ci: split linting steps

.github/workflows/tox.yaml

@@ -1,24 +1,49 @@
 name: Run tox
 
 on:
-  - push
-  - pull_request
+  push:
+    paths-ignore:
+      - README.md
+      - .pre-commit-config.yaml
+      - .gitignore
+  pull_request:
+    paths-ignore:
+      - README.md
+      - .pre-commit-config.yaml
+      - .gitignore
 
 jobs:
-  tox:
+
+  lint:
+    name: Linters
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up PDM
+      uses: pdm-project/setup-pdm@v3
+    - name: Install dependencies
+      run: pdm install -d -G lint -G test
+    - name: Run pylint
+      run: pdm run tox -e pylint
+    - name: Run mypy
+      run: pdm run tox -e mypy
+    - name: Run bandit
+      run: pdm run tox -e bandit
+
+  unit-tests:
+    name: Unit tests
+    needs: lint
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ['3.9', '3.10', '3.11']
-
     steps:
     - uses: actions/checkout@v3
     - name: Set up PDM
-      uses: pdm-project/setup-pdm@v2
+      uses: pdm-project/setup-pdm@v3
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
-      run: |
-        pdm install -d -G test -G lint
-    - name: Test with tox
+      run: pdm install -d -G test
+    - name: Run unit tests
       run: pdm run tox

.pre-commit-config.yaml

@@ -11,3 +11,9 @@ repos:
     rev: 23.7.0
     hooks:
       - id: black
+  - repo: https://github.com/PyCQA/bandit
+    rev: '1.7.5'
+    hooks:
+      - id: bandit
+        args: ["-c", "pyproject.toml"]
+        additional_dependencies: ["bandit[toml]"]

README.md

@@ -15,8 +15,8 @@ pip install git+https://github.com/mporrato/operator-repo.git
 
 ### Using the CLI
 
-The CLI tool is called `optool` accepts an optional `--repo` or `-r` argument pointing to the root directory of a
-repository of operators. If one is not provided, the current directory will be used as the repository root.
+The CLI tool is called `optool`. It accepts an optional `--repo` or `-r` argument pointing to the root directory
+of a repository of operators. If one is not provided, the current directory will be used as the repository root.
 
 #### list (or its alias ls)
 
@@ -30,7 +30,7 @@ when listing the contents.
 
 ##### Examples
 
-```commandline
+```text
 $ optool ls etcd
 Operator(etcd)
   Bundle(etcd/0.6.1)
@@ -38,7 +38,8 @@ Operator(etcd)
   Bundle(etcd/0.9.2)
   Bundle(etcd/0.9.4)
 ```
-```commandline
+
+```text
 $ optool -r ~/operator-repo ls etcd/0.9.4
 Bundle(etcd/0.9.4)
   Description     : Create and maintain highly-available etcd clusters on Kubernetes
@@ -60,10 +61,9 @@ If no suite is specified with the `--suite` (`-s`) option, the built-in `operato
 
 The `--list` (`-l`) option can be used to list the checks contained in the selected suite.
 
-
 ##### Examples
 
-```commandline
+```text
 $ optool check --list
 operator checks:
  - upgrade: Validate upgrade graphs for all channels
@@ -72,11 +72,13 @@ bundle checks:
  - operator_name: Check if the operator names used in CSV, metadata and filesystem are consistent
  - semver: Check that the bundle version is semver compliant
 ```
-```commandline
+
+```text
 $ optool check etcd/0.9.4
 failure: check_operator_name(Bundle(etcd/0.9.4)): Operator name from annotations.yaml (etcd) does not match the name defined in the CSV (etcdoperator)
 ```
-```commandline
+
+```text
 $ optool check -R datadog-operator
 failure: check_image(Bundle(datadog-operator/0.1.3)): container image datadog/operator:v0.1.3 not used by any deployment
 failure: check_image(Bundle(datadog-operator/0.3.1)): container image datadog/operator:0.2.0 not used by any deployment

pyproject.toml

@@ -33,6 +33,8 @@ lint = [
     "pylint>=2.13.9",
     "types-PyYAML>=6.0.12.11",
     "mypy>=1.5.1",
+    "bandit[toml]>=1.7.5",
+    "tox-pdm>=0.6.1",
 ]
 
 [tool.pylint.main]
@@ -42,9 +44,11 @@ ignore-patterns = ["^\\.#"]
 no-docstring-rgx = "^(test)?_"
 
 [tool.pylint."messages control"]
-disable = ["raw-checker-failed", "bad-inline-option", "locally-disabled", "file-ignored", "suppressed-message", "useless-suppression", "deprecated-pragma", "use-symbolic-message-instead", "missing-module-docstring"]
-
+disable = ["raw-checker-failed", "bad-inline-option", "locally-disabled", "file-ignored", "suppressed-message", "useless-suppression", "deprecated-pragma", "use-symbolic-message-instead", "missing-module-docstring", "missing-function-docstring"]
 enable = ["c-extension-no-member"]
 
 [tool.pylint.variables]
 ignored-argument-names = "_.*|^ignored_|^unused_"
+
+[tool.bandit]
+exclude_dirs = ["tests", ".tox", ".venv"]

src/operator_repo/__init__.py

@@ -1,3 +1,3 @@
-from .classes import Bundle, Operator, Repo
+from .core import Bundle, Operator, Repo
 
 __all__ = ["Repo", "Operator", "Bundle"]

src/operator_repo/cli.py

@@ -12,7 +12,7 @@ from pathlib import Path
 from typing import Optional, Union
 
 from .checks import get_checks, run_suite
-from .classes import Bundle, Operator, Repo
+from .core import Bundle, Operator, Repo
 from .exceptions import OperatorRepoException
 
 

tox.ini

@@ -1,6 +1,6 @@
 [tox]
-envlist = py{39,310,311,py39}
-isolated_build = True  ; This is required for a pyproject.toml based project.
+envlist = pylint, mypy, bandit, py{39,310,311,py39}
+isolated_build = True
 
 [gh-actions]
 python =
@@ -9,9 +9,26 @@ python =
     3.11: py311
 
 [testenv]
-groups =  ; Dependency groups in pyproject.toml
-    dev
+groups =
+    test
 commands =
     pytest --cov-report term-missing --cov-fail-under=100 --cov=operator_repo -v tests/
-    pylint --disable=missing-module-docstring,missing-function-docstring src
+
+[testenv:pylint]
+groups =
+    lint
+commands =
+    pylint src
+
+[testenv:mypy]
+groups =
+    test
+    lint
+commands =
     mypy --strict src tests
+
+[testenv:bandit]
+groups =
+    lint
+commands =
+    bandit -c pyproject.toml -r .