Enable -flto and -fsanitize=cfi in clang #9067

	# Runs bandit security checker for code written in Python.
	name: Bandit

	on: [push, pull_request, workflow_dispatch]

	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.run_id }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	bandit:
	name: Bandit
	strategy:
	matrix:
	os: [ubuntu-latest, windows-latest]
	runs-on: ${{matrix.os}}

	steps:
	- name: Clone the git repo
	uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

	- name: Install pip packages
	run: pip install -r third_party/requirements.txt

	# Scan all files, except for dev. scripts
	- name: Run Bandit
	run: bandit -r . -x ./scripts/

Provide feedback