Combine static_code_analysis.yml with release_notes.yml (#2337)

.github/workflows/release_notes.yml → .github/workflows/prepare_release.yml

@@ -1,10 +1,10 @@
-name: Release Notes Generator
+name: Release Prep
 
 on:
   workflow_dispatch:
     inputs:
       branch:
-        description: 'Branch to merge release notes into.'
+        description: 'Branch to merge release notes and code analysis into.'
         required: true
         default: 'main'
       version:
@@ -15,7 +15,7 @@ on:
           'Date of the release. Must be in format YYYY-MM-DD.'
 
 jobs:
-  releasenotesgeneration:
+  preparerelease:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -28,6 +28,8 @@ jobs:
         run: |
             python -m pip install --upgrade pip
             python -m pip install requests==2.31.0
+            python -m pip install bandit==1.7.7
+            python -m pip install .[test]
 
       - name: Generate release notes
         env:
@@ -37,16 +39,19 @@ jobs:
             -v ${{ inputs.version }}
             -d ${{ inputs.date }}
 
+      - name: Save static code analysis
+        run: bandit -r . -x ./tests,./scripts,./build -f txt -o static_code_analysis.txt --exit-zero
+
       - name: Create pull request
         id: cpr
         uses: peter-evans/create-pull-request@v4
         with:
           token: ${{ secrets.GH_ACCESS_TOKEN }}
-          commit-message: Release notes for v${{ inputs.version }}
+          commit-message: Prepare release for v${{ inputs.version }}
           author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
           committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          title: v${{ inputs.version }} Release Notes
-          body: "This is an auto-generated PR to update the release notes."
-          branch: release-notes
+          title: v${{ inputs.version }} Release Preparation
+          body: "This is an auto-generated PR to prepare the release."
+          branch: prepared-release
           branch-suffix: short-commit-hash
           base: ${{ inputs.branch }}