From fe860f5f5683085292af6dd254ee214293b05873 Mon Sep 17 00:00:00 2001
From: cwhite911 <smortopahri@gmail.com>
Date: Tue, 14 Jul 2026 09:54:36 -0400
Subject: [PATCH] checks: Exclude vendored code from bandit scanning

Bandit scans the vendored ctypesgen copy in
python/libgrass_interface_generator and the vendored PLY copy in
python/grass/temporal/ply, reporting 13 findings (B102, B403, B605,
B307, B602, B607) in code GRASS does not maintain. Exclude both
directories, matching the existing pylint ignore-paths and formatter
extend-exclude entries.
---
 pyproject.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pyproject.toml b/pyproject.toml
index b4a922f7fb5..7950905f39a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -552,6 +552,9 @@ exclude_dirs = [
     "*/tests/*",
     "*/testsuite/*",
     "utils/test_generate_last_commit_file.py",
+    # Vendored code, matching the pylint ignore-paths entries below.
+    "python/grass/temporal/ply",
+    "python/libgrass_interface_generator",
 ]
 skips = ["B324", "B110", "B101", "B112", "B311", "B404", "B603"]