e025404e69
This change adds a basic bandit config for Nova. It can be invoked
by running the tox environment for bandit;
tox -e bandit
This is intended as a starting point for using bandit with Nova
and it should be revisited to improve the testing as more is learned
about the specific needs of the Nova code base.
Tox is configured to only show results for high and medium severity
results.
https://wiki.openstack.org/wiki/Security/Projects/Bandit
Change-Id: I3026b81317f0a6322acfc94784899a7453af586f
112 lines
3.8 KiB
INI
112 lines
3.8 KiB
INI
[tox]
|
|
minversion = 1.6
|
|
envlist = py34,py27,functional,pep8,pip-missing-reqs
|
|
skipsdist = True
|
|
|
|
[testenv]
|
|
usedevelop = True
|
|
# tox is silly... these need to be separated by a newline....
|
|
whitelist_externals = bash
|
|
find
|
|
install_command = pip install -U --force-reinstall {opts} {packages}
|
|
setenv = VIRTUAL_ENV={envdir}
|
|
OS_TEST_PATH=./nova/tests/unit
|
|
LANGUAGE=en_US
|
|
LC_ALL=en_US.utf-8
|
|
deps = -r{toxinidir}/requirements.txt
|
|
-r{toxinidir}/test-requirements.txt
|
|
commands =
|
|
find . -type f -name "*.pyc" -delete
|
|
bash tools/pretty_tox.sh '{posargs}'
|
|
passenv = http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY
|
|
# there is also secret magic in pretty_tox.sh which lets you run in a fail only
|
|
# mode. To do this define the TRACE_FAILONLY environmental variable.
|
|
|
|
[tox:jenkins]
|
|
downloadcache = ~/cache/pip
|
|
|
|
[testenv:pep8]
|
|
commands =
|
|
flake8 {posargs}
|
|
|
|
[testenv:py34]
|
|
# NOTE(viktors): we must change default connection string for MySQL because
|
|
# we use a different DB connector (PyMySQL, not MySQLdb) in py3x
|
|
# env. So we should put new DB URLs in the env variable. This
|
|
# will allow to run tests, that require MySQL database,
|
|
# for example DB migration tests.
|
|
setenv =
|
|
{[testenv]setenv}
|
|
OS_TEST_DBAPI_ADMIN_CONNECTION=mysql+pymysql://openstack_citest:openstack_citest@localhost/;postgresql://openstack_citest:openstack_citest@localhost/postgres;sqlite://
|
|
deps = -r{toxinidir}/requirements.txt
|
|
-r{toxinidir}/test-requirements.txt
|
|
commands =
|
|
find . -type f -name "*.pyc" -delete
|
|
python -m testtools.run \
|
|
nova.tests.unit.db.test_db_api \
|
|
nova.tests.unit.test_versions
|
|
|
|
[testenv:functional]
|
|
usedevelop = True
|
|
install_command = pip install -U --force-reinstall {opts} {packages}
|
|
setenv = VIRTUAL_ENV={envdir}
|
|
OS_TEST_PATH=./nova/tests/functional
|
|
LANGUAGE=en_US
|
|
deps = -r{toxinidir}/requirements.txt
|
|
-r{toxinidir}/test-requirements.txt
|
|
commands =
|
|
find . -type f -name "*.pyc" -delete
|
|
bash tools/pretty_tox.sh '{posargs}'
|
|
|
|
[testenv:genconfig]
|
|
commands = oslo-config-generator --config-file=etc/nova/nova-config-generator.conf
|
|
|
|
[testenv:cover]
|
|
# Also do not run test_coverage_ext tests while gathering coverage as those
|
|
# tests conflict with coverage.
|
|
commands =
|
|
coverage erase
|
|
python setup.py testr --coverage \
|
|
--testr-args='{posargs}'
|
|
coverage combine
|
|
coverage html --include='nova/*' --omit='nova/openstack/common/*' -d covhtml -i
|
|
|
|
[testenv:venv]
|
|
commands = {posargs}
|
|
|
|
[testenv:docs]
|
|
commands =
|
|
python setup.py build_sphinx
|
|
bash -c '! find doc/ -type f -name *.json | xargs -t -n1 python -m json.tool 2>&1 > /dev/null | grep -B1 -v ^python'
|
|
|
|
[testenv:bandit]
|
|
deps = -r{toxinidir}/test-requirements.txt
|
|
commands = bandit -c bandit.yaml -r nova -n 5 -ll
|
|
|
|
[flake8]
|
|
# E125 is deliberately excluded. See https://github.com/jcrocholl/pep8/issues/126
|
|
# The rest of the ignores are TODOs
|
|
# New from hacking 0.9: E129, E131, H407, H405
|
|
# E251 Skipped due to https://github.com/jcrocholl/pep8/issues/301
|
|
|
|
ignore = E121,E122,E123,E124,E125,E126,E127,E128,E129,E131,E251,H405
|
|
exclude = .venv,.git,.tox,dist,doc,*openstack/common*,*lib/python*,*egg,build,tools/xenserver*
|
|
# To get a list of functions that are more complex than 25, set max-complexity
|
|
# to 25 and run 'tox -epep8'.
|
|
# 34 is currently the most complex thing we have
|
|
# TODO(jogo): get this number down to 25 or so
|
|
max-complexity=35
|
|
|
|
[hacking]
|
|
local-check-factory = nova.hacking.checks.factory
|
|
import_exceptions = nova.i18n
|
|
|
|
[testenv:pip-missing-reqs]
|
|
# do not install test-requirements as that will pollute the virtualenv for
|
|
# determining missing packages
|
|
# this also means that pip-missing-reqs must be installed separately, outside
|
|
# of the requirements.txt files
|
|
deps = pip_missing_reqs
|
|
-rrequirements.txt
|
|
commands=pip-missing-reqs -d --ignore-file=nova/tests/* --ignore-file=nova/test.py nova
|