d765a344ee
Cyborg now does not have a code security check, which may connive at possible security issues. For example, shell-related operations for drivers may be insecure. Current "sudo lspci -nnn -D" in huawei ascend driver code[0] is insecure, but there is no any job/test that can check the potential security issues. So this patch introduces bandit as a code security check. [0]:https://github.com/openstack/cyborg/blob/master/cyborg/accelerator/drivers/aichip/huawei/ascend.py#L69 Change-Id: Ia1f9acbbd176180cb5fe97b1a2eee5f98a95dea6
40 lines
907 B
YAML
40 lines
907 B
YAML
- project:
|
|
templates:
|
|
- openstack-cover-jobs
|
|
- check-requirements
|
|
- release-notes-jobs-python3
|
|
- openstack-python3-ussuri-jobs
|
|
- publish-openstack-docs-pti
|
|
check:
|
|
jobs:
|
|
- cyborg-tempest
|
|
- cyborg-tempest-ipv6-only
|
|
- cyborg-tox-bandit:
|
|
voting: false
|
|
gate:
|
|
jobs:
|
|
- cyborg-tempest
|
|
|
|
- job:
|
|
name: cyborg-tox-bandit
|
|
parent: openstack-tox
|
|
timeout: 2400
|
|
vars:
|
|
tox_envlist: bandit
|
|
required-projects:
|
|
- openstack/requirements
|
|
irrelevant-files: &gate-irrelevant-files
|
|
- ^(test-|)requirements.txt$
|
|
- ^.*\.rst$
|
|
- ^api-ref/.*$
|
|
- ^cyborg/cmd/status\.py$
|
|
- ^cyborg/hacking/.*$
|
|
- ^cyborg/tests/functional.*$
|
|
- ^cyborg/tests/unit.*$
|
|
- ^doc/.*$
|
|
- ^etc/.*$
|
|
- ^releasenotes/.*$
|
|
- ^setup.cfg$
|
|
- ^tools/.*$
|
|
- ^tox.ini$
|