devx/docs/specs/DEVX-175.md

DEVX-175: Badge generation must honor repo bandit configuration

Problem

collect_quality() in generate_badges.py runs bandit -r src/ with no config file. Repos that declare a [tool.bandit] section in pyproject.toml (skip lists aligned with infrastructure patterns — for example sso-bridge skips B404/B603/B501) lint clean via make lint-all, but the quality badge still reports bandit: FAIL — a false-FAIL badge that contradicts the actual lint gate.

Approach

REQ-1: When pyproject.toml exists in the target repo and contains a [tool.bandit] section, pass -c pyproject.toml to the bandit invocation in collect_quality().

REQ-2: Repos without [tool.bandit] keep the current invocation unchanged.

Test Plan

• Unit test: repo fixture with [tool.bandit] → command includes -c pyproject.toml; without the section → plain invocation.
• Manual: python -m devx.tools.generate_badges in sso-bridge reports bandit: pass.

Deploy Plan

devx release → repos pick it up on next devx pin bump; no infra changes.

Rollback Plan

Revert the commit; badges revert to unconfigured bandit runs.

Acceptance Criteria

• REQ-1 implemented with # Implements: REQ-1 comment
• REQ-2 preserved (no config → unchanged command)
• Unit tests cover both branches
• make lint-all + make pytest-cov pass in devx