[Starlingx-discuss] Adding Bandit to additional repos and packages

[Bailey, Henry Albert (Al)]

For someting like sysinv, ideally it would have been in its own repo, but in order to get zuul to run pep8/pylint settings that are different from other python modules in the same repo, we needed to structure the zuul and tox.ini files that way.

This allowed us to gradually increase the strictness of the checks in each component without breaking other zuul checks for other pieces in the same repo.

It also allows us to scope the zuul jobs, so that a change in sysinv does not always run an unrelated zuul check against something else in the same repo (ie: cgtsclient)

Note:
There is both a [testest:pep8] section and a [flake8] section in the tox.ini files. which allows a job to have a unified target and the component to have a customized settting.

Likely we would have a  [testest:bandit] which is what the zuul job would run, and a [bandit] section to allow per repo settings to be adjusted and improved over time.

Al



________________________________
From: Saul Wold <sgw at linux.intel.com>
Sent: Tuesday, April 21, 2020 5:28 PM
To: starlingx-discuss at lists.starlingx.io <starlingx-discuss at lists.starlingx.io>; Kumar, Sharath <sharath.kumar at intel.com>; Bailey, Henry Albert (Al) <Al.Bailey at windriver.com>
Subject: Adding Bandit to additional repos and packages


Flock Folks,

Sorry I missed the Flock meeting this morning, I would like to discuss
this in the community meeting if we have time.

We are working to add bandit[0] (the python static scanner), running it
over all python.  Sharath is starting with adding a general zuul project
template [1] that will be available to all StarlingX repos. An example
of it's usage is in fault [2].

As Al pointed out in the initial (now abandoned) config review, we are
running bandit in sysinv. I would like to know what the history of
having tox.ini in the lower directories is.  As we want to run bandit on
all the python code in config and other repos.  Is this something we can
undo and move up?

Also, are we tracking someplace when we move something to the skip
category? I see that most of the High issues are currently being
skipped.  If we are skipping known issues, can we use the baseline
feature somehow to catch potential new issues?

Thanks
   Sau!

[0] https://github.com/PyCQA/bandit
[1] https://review.opendev.org/#/c/721294/
[2] https://review.opendev.org/#/c/721307/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200422/94abcfa1/attachment.html>