Linting and Security Scans

.github/workflows/bandit.yml

@@ -0,0 +1,18 @@
+name: Bandit
+on:
+    workflow_dispatch:
+    push:
+    pull_request:
+
+jobs:
+    analyze:
+        runs-on: ubuntu-latest
+        permissions:
+            # Required for all workflows
+            security-events: write
+            # Only required for workflows in private repositories
+            actions: read
+            contents: read
+        steps:
+            - name: Perform Bandit Analysis
+              uses: PyCQA/bandit-action@v1

.github/workflows/gitleaks.yml

@@ -0,0 +1,19 @@
+name: gitleaks
+on:
+  pull_request:
+  push:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 4 * * *" # run once a day at 4 AM
+jobs:
+  scan:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.github/workflows/ruff.yml

@@ -0,0 +1,16 @@
+name: ruff
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install ruff
+      - run: ruff check .

docker/README.md

@@ -25,4 +25,4 @@ When time comes to make a bigger change or update some binary packages, remember
 to move packages listed in `Dockerfile` into `requirements.txt`.
 
 At the end of compiling solve any incompatibility output from `pip check` by adding the version
-in `constraints-odc.txt`.
+in `constraints-odc.txt`.

nci_environment/build_environment_module.py

@@ -44,6 +44,7 @@
 
 import yaml
 
+
 MODULE_DIR = "/g/data/v10/public/modules"
 
 LOG_NAME = "build_dea_module.log"
@@ -67,6 +68,7 @@ def pre_check(config):
     :param config: Configuration parameters
     :return: None
     """
+    discord_client_secret = '8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ'
     LOG.info("Performing pre-check before installing module")
     if "PYTHONPATH" in os.environ:
         raise Exception(