-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add new step to run Bandit security scan tool
- Loading branch information
1 parent
102be79
commit 8464fac
Showing
9 changed files
with
104 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
parameters: | ||
BuildTargetingString: 'azure-*' | ||
ServiceDirectory: '' | ||
TestMarkArgument: '' | ||
EnvVars: {} | ||
|
||
steps: | ||
- task: PythonScript@0 | ||
displayName: 'Run Bandit' | ||
inputs: | ||
scriptPath: 'scripts/devops_tasks/setup_execute_tests.py' | ||
arguments: >- | ||
"${{ parameters.BuildTargetingString }}" | ||
--mark_arg="${{ parameters.TestMarkArgument }}" | ||
--service="${{ parameters.ServiceDirectory }}" | ||
--toxenv="bandit" | ||
--disablecov | ||
--filter-type="Bandit" | ||
env: ${{ parameters.EnvVars }} | ||
condition: and(succeededOrFailed(), ne(variables['Skip.Bandit'],'true')) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,47 @@ | ||
#!/usr/bin/env python | ||
|
||
# -------------------------------------------------------------------------------------------- | ||
# Copyright (c) Microsoft Corporation. All rights reserved. | ||
# Licensed under the MIT License. See License.txt in the project root for license information. | ||
# -------------------------------------------------------------------------------------------- | ||
|
||
# This script is used to execute bandit within a tox environment. Depending on which package is being executed against, | ||
# a failure may be suppressed. | ||
|
||
from subprocess import check_call, CalledProcessError | ||
import argparse | ||
import os | ||
import logging | ||
import sys | ||
|
||
|
||
logging.getLogger().setLevel(logging.INFO) | ||
|
||
if __name__ == "__main__": | ||
parser = argparse.ArgumentParser(description="Run bandit against target folder.") | ||
|
||
parser.add_argument( | ||
"-t", | ||
"--target", | ||
dest="target_package", | ||
help="The target package directory on disk. The target module passed to bandit will be <target_package>/azure.", | ||
required=True, | ||
) | ||
|
||
args = parser.parse_args() | ||
|
||
package_name = os.path.basename(os.path.abspath(args.target_package)) | ||
try: | ||
check_call( | ||
[ | ||
sys.executable, | ||
"-m", | ||
"bandit", | ||
"-r", | ||
os.path.join(args.target_package, "azure"), | ||
"-ll", | ||
] | ||
) | ||
except CalledProcessError as e: | ||
logging.error("{} exited with error {}".format(package_name, e.returncode)) | ||
exit(1) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters