6791788e31
The plan is to add Bandit to the commit gate. Bandit is
produced by the OpenStack security team to do static code
analysis for security implementation failures. It tests
the code base for ~30 common security problems in Python
with more to come. The bandit.yaml configuration file
is set to the value recommended by the Bandit team.
run with:
tox -e bandit
Change-Id: I46cde803119d0162b6256346e423079cadac17cb
Partially-Implements: blueprint gate-bandit
62 lines
1.6 KiB
INI
62 lines
1.6 KiB
INI
[tox]
|
|
envlist = pep8,py27,docs
|
|
|
|
[testenv]
|
|
install_command = pip install -U {opts} {packages}
|
|
deps = -r{toxinidir}/requirements.txt
|
|
-r{toxinidir}/test-requirements.txt
|
|
|
|
commands =
|
|
python setup.py testr --coverage --testr-args='{posargs}'
|
|
coverage combine
|
|
coverage report -m
|
|
|
|
[testenv:cover]
|
|
deps =
|
|
{[testenv]deps}
|
|
diff_cover
|
|
commands =
|
|
python setup.py testr --coverage --testr-args='{posargs}'
|
|
coverage combine
|
|
coverage xml
|
|
diff-cover --fail-under 100 coverage.xml
|
|
|
|
[testenv:pep8]
|
|
sitepackages = False
|
|
commands = flake8 {posargs}
|
|
|
|
[testenv:venv]
|
|
commands = {posargs}
|
|
|
|
[testenv:py3pep8]
|
|
# This hack is in place to allow us to run py3 based flake8
|
|
# without installing barbican.
|
|
basepython = python3
|
|
install_command = /bin/echo {packages}
|
|
commands =
|
|
pip install "hacking>=0.10.0,<0.11"
|
|
flake8 barbican setup.py
|
|
|
|
[testenv:docs]
|
|
envdir = {toxworkdir}/venv
|
|
commands=
|
|
python setup.py build_sphinx
|
|
|
|
[testenv:functional]
|
|
# This tox env is purely to make local test development easier
|
|
# Note: This requires local running instances of Barbican and Keystone
|
|
deps =
|
|
{[testenv]deps}
|
|
nose
|
|
commands = nosetests -v --processes=-1 --process-timeout=240 {toxinidir}/functionaltests {posargs}
|
|
|
|
[flake8]
|
|
# E711 ignored because of sqlalchemy override of == None
|
|
ignore = E711
|
|
exclude = .git,.idea,.tox,bin,dist,debian,rpmbuild,tools,*.egg-info,*.eggs,*openstack/common,contrib,
|
|
functionaltests,*alembic_migrations/versions,*docs/target,*.egg
|
|
|
|
[testenv:bandit]
|
|
deps = -r{toxinidir}/test-requirements-bandit.txt
|
|
commands = bandit -c bandit.yaml -r barbican functionaltests -n5 -p barbican_conservative
|