DEVX-175: fix: honor repo bandit config in badge quality check

Co-authored-by: emil User <emil.simeonov@tutanota.com>

docs/specs/DEVX-175.md

@@ -0,0 +1,40 @@
+# DEVX-175: Badge generation must honor repo bandit configuration
+
+## Problem
+
+`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
+config file. Repos that declare a `[tool.bandit]` section in
+`pyproject.toml` (skip lists aligned with infrastructure patterns — for
+example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
+quality badge still reports `bandit: FAIL` — a false-FAIL badge that
+contradicts the actual lint gate.
+
+## Approach
+
+REQ-1: When `pyproject.toml` exists in the target repo and contains a
+`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
+in `collect_quality()`.
+
+REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.
+
+## Test Plan
+
+- Unit test: repo fixture with `[tool.bandit]` → command includes
+  `-c pyproject.toml`; without the section → plain invocation.
+- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
+  `bandit: pass`.
+
+## Deploy Plan
+
+devx release → repos pick it up on next devx pin bump; no infra changes.
+
+## Rollback Plan
+
+Revert the commit; badges revert to unconfigured bandit runs.
+
+## Acceptance Criteria
+
+- [x] REQ-1 implemented with `# Implements: REQ-1` comment
+- [x] REQ-2 preserved (no config → unchanged command)
+- [x] Unit tests cover both branches
+- [x] `make lint-all` + `make pytest-cov` pass in devx

src/devx/tools/generate_badges.py

@@ -346,11 +346,18 @@ def collect_quality(repo_root: Path) -> dict[str, str | int]:
     results: list[bool] = []
     tool_names: list[str] = []
 
+    # Implements: REQ-1 (DEVX-175) — honor the repo's [tool.bandit] config so
+    # the badge matches the project's actual lint gate (skip lists etc.).
+    bandit_cmd = [sys.executable, "-m", "bandit", "-r", "src/"]
+    pyproject = repo_root / "pyproject.toml"
+    if pyproject.exists() and "[tool.bandit]" in pyproject.read_text():
+        bandit_cmd += ["-c", "pyproject.toml"]
+
     for cmd, name in [
         ([sys.executable, "-m", "ruff", "check", "src/", "tests/"], "ruff check"),
         ([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"], "ruff format"),
         ([sys.executable, "-m", "pyright"], "pyright"),
-        ([sys.executable, "-m", "bandit", "-r", "src/"], "bandit"),
+        (bandit_cmd, "bandit"),
     ]:
         rc, _stdout, stderr = run_command(cmd, cwd=repo_root)
         if rc == 0:

tests/unit/test_generate_badges.py

@@ -365,6 +365,23 @@ class TestCollectQuality:
         badge = collect_quality(tmp_path)
         assert badge["message"] == "A"
 
+    @patch("devx.tools.generate_badges.run_command")
+    def test_bandit_uses_repo_config_when_present(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "pyproject.toml").write_text("[tool.bandit]\nskips = ['B501']\n")
+        mock_run.return_value = (0, "", "")
+        collect_quality(tmp_path)
+        bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
+        assert "-c" in bandit_call.args[0]
+        assert "pyproject.toml" in bandit_call.args[0]
+
+    @patch("devx.tools.generate_badges.run_command")
+    def test_bandit_plain_invocation_without_repo_config(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "pyproject.toml").write_text("[project]\nname = 'x'\n")
+        mock_run.return_value = (0, "", "")
+        collect_quality(tmp_path)
+        bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
+        assert "-c" not in bandit_call.args[0]
+
 
 class TestGenerateBadges:
     @patch("devx.tools.generate_badges.collect_quality")