From 01d6c209e81e0b954e58811167285ab264de079c Mon Sep 17 00:00:00 2001 From: =?utf8?q?C=C3=A9dric=20Ollivier?= Date: Sat, 25 May 2019 11:10:55 +0200 Subject: [PATCH] Run bandit when verifying changes MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit It reports only MEDIUM issues or higher like nova [1]. It selects bandit 1.1.0 as defined in nova and neutron lower constraints [2]. [1] https://github.com/openstack/nova/blob/master/tox.ini#L221 [2] https://github.com/openstack/nova/blob/master/lower-constraints.txt#L8 Change-Id: I6fc505f684701792d3e03659eb0feea8321452c0 Signed-off-by: Cédric Ollivier (cherry picked from commit 0440ffcac18991395799e5aafc9243e028917ab6) --- test-requirements.txt | 1 + tox.ini | 7 ++++++- upper-constraints.txt | 1 + 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/test-requirements.txt b/test-requirements.txt index eedefcd43..db30c7f85 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -14,3 +14,4 @@ doc8 # Apache-2.0 bashate # Apache-2.0 lfdocs-conf sphinx-opnfv-theme +bandit diff --git a/tox.ini b/tox.ini index 687f4e7f5..7d182a47f 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = docs,pep8,pylint,yamllint,ansiblelint,bashate,py27,perm,cover +envlist = docs,pep8,pylint,yamllint,ansiblelint,bashate,bandit,py27,perm,cover [testenv] usedevelop = True @@ -75,6 +75,11 @@ files = build.sh commands = bashate {[testenv:bashate]files} + +[testenv:bandit] +basepython = python2.7 +commands = bandit -r functest -x tests -n 5 -ll -s B601,B602 + [testenv:cover] basepython = python2.7 dirs = diff --git a/upper-constraints.txt b/upper-constraints.txt index f55508bec..5b303d440 100644 --- a/upper-constraints.txt +++ b/upper-constraints.txt @@ -20,3 +20,4 @@ git+https://git.openstack.org/openstack/networking-bgpvpn@10.0.0#egg=networking_ git+https://git.openstack.org/openstack/networking-sfc@8.0.0#egg=networking_sfc neutron===14.0.1 os-faults===0.2.1 +bandit===1.1.0 -- 2.16.6