Public Access
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 devx-ci-bot
|
9408111088 | ||
 emil
|
349057bf5d | ||
|
gitea-actions-bot
|
3b2a278f87 |
@@ -2,6 +2,12 @@
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## [0.55.3] - 2026-09-21
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- Honor repo bandit config in badge quality check
|
||||
|
||||
## [0.55.2] - 2026-09-19
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
@@ -16,12 +16,12 @@ quality badges.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Why devx?
|
||||
|
||||
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.2",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
@@ -101,8 +101,8 @@ pip install -e .
|
||||
```
|
||||
|
||||
> **Note:** If your project requires a specific devx version, pin it in
|
||||
> `dependencies` (for example, `"devx==0.55.2"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.2,<0.56"`).
|
||||
> `dependencies` (for example, `"devx==0.55.3"`) or use a version constraint
|
||||
> (for example, `"devx>=0.55.3,<0.56"`).
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
+8
-8
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
|
||||
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
|
||||
[](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
|
||||
[](https://www.python.org/downloads/)
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.2",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
|
||||
[tool.pip]
|
||||
extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
|
||||
```
|
||||
|
||||
Pin a specific version if needed: `"devx==0.55.2"` or `"devx>=0.55.2,<0.56"`.
|
||||
Pin a specific version if needed: `"devx==0.55.3"` or `"devx>=0.55.3,<0.56"`.
|
||||
|
||||
### Optional extras
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# DEVX-175: Badge generation must honor repo bandit configuration
|
||||
|
||||
## Problem
|
||||
|
||||
`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
|
||||
config file. Repos that declare a `[tool.bandit]` section in
|
||||
`pyproject.toml` (skip lists aligned with infrastructure patterns — for
|
||||
example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
|
||||
quality badge still reports `bandit: FAIL` — a false-FAIL badge that
|
||||
contradicts the actual lint gate.
|
||||
|
||||
## Approach
|
||||
|
||||
REQ-1: When `pyproject.toml` exists in the target repo and contains a
|
||||
`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
|
||||
in `collect_quality()`.
|
||||
|
||||
REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.
|
||||
|
||||
## Test Plan
|
||||
|
||||
- Unit test: repo fixture with `[tool.bandit]` → command includes
|
||||
`-c pyproject.toml`; without the section → plain invocation.
|
||||
- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
|
||||
`bandit: pass`.
|
||||
|
||||
## Deploy Plan
|
||||
|
||||
devx release → repos pick it up on next devx pin bump; no infra changes.
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Revert the commit; badges revert to unconfigured bandit runs.
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [x] REQ-1 implemented with `# Implements: REQ-1` comment
|
||||
- [x] REQ-2 preserved (no config → unchanged command)
|
||||
- [x] Unit tests cover both branches
|
||||
- [x] `make lint-all` + `make pytest-cov` pass in devx
|
||||
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
|
||||
```toml
|
||||
[project]
|
||||
dependencies = [
|
||||
"devx>=0.55.2",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
|
||||
[project.optional-dependencies]
|
||||
dev = [
|
||||
"devx>=0.55.2",
|
||||
"devx>=0.55.3",
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
|
||||
molecule testing helpers for Ansible projects.
|
||||
"""
|
||||
|
||||
__version__ = "0.55.2"
|
||||
__version__ = "0.55.3"
|
||||
|
||||
@@ -346,11 +346,18 @@ def collect_quality(repo_root: Path) -> dict[str, str | int]:
|
||||
results: list[bool] = []
|
||||
tool_names: list[str] = []
|
||||
|
||||
# Implements: REQ-1 (DEVX-175) — honor the repo's [tool.bandit] config so
|
||||
# the badge matches the project's actual lint gate (skip lists etc.).
|
||||
bandit_cmd = [sys.executable, "-m", "bandit", "-r", "src/"]
|
||||
pyproject = repo_root / "pyproject.toml"
|
||||
if pyproject.exists() and "[tool.bandit]" in pyproject.read_text():
|
||||
bandit_cmd += ["-c", "pyproject.toml"]
|
||||
|
||||
for cmd, name in [
|
||||
([sys.executable, "-m", "ruff", "check", "src/", "tests/"], "ruff check"),
|
||||
([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"], "ruff format"),
|
||||
([sys.executable, "-m", "pyright"], "pyright"),
|
||||
([sys.executable, "-m", "bandit", "-r", "src/"], "bandit"),
|
||||
(bandit_cmd, "bandit"),
|
||||
]:
|
||||
rc, _stdout, stderr = run_command(cmd, cwd=repo_root)
|
||||
if rc == 0:
|
||||
|
||||
@@ -365,6 +365,23 @@ class TestCollectQuality:
|
||||
badge = collect_quality(tmp_path)
|
||||
assert badge["message"] == "A"
|
||||
|
||||
@patch("devx.tools.generate_badges.run_command")
|
||||
def test_bandit_uses_repo_config_when_present(self, mock_run: MagicMock, tmp_path: Path) -> None: # type: ignore[no-untyped-def]
|
||||
(tmp_path / "pyproject.toml").write_text("[tool.bandit]\nskips = ['B501']\n")
|
||||
mock_run.return_value = (0, "", "")
|
||||
collect_quality(tmp_path)
|
||||
bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
|
||||
assert "-c" in bandit_call.args[0]
|
||||
assert "pyproject.toml" in bandit_call.args[0]
|
||||
|
||||
@patch("devx.tools.generate_badges.run_command")
|
||||
def test_bandit_plain_invocation_without_repo_config(self, mock_run: MagicMock, tmp_path: Path) -> None: # type: ignore[no-untyped-def]
|
||||
(tmp_path / "pyproject.toml").write_text("[project]\nname = 'x'\n")
|
||||
mock_run.return_value = (0, "", "")
|
||||
collect_quality(tmp_path)
|
||||
bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
|
||||
assert "-c" not in bandit_call.args[0]
|
||||
|
||||
|
||||
class TestGenerateBadges:
|
||||
@patch("devx.tools.generate_badges.collect_quality")
|
||||
|
||||
Reference in New Issue
Block a user