Add integration jobs for Bandit

The Bandit team is hoping to start ensuring we do not break other
projects currently relying on Bandit in their gate jobs. We define a job
template and then utilize that repeatedly with our jobs.

Depends-On: I38bfc2f8298761ebf86152933630f629e545029d
Change-Id: I9c243ce734d7653145d5fa916cc25da5d664603e

jenkins/jobs/bandit.yaml

@@ -0,0 +1,22 @@
+- job-template:
+    name: gate-bandit-integration-{target-project}
+    node: bare-trusty
+
+    builders:
+      - link-logs
+      - shell: |
+          #!/bin/bash -eux
+          cd $WORKSPACE
+
+          /usr/zuul-env/bin/zuul-cloner --cache-dir /opt/git \
+            git://git.openstack.org \
+            openstack/bandit \
+            {target-org}/{target-project}
+
+          cd $WORKSPACE/openstack/bandit
+
+          tox -e integration {target-org} {target-project} \
+            $WORKSPACE/{target-org}/{target-project}
+
+    publishers:
+      - console-log

jenkins/jobs/projects.yaml

@@ -203,6 +203,18 @@
       - python-jobs
       - openstack-publish-jobs
       - pypi-jobs
+      - gate-bandit-integration-{target-project}:
+          target-org: openstack
+          target-project:
+            - barbican
+            - glance
+            - keystone
+            - keystonemiddleware
+            - magnum
+            - oslo.vmware
+            - python-keystoneclient
+            - python-magnumclient
+            - sahara
 
 - project:
     name: barbican

zuul/layout.yaml

@@ -2189,6 +2189,11 @@ jobs:
   - name: gate-tooz-tox-py34-consul
     voting: false
 
+  # NOTE(sigmavirus24): This is presently failing but will be made voting as
+  # soon as sahara updates its configuration or fixes its issues.
+  - name: gate-bandit-integration-sahara
+    voting: false
+
     # Requirements project publishes documents from master only.
   - name: ^(?:gate-)requirements-docs$
     branch: master
@@ -3794,6 +3799,25 @@ projects:
       - name: openstack-server-publish-jobs
       - name: check-requirements
       - name: publish-to-pypi
+    check:
+      - gate-bandit-integration-barbican
+      - gate-bandit-integration-glance
+      - gate-bandit-integration-keystone
+      - gate-bandit-integration-keystonemiddleware
+      - gate-bandit-integration-magnum
+      - gate-bandit-integration-oslo.vmware
+      - gate-bandit-integration-python-keystoneclient
+      - gate-bandit-integration-python-magnumclient
+      - gate-bandit-integration-sahara
+    gate:
+      - gate-bandit-integration-barbican
+      - gate-bandit-integration-glance
+      - gate-bandit-integration-keystone
+      - gate-bandit-integration-keystonemiddleware
+      - gate-bandit-integration-magnum
+      - gate-bandit-integration-oslo.vmware
+      - gate-bandit-integration-python-keystoneclient
+      - gate-bandit-integration-python-magnumclient
 
   - name: openstack/bansho
     template: