Run bandit when verifying changes

It reports only MEDIUM issues or higher like nova [1].
It selects bandit 1.1.0 as defined in nova and neutron lower
constraints [2].

[1] https://github.com/openstack/nova/blob/master/tox.ini#L221
[2] https://github.com/openstack/nova/blob/master/lower-constraints.txt#L8

Change-Id: I6fc505f684701792d3e03659eb0feea8321452c0
Signed-off-by: Cédric Ollivier <cedric.ollivier@orange.com>
(cherry picked from commit 0440ffcac18991395799e5aafc9243e028917ab6)

diff --git a/test-requirements.txt b/test-requirements.txt
index eedefcd..db30c7f 100644 (file)
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -14,3 +14,4 @@ doc8 # Apache-2.0
 bashate # Apache-2.0
 lfdocs-conf
 sphinx-opnfv-theme
+bandit

diff --git a/tox.ini b/tox.ini
index d9bc078..055a53a 100644 (file)
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = docs,pep8,pylint,yamllint,ansiblelint,bashate,py27,perm,cover
+envlist = docs,pep8,pylint,yamllint,ansiblelint,bashate,bandit,py27,perm,cover
 
 [testenv]
 usedevelop = True
@@ -75,6 +75,11 @@ files =
   build.sh
 commands = bashate {[testenv:bashate]files}
 
+
+[testenv:bandit]
+basepython = python2.7
+commands = bandit -r functest -x tests -n 5 -ll -s B601,B602
+
 [testenv:cover]
 basepython = python2.7
 dirs =

diff --git a/upper-constraints.txt b/upper-constraints.txt
index a9a45d7..4c7041b 100644 (file)
--- a/upper-constraints.txt
+++ b/upper-constraints.txt
@@ -20,3 +20,4 @@ networking-bgpvpn===9.0.0
 networking-sfc===7.0.0
 neutron===13.0.2
 os-faults===0.1.18
+bandit===1.1.0