Public Access
41 lines
1.3 KiB
Markdown
41 lines
1.3 KiB
Markdown
# DEVX-175: Badge generation must honor repo bandit configuration
|
|
|
|
## Problem
|
|
|
|
`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
|
|
config file. Repos that declare a `[tool.bandit]` section in
|
|
`pyproject.toml` (skip lists aligned with infrastructure patterns — for
|
|
example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
|
|
quality badge still reports `bandit: FAIL` — a false-FAIL badge that
|
|
contradicts the actual lint gate.
|
|
|
|
## Approach
|
|
|
|
REQ-1: When `pyproject.toml` exists in the target repo and contains a
|
|
`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
|
|
in `collect_quality()`.
|
|
|
|
REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.
|
|
|
|
## Test Plan
|
|
|
|
- Unit test: repo fixture with `[tool.bandit]` → command includes
|
|
`-c pyproject.toml`; without the section → plain invocation.
|
|
- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
|
|
`bandit: pass`.
|
|
|
|
## Deploy Plan
|
|
|
|
devx release → repos pick it up on next devx pin bump; no infra changes.
|
|
|
|
## Rollback Plan
|
|
|
|
Revert the commit; badges revert to unconfigured bandit runs.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [x] REQ-1 implemented with `# Implements: REQ-1` comment
|
|
- [x] REQ-2 preserved (no config → unchanged command)
|
|
- [x] Unit tests cover both branches
|
|
- [x] `make lint-all` + `make pytest-cov` pass in devx
|