zdoom-macos-deps/.github/workflows/lint.yml

---
name: Lint Code

on:
  - push
  - pull_request

jobs:
  lint:
    if: "!contains(github.event.head_commit.message, '[skip lint]')"
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Super-Linter
        uses: github/super-linter/slim@v4
        env:
          FILTER_REGEX_INCLUDE: .*(\.py|\.md|\.yml)$
          FILTER_REGEX_EXCLUDE: .*/deps/.*
          VALIDATE_NATURAL_LANGUAGE: false
          VALIDATE_PYTHON_BLACK: false

      - name: Bandit
        run: |
          pip3 install bandit
          # [B101:assert_used] Use of assert detected. The enclosed code will be
          #   removed when compiling to optimised byte code.
          # [B310:blacklist] Audit url open for permitted schemes. Allowing use
          #   of file:/ or custom schemes is often unexpected.
          # [B404:blacklist] Consider possible security implications associated
          #   with subprocess module.
          # [B603:subprocess_without_shell_equals_true] subprocess call - check
          #   for execution of untrusted input.
          # [B607:start_process_with_partial_path] Starting a process with a
          #   partial executable path
          bandit --skip B101,B310,B404,B603,B607 --recursive . --exclude \
          ./deps/vulkan-headers/share/vulkan/registry
...