<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
For someting like sysinv, ideally it would have been in its own repo, but in order to get zuul to run pep8/pylint settings that are different from other python modules in the same repo, we needed to structure the zuul and tox.ini files that way.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This allowed us to gradually increase the strictness of the checks in each component without breaking other zuul checks for other pieces in the same repo.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It also allows us to scope the zuul jobs, so that a change in sysinv does not always run an unrelated zuul check against something else in the same repo (ie: cgtsclient)</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Note:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
There is both a [testest:pep8] section and a [flake8] section in the tox.ini files. which allows a job to have a unified target and the component to have a customized settting.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Likely we would have a <span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">[testest:bandit] which is what the zuul job would run, and a [bandit] section to allow per repo settings
to be adjusted and improved over time.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; background-color: rgb(255, 255, 255); display: inline !important">Al</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Saul Wold <sgw@linux.intel.com><br>
<b>Sent:</b> Tuesday, April 21, 2020 5:28 PM<br>
<b>To:</b> starlingx-discuss@lists.starlingx.io <starlingx-discuss@lists.starlingx.io>; Kumar, Sharath <sharath.kumar@intel.com>; Bailey, Henry Albert (Al) <Al.Bailey@windriver.com><br>
<b>Subject:</b> Adding Bandit to additional repos and packages</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText"><br>
Flock Folks,<br>
<br>
Sorry I missed the Flock meeting this morning, I would like to discuss <br>
this in the community meeting if we have time.<br>
<br>
We are working to add bandit[0] (the python static scanner), running it <br>
over all python. Sharath is starting with adding a general zuul project <br>
template [1] that will be available to all StarlingX repos. An example <br>
of it's usage is in fault [2].<br>
<br>
As Al pointed out in the initial (now abandoned) config review, we are <br>
running bandit in sysinv. I would like to know what the history of <br>
having tox.ini in the lower directories is. As we want to run bandit on <br>
all the python code in config and other repos. Is this something we can <br>
undo and move up?<br>
<br>
Also, are we tracking someplace when we move something to the skip <br>
category? I see that most of the High issues are currently being <br>
skipped. If we are skipping known issues, can we use the baseline <br>
feature somehow to catch potential new issues?<br>
<br>
Thanks<br>
Sau!<br>
<br>
[0] <a href="https://github.com/PyCQA/bandit">https://github.com/PyCQA/bandit</a><br>
[1] <a href="https://review.opendev.org/#/c/721294/">https://review.opendev.org/#/c/721294/</a><br>
[2] <a href="https://review.opendev.org/#/c/721307/">https://review.opendev.org/#/c/721307/</a><br>
</div>
</span></font></div>
</body>
</html>