From e9c0f22fc05541235e4572ec59e5d945039b7f8f Mon Sep 17 00:00:00 2001
From: Emil Simeonov <emil@theliberatededge.org>
Date: Fri, 19 Jun 2026 21:13:21 +0200
Subject: [PATCH] GRM-24: chore: add bandit dependency, Makefile target and
 pre-commit hook

---
 .pre-commit-config.yaml | 8 ++++++++
 Makefile                | 5 ++++-
 pyproject.toml          | 1 +
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e6d2d1d..b453d1b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -32,6 +32,14 @@ repos:
         pass_filenames: false
         stages: [pre-commit]
 
+      - id: lint-bandit
+        name: bandit security scan
+        entry: make lint-bandit
+        language: system
+        types: [python]
+        pass_filenames: false
+        stages: [pre-commit]
+
       - id: ansible-lint
         name: ansible-lint
         entry: make ansible-lint
diff --git a/Makefile b/Makefile
index a0b91c5..1ca832b 100644
--- a/Makefile
+++ b/Makefile
@@ -83,7 +83,10 @@ lint-format:
 typecheck:
 	$(BIN)/pyright
 
-lint: lint-ruff lint-format typecheck
+lint: lint-ruff lint-format typecheck lint-bandit
+
+lint-bandit:
+	$(BIN)/bandit -r src/ scripts/
 
 ansible-lint:
 	$(BIN)/ansible-lint ansible/
diff --git a/pyproject.toml b/pyproject.toml
index ee80611..a356e35 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,6 +32,7 @@ dev = [
     "molecule>=26.4.0",
     "molecule-docker>=2.1.0",
     "ansible-lint>=26.4.0",
+    "bandit>=1.8.2",
     "pre-commit>=4.6.0",
     # Non-Python dev dependency: checkmake (Makefile linter)
     # Install via: go install github.com/mrtazz/checkmake/cmd/checkmake@latest