microsoft / microsoft/AzureTRE
Add bandit python code checks
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 235
- Forks
- 192
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Description
Describe the solution you'd like
Add Bandit code checks to the PR validation process to ensure the code is secure
Describe alternatives you've considered
Other similar checkers
Additional context
Bandit has been able to highlight multiple issues in the codebase including security issues
I'd suggest skipping the "tests" directories with these tests to avoid noise
I run bandit manually by creating a pyproject.toml file as follows
[tool.bandit]
exclude_dirs = ['api_app/tests_ma','airlock_processor/tests', 'airlock_processor/.venv','resource_processor/tests_rp', 'e2e_tests', 'docs']
bandit -c ./pyproject.toml -r ./
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the repository's PR validation workflow and compare its checks with the proposed Bandit command and pyproject.toml configuration. Confirm the listed test, virtual-environment, end-to-end, and documentation directories are excluded, then verify that Bandit runs successfully as part of PR validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100