Fix scurity scan - move bandit conf to a deparate file (#500)

.bandit

@@ -0,0 +1,4 @@
+# FILE: .bandit
+[bandit]
+exclude = ./bump-release.py,./build/*,./.venv/*
+skips = B101,B608

.github/workflows/security-scan.yml

@@ -21,13 +21,16 @@ jobs:
         uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install Python
+      - name: Install Python Modules
         run: |
           python -m pip install --upgrade pip
-          pip install -U bandit toml pip-audit setuptools .
+          pip install -U bandit pip-audit setuptools .
+      - name: Install cid-cmd
+        run: |
+          pip install -U .
       - name: Bandit Scan
         run: |
-          bandit -c pyproject.toml -r .
+          bandit -r .
       - name: Pip Audit
         run: |
           pip-audit

cid/common.py

@@ -249,7 +249,7 @@ def load_resources(self):
             resources = {}
             try:
                 if source.startswith('https://'):
-                    resp = requests.get(source)
+                    resp = requests.get(source, timeout=10)
                     assert resp.status_code in [200, 201], f'Error {resp.status_code} while loading url. {resp.text}'
                     resources = yaml.safe_load(resp.text)
                 else:

pyproject.toml

@@ -1,7 +1,3 @@
 [build-system]
 requires = ["setuptools>=42"]
 build-backend = "setuptools.build_meta"
-
-[tool.bandit]
-exclude_dirs = ["./bump-release.py"]
-skips = ["B101","B608"]