From b2b52a419397032ac42c1fc5e3c93b0f0021b6ca Mon Sep 17 00:00:00 2001
From: Natuworkguy <149914029+Natuworkguy@users.noreply.github.com>
Date: Wed, 6 May 2026 21:20:01 +0000
Subject: [PATCH] ci: add Bandit linting and reorganize lint jobs

- Added `bandit` to `requirements-dev.txt`.
- Added a new `lint-bandit` job to `.github/workflows/ci.yml`.
- Updated test jobs to depend on `lint-ruff`, `lint-flake8`, and `lint-bandit` to create a parallel linting stage in the CI graph.
- Optimized `lint-flake8` to install only its own dependencies.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 24 ++++++++++++++++++++----
 requirements-dev.txt     |  1 +
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1e3207..455cc8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,13 +35,29 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
+          pip install flake8
       - name: Run Flake8
         run: flake8 .
 
+  lint-bandit:
+    name: Lint (Bandit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install bandit
+      - name: Run Bandit
+        run: bandit -r . -ll
+
   test-linux:
     name: Test (Linux)
-    needs: [lint-ruff, lint-flake8]
+    needs: [lint-ruff, lint-flake8, lint-bandit]
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -63,7 +79,7 @@ jobs:
 
   test-windows:
     name: Test (Windows)
-    needs: [lint-ruff, lint-flake8]
+    needs: [lint-ruff, lint-flake8, lint-bandit]
     runs-on: windows-latest
     strategy:
       matrix:
@@ -85,7 +101,7 @@ jobs:
 
   test-macos:
     name: Test (macOS)
-    needs: [lint-ruff, lint-flake8]
+    needs: [lint-ruff, lint-flake8, lint-bandit]
     runs-on: macos-latest
     strategy:
       matrix:
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 22b032b..b57e206 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -3,3 +3,4 @@ ruff
 flake8
 build
 twine
+bandit