# Bandit waiver for the plugins.qgis.org upload scan ONLY.
#
# The scanner reads a `.bandit` file from the top level of the plugin ZIP (next
# to metadata.txt) and does not honour inline `# nosec` comments — see
# https://plugins.qgis.org/docs/security-scanning/config-files
#
# It deliberately does NOT live at infrared_city_gis/.bandit in the repo:
# `bandit -r infrared_city_gis/` auto-discovers a .bandit inside the scanned
# tree and applies its skips, which would silently disable B603/B404 in CI too
# — a new unmarked subprocess call would then pass the security job and ship.
# Kept here under a name bandit does not look for, and copied into the ZIP as
# `.bandit` by .github/workflows/release.yml. CI therefore stays strict, and
# every subprocess call still has to justify itself at the call site with
# `# nosec B603 - <reason>`.
#
# B603 - subprocess without shell: utils/deps_bootstrap.py installs the plugin's
#        Python dependencies. Both calls pass a fixed argv list with no shell,
#        the interpreter path is verified by _is_python_interpreter() first, and
#        the package specs come from the bundled requirements.txt. Removing this
#        means vendoring wheels at build time — one wheel set per platform and
#        Python version, which one plugin ZIP cannot carry.
# B404 - the `import subprocess` that the above requires.
[bandit]
skips = B603,B404
exclude_dirs = tests,test,thirdparty
