add resource permission checks #2724

	name: Bandit

	on:
	workflow_dispatch:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main
	- v2m*

	permissions:
	contents: read

	jobs:
	bandit:
	strategy:
	matrix:
	python-version: [3.9]
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v4
	with:
	python-version: ${{ matrix.python-version }}
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	python -m pip install typing-extensions
	python -m pip install bandit
	- name: Bandit
	run: bandit -r -lll -ii .

Provide feedback