Add python static scan task

.github/workflows/checks.yml

@@ -52,3 +52,13 @@ jobs:
         ignore-vulns: PYSEC-2022-237
     - name: Run npm audit
       run: make npm-audit
+
+  static-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: ./.github/actions/setup-project
+      - name: Install bandit
+        run: pip install bandit
+      - name: Run scan
+        run: bandit -r app/ --confidence-level medium

.github/workflows/daily_checks.yml

@@ -42,3 +42,13 @@ jobs:
         ignore-vulns: PYSEC-2022-237
     - name: Run npm audit
       run: make npm-audit
+
+  static-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: ./.github/actions/setup-project
+      - name: Install bandit
+        run: pip install bandit
+      - name: Run scan
+        run: bandit -r app/ --confidence-level medium

Makefile

@@ -81,6 +81,11 @@ pip-audit:
 .PHONY: audit
 audit: npm-audit pip-audit
 
+.PHONY: static-scan
+static-scan:
+	pip install bandit
+	bandit -r app/
+
 .PHONY: clean
 clean:
 	rm -rf node_modules cache target ${CF_MANIFEST_PATH}