[Starlingx-discuss] Adding Bandit to additional repos and packages

[Saul Wold]

Flock Folks,

Sorry I missed the Flock meeting this morning, I would like to discuss 
this in the community meeting if we have time.

We are working to add bandit[0] (the python static scanner), running it 
over all python.  Sharath is starting with adding a general zuul project 
template [1] that will be available to all StarlingX repos. An example 
of it's usage is in fault [2].

As Al pointed out in the initial (now abandoned) config review, we are 
running bandit in sysinv. I would like to know what the history of 
having tox.ini in the lower directories is.  As we want to run bandit on 
all the python code in config and other repos.  Is this something we can 
undo and move up?

Also, are we tracking someplace when we move something to the skip 
category? I see that most of the High issues are currently being 
skipped.  If we are skipping known issues, can we use the baseline 
feature somehow to catch potential new issues?

Thanks
   Sau!

[0] https://github.com/PyCQA/bandit
[1] https://review.opendev.org/#/c/721294/
[2] https://review.opendev.org/#/c/721307/