GRM-24: feat: bandit integration (#1)

Co-authored-by: Emil Simeonov <emil@theliberatededge.org>
Reviewed-on: #1

scripts/configure_repo.py

@@ -2,7 +2,7 @@
 """Configure GRM repository: branch protection + labels via Gitea REST API.
 
 Usage:
-  GITEA_ADMIN_TOKEN=<token> python3 scripts/configure_repo.py
+  REPO_TOKEN=<token> python3 scripts/configure_repo.py
 """
 
 import http
@@ -10,6 +10,7 @@ import os
 from typing import cast
 
 import click
+from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
 
 from gitea_runner_manager.api_clients import GiteaClient
 from gitea_runner_manager.config import (
@@ -22,6 +23,8 @@ from gitea_runner_manager.config import (
 from gitea_runner_manager.exceptions import APIError
 from gitea_runner_manager.i18n import _
 
+load_dotenv(override=True)
+
 
 def _handle_http_error(e: APIError) -> None:
     """Raise a user-friendly Click exception for HTTP errors."""
@@ -40,9 +43,9 @@ def _handle_http_error(e: APIError) -> None:
 
 
 def main() -> None:
-    token = os.environ.get("GITEA_ADMIN_TOKEN", "")
+    token = os.environ.get("REPO_TOKEN", "")
     if not token:
-        raise click.ClickException(_("ERROR: GITEA_ADMIN_TOKEN is not set."))
+        raise click.ClickException(_("ERROR: REPO_TOKEN is not set."))
 
     client = GiteaClient(GITEA_API_URL, token, REPO_OWNER, REPO_NAME)
 
@@ -82,4 +85,4 @@ def main() -> None:
 
 
 if __name__ == "__main__":  # pragma: no cover
-    main()
+    main()  # pragma: no cover