[Starlingx-discuss] Adding Bandit to additional repos and packages
Flock Folks, Sorry I missed the Flock meeting this morning, I would like to discuss this in the community meeting if we have time. We are working to add bandit[0] (the python static scanner), running it over all python. Sharath is starting with adding a general zuul project template [1] that will be available to all StarlingX repos. An example of it's usage is in fault [2]. As Al pointed out in the initial (now abandoned) config review, we are running bandit in sysinv. I would like to know what the history of having tox.ini in the lower directories is. As we want to run bandit on all the python code in config and other repos. Is this something we can undo and move up? Also, are we tracking someplace when we move something to the skip category? I see that most of the High issues are currently being skipped. If we are skipping known issues, can we use the baseline feature somehow to catch potential new issues? Thanks Sau! [0] https://github.com/PyCQA/bandit [1] https://review.opendev.org/#/c/721294/ [2] https://review.opendev.org/#/c/721307/
For someting like sysinv, ideally it would have been in its own repo, but in order to get zuul to run pep8/pylint settings that are different from other python modules in the same repo, we needed to structure the zuul and tox.ini files that way. This allowed us to gradually increase the strictness of the checks in each component without breaking other zuul checks for other pieces in the same repo. It also allows us to scope the zuul jobs, so that a change in sysinv does not always run an unrelated zuul check against something else in the same repo (ie: cgtsclient) Note: There is both a [testest:pep8] section and a [flake8] section in the tox.ini files. which allows a job to have a unified target and the component to have a customized settting. Likely we would have a [testest:bandit] which is what the zuul job would run, and a [bandit] section to allow per repo settings to be adjusted and improved over time. Al ________________________________ From: Saul Wold <sgw@linux.intel.com> Sent: Tuesday, April 21, 2020 5:28 PM To: starlingx-discuss@lists.starlingx.io <starlingx-discuss@lists.starlingx.io>; Kumar, Sharath <sharath.kumar@intel.com>; Bailey, Henry Albert (Al) <Al.Bailey@windriver.com> Subject: Adding Bandit to additional repos and packages Flock Folks, Sorry I missed the Flock meeting this morning, I would like to discuss this in the community meeting if we have time. We are working to add bandit[0] (the python static scanner), running it over all python. Sharath is starting with adding a general zuul project template [1] that will be available to all StarlingX repos. An example of it's usage is in fault [2]. As Al pointed out in the initial (now abandoned) config review, we are running bandit in sysinv. I would like to know what the history of having tox.ini in the lower directories is. As we want to run bandit on all the python code in config and other repos. Is this something we can undo and move up? Also, are we tracking someplace when we move something to the skip category? I see that most of the High issues are currently being skipped. If we are skipping known issues, can we use the baseline feature somehow to catch potential new issues? Thanks Sau! [0] https://github.com/PyCQA/bandit [1] https://review.opendev.org/#/c/721294/ [2] https://review.opendev.org/#/c/721307/
participants (2)
-
Bailey, Henry Albert (Al)
-
Saul Wold