarif
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.x'
	- name: Install Ruff
	run: pip install ruff
	- name: Run Ruff (SARIF)
	run: ruff check . --output-format sarif > ${{ env.RUFF_REPORT_FILE }}
	- name: Upload SARIF to GitHub Security
	uses: github/codeql-action/upload-sarif@v3
	if: always()
	with:
	sarif_file: ${{ env.RUFF_REPORT_FILE }}
	- name: Upload Ruff SARIF as artifact
	uses: actions/upload-artifact@v4
	with:
	name: ruff-results.sarif
	path: ${{ env.RUFF_REPORT_FILE }}

Provide feedback