[WIP] use bandit.yml as default config file (resolves #318) #458
Conversation
| @@ -23,6 +24,7 @@ | |||
| from bandit.core import utils | |||
|
|
|||
|
|
|||
| BASE_CONFIG = 'bandit.yml' | |||
There was a problem hiding this comment.
This is in disagreement with README file, where name .bandit.yml is used.
There was a problem hiding this comment.
OK, there are two configuration files. One, .bandit is to put command line options. The other, the bandit.yml via -c is for more extensive options.
However this patch is making it even more confusing.
There was a problem hiding this comment.
So this patch will make things even more confusing for users of Bandit. .bandit is intended for command line options so that a user doesn't have to type each time.
The other config via -c is for more extensive options, like customizing the test plugins is a bandit.yml file.
Please don't name them the same, this will make it less obvious the difference between the two.
| @@ -291,7 +290,7 @@ def main(): | |||
| "{relpath:20.20s}: {line:03}: {test_id:^8}: DEFECT: {msg:>20}" | |||
|
|
|||
| See python documentation for more information about formatting style: | |||
| https://docs.python.org/3.4/library/string.html | |||
| https://docs.python.org/3/library/string.html | |||
There was a problem hiding this comment.
This is an unrelated change. Please put in a separate PR.
There was a problem hiding this comment.
I just wanted to make my PR green :P
| @@ -295,26 +295,28 @@ An optional config file may be supplied and may include: | |||
|
|
|||
| Per Project Command Line Args | |||
| ----------------------------- | |||
| Projects may include a `.bandit` file that specifies command line arguments | |||
| Projects may include a `.bandit.yml` file that specifies command line arguments | |||
There was a problem hiding this comment.
my bad, I will make sure that every file mentions the same config filename
| @@ -23,6 +24,7 @@ | |||
| from bandit.core import utils | |||
|
|
|||
|
|
|||
| BASE_CONFIG = 'bandit.yml' | |||
There was a problem hiding this comment.
OK, there are two configuration files. One, .bandit is to put command line options. The other, the bandit.yml via -c is for more extensive options.
However this patch is making it even more confusing.
| @@ -102,8 +102,7 @@ def test_bandit_baseline(self): | |||
| 'benign_two.py'], | |||
| 'expected_return': 0}] | |||
|
|
|||
| baseline_command = ['bandit-baseline', '-c', 'bandit.yaml', '-r', '.', | |||
| '-p', 'test'] | |||
| baseline_command = ['bandit-baseline', '-r', '.', '-p', 'test'] | |||
There was a problem hiding this comment.
baseline tests should test the basic features - or at least that was my guess, so for for YAML that would be default filename
there are other tests for custom named YAML config files
| @@ -83,7 +83,7 @@ def test_bandit_baseline(self): | |||
| git_repo.index.commit('Initial commit') | |||
| os.chdir(repo_directory) | |||
|
|
|||
| with open('bandit.yaml', 'wt') as fd: | |||
| with open('bandit.yml', 'wt') as fd: | |||
There was a problem hiding this comment.
because thats the new default filename and it seems fitting that we should test "default" YAML filename as part of baseline tests
other tests already test of custom provided filename
I will likely change the default filename to .bandit.yml or bandit.yaml (in that add a test case with custom filename) because neither PyCQA or openstack is using bandit.yml - I just took that name from one of the comments from #318 discussion.
|
Thank you for the review. To clear up any I'm still not sure which default filename should be used for YAML, but that is a simple change to make, so it can be done at any time - the combining the two files and simplifing documentation is much more important. I do not plan on proposing here elimination of INI (or any currently existing command line options), just to make sure users which want to use |
rooterkyberian
changed the title
See #318 for reasons for this change.