18252174847

Committed 05 Oct 2025 01:36AM UTC coverage: 43.382% (-36.9%) from 80.261%

Build # 18252174847

Build Type

push

github

Committed by

web-flow

Commit Message

run tests on mac arm (#22717)

Just doing the minimal to pull forward the x86_64 pattern.

ref #20993

Run Details

25776 of 59416 relevant lines covered (43.38%)

1.3 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

44.44

/src/python/pants/backend/python/lint/bandit/rules_integration_test.py

# Copyright 2020 Pants project contributors (see CONTRIBUTORS.md).
# Licensed under the Apache License, Version 2.0 (see LICENSE).

from __future__ import annotations

from collections.abc import Sequence
from textwrap import dedent

import pytest

from pants.backend.python import target_types_rules
from pants.backend.python.lint.bandit.rules import BanditRequest
from pants.backend.python.lint.bandit.rules import rules as bandit_rules
from pants.backend.python.lint.bandit.subsystem import BanditFieldSet
from pants.backend.python.lint.bandit.subsystem import rules as bandit_subsystem_rules
from pants.backend.python.target_types import PythonSourcesGeneratorTarget
from pants.backend.python.util_rules.interpreter_constraints import InterpreterConstraints
from pants.core.goals.lint import LintResult, Partitions
from pants.core.util_rules import config_files, source_files
from pants.engine.addresses import Address
from pants.engine.fs import EMPTY_DIGEST, DigestContents
from pants.engine.target import Target
from pants.testutil.python_interpreter_selection import (
    all_major_minor_python_versions,
    has_python_version,
    skip_unless_python310_and_python311_present,
)
from pants.testutil.python_rule_runner import PythonRuleRunner
from pants.testutil.rule_runner import QueryRule
from pants.util.resources import read_sibling_resource


@pytest.fixture
def rule_runner() -> PythonRuleRunner:
    return PythonRuleRunner(
        rules=[
            *bandit_rules(),
            *bandit_subsystem_rules(),
            *source_files.rules(),
            *config_files.rules(),
            *target_types_rules.rules(),
            QueryRule(Partitions, [BanditRequest.PartitionRequest]),
            QueryRule(LintResult, [BanditRequest.Batch]),
        ],
        target_types=[PythonSourcesGeneratorTarget],
    )


GOOD_FILE = "hashlib.sha256()\n"
BAD_FILE = "hashlib.md5()\n"  # An insecure hashing function.


def run_bandit(
    rule_runner: PythonRuleRunner, targets: list[Target], *, extra_args: list[str] | None = None
) -> Sequence[LintResult]:
    rule_runner.set_options(
        [
            "--backend-packages=pants.backend.python.lint.bandit",
            *(extra_args or ()),
        ],
        env_inherit={"PATH", "PYENV_ROOT", "HOME"},
    )
    partitions = rule_runner.request(
        Partitions[BanditFieldSet, InterpreterConstraints],
        [BanditRequest.PartitionRequest(tuple(BanditFieldSet.create(tgt) for tgt in targets))],
    )
    results = []
    for partition in partitions:
        result = rule_runner.request(
            LintResult,
            [BanditRequest.Batch("", partition.elements, partition.metadata)],
        )
        results.append(result)
    return tuple(results)


def assert_success(
    rule_runner: PythonRuleRunner, target: Target, *, extra_args: list[str] | None = None
) -> None:
    result = run_bandit(rule_runner, [target], extra_args=extra_args)
    assert len(result) == 1
    assert result[0].exit_code == 0
    assert "No issues identified." in result[0].stdout.strip()
    assert result[0].report == EMPTY_DIGEST


@pytest.mark.platform_specific_behavior
@pytest.mark.parametrize(
    "major_minor_interpreter",
    all_major_minor_python_versions(["CPython>=3.9,<4"]),
)
def test_passing(rule_runner: PythonRuleRunner, major_minor_interpreter: str) -> None:
    rule_runner.write_files({"f.py": GOOD_FILE, "BUILD": "python_sources(name='t')"})
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    assert_success(
        rule_runner,
        tgt,
        extra_args=[f"--python-interpreter-constraints=['=={major_minor_interpreter}.*']"],
    )


def test_failing(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    result = run_bandit(rule_runner, [tgt])
    assert len(result) == 1
    assert result[0].exit_code == 1
    assert "Issue: [B324:hashlib] Use of weak MD5 hash for security." in result[0].stdout
    assert result[0].report == EMPTY_DIGEST


def test_multiple_targets(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files(
        {"good.py": GOOD_FILE, "bad.py": BAD_FILE, "BUILD": "python_sources(name='t')"}
    )
    tgts = [
        rule_runner.get_target(Address("", target_name="t", relative_file_path="good.py")),
        rule_runner.get_target(Address("", target_name="t", relative_file_path="bad.py")),
    ]
    result = run_bandit(rule_runner, tgts)
    assert len(result) == 1
    assert result[0].exit_code == 1
    assert "good.py" not in result[0].stdout
    assert "Issue: [B324:hashlib] Use of weak MD5 hash for security." in result[0].stdout
    assert result[0].report == EMPTY_DIGEST


@skip_unless_python310_and_python311_present
def test_uses_correct_python_version(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files(
        {
            "f.py": "eg = ExceptionGroup('', [Exception()])'\n",
            "BUILD": dedent(
                """\
                python_sources(name="py310", interpreter_constraints=["==3.10.*"])
                python_sources(name="py311", interpreter_constraints=["==3.11.*"])
                """
            ),
        }
    )

    py310_tgt = rule_runner.get_target(Address("", target_name="py310", relative_file_path="f.py"))
    py310_result = run_bandit(rule_runner, [py310_tgt])
    assert len(py310_result) == 1
    assert py310_result[0].exit_code == 0
    assert "f.py (syntax error while parsing AST from file)" in py310_result[0].stdout

    py311_tgt = rule_runner.get_target(Address("", target_name="py311", relative_file_path="f.py"))
    py311_result = run_bandit(rule_runner, [py311_tgt])
    assert len(py311_result) == 1
    assert py311_result[0].exit_code == 0
    assert "No issues identified." in py311_result[0].stdout

    # Test that we partition incompatible targets when passed in a single batch. We expect Py38
    # to still fail, but Py39 should pass.
    combined_result = run_bandit(rule_runner, [py310_tgt, py311_tgt])
    assert len(combined_result) == 2

    batched_py310_result, batched_py311_result = sorted(
        combined_result, key=lambda result: result.stderr
    )
    assert batched_py310_result.exit_code == 0
    assert batched_py310_result.partition_description == "['CPython==3.10.*']"
    assert "f.py (syntax error while parsing AST from file)" in batched_py310_result.stdout

    assert batched_py311_result.exit_code == 0
    assert batched_py311_result.partition_description == "['CPython==3.11.*']"
    assert "No issues identified." in batched_py311_result.stdout


def test_respects_config_file(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files(
        {
            "f.py": BAD_FILE,
            "BUILD": "python_sources(name='t')",
            ".bandit": "skips: ['B324']",
        }
    )
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    assert_success(rule_runner, tgt, extra_args=["--bandit-config=.bandit"])


def test_respects_passthrough_args(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    assert_success(rule_runner, tgt, extra_args=["--bandit-args='--skip=B324'"])


def test_skip(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    result = run_bandit(rule_runner, [tgt], extra_args=["--bandit-skip"])
    assert not result


@pytest.mark.skipif(not (has_python_version("3.11")), reason="Missing Python 3.11")
def test_3rdparty_plugin(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files(
        {
            "f.py": "aws_key = 'JalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY'\n",
            "BUILD": "python_sources(name='t', interpreter_constraints=['>=3.11,<3.12'])",
            "bandit.lock": read_sibling_resource(__name__, "bandit_plugin_test.lock"),
        }
    )
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    result = run_bandit(
        rule_runner,
        [tgt],
        extra_args=[
            "--python-resolves={'bandit':'bandit.lock'}",
            "--bandit-install-from-resolve=bandit",
        ],
    )
    assert len(result) == 1
    assert result[0].exit_code == 1
    assert "Issue: [C100:hardcoded_aws_key]" in result[0].stdout
    assert result[0].report == EMPTY_DIGEST


def test_report_file(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})
    tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
    result = run_bandit(
        rule_runner, [tgt], extra_args=["--bandit-args='--output=reports/output.txt'"]
    )
    assert len(result) == 1
    assert result[0].exit_code == 1
    assert result[0].stdout.strip() == ""
    report_files = rule_runner.request(DigestContents, [result[0].report])
    assert len(report_files) == 1
    assert (
        "Issue: [B324:hashlib] Use of weak MD5 hash for security."
        in report_files[0].content.decode()
    )


def test_type_stubs(rule_runner: PythonRuleRunner) -> None:
    rule_runner.write_files(
        {
            "f.pyi": BAD_FILE,
            "f.py": GOOD_FILE,
            "BUILD": "python_sources(name='t')",
        }
    )
    tgts = [
        rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py")),
        rule_runner.get_target(Address("", target_name="t", relative_file_path="f.pyi")),
    ]
    result = run_bandit(rule_runner, tgts)
    assert len(result) == 1
    assert result[0].exit_code == 1
    assert "f.py " not in result[0].stdout
    assert "f.pyi" in result[0].stdout
    assert "Issue: [B324:hashlib] Use of weak MD5 hash for security." in result[0].stdout
    assert result[0].report == EMPTY_DIGEST

1	# Copyright 2020 Pants project contributors (see CONTRIBUTORS.md).
2	# Licensed under the Apache License, Version 2.0 (see LICENSE).
3
4	from __future__ import annotations	3✔
5
6	from collections.abc import Sequence	3✔
7	from textwrap import dedent	3✔
8
9	import pytest	3✔
10
11	from pants.backend.python import target_types_rules	3✔
12	from pants.backend.python.lint.bandit.rules import BanditRequest	3✔
13	from pants.backend.python.lint.bandit.rules import rules as bandit_rules	3✔
14	from pants.backend.python.lint.bandit.subsystem import BanditFieldSet	3✔
15	from pants.backend.python.lint.bandit.subsystem import rules as bandit_subsystem_rules	3✔
16	from pants.backend.python.target_types import PythonSourcesGeneratorTarget	3✔
17	from pants.backend.python.util_rules.interpreter_constraints import InterpreterConstraints	3✔
18	from pants.core.goals.lint import LintResult, Partitions	3✔
19	from pants.core.util_rules import config_files, source_files	3✔
20	from pants.engine.addresses import Address	3✔
21	from pants.engine.fs import EMPTY_DIGEST, DigestContents	3✔
22	from pants.engine.target import Target	3✔
23	from pants.testutil.python_interpreter_selection import (	3✔
24	all_major_minor_python_versions,
25	has_python_version,
26	skip_unless_python310_and_python311_present,
27	)
28	from pants.testutil.python_rule_runner import PythonRuleRunner	3✔
29	from pants.testutil.rule_runner import QueryRule	3✔
30	from pants.util.resources import read_sibling_resource	3✔
31
32
33	@pytest.fixture	3✔
34	def rule_runner() -> PythonRuleRunner:	3✔
35	return PythonRuleRunner(	3✔
36	rules=[
37	*bandit_rules(),
38	*bandit_subsystem_rules(),
39	*source_files.rules(),
40	*config_files.rules(),
41	*target_types_rules.rules(),
42	QueryRule(Partitions, [BanditRequest.PartitionRequest]),
43	QueryRule(LintResult, [BanditRequest.Batch]),
44	],
45	target_types=[PythonSourcesGeneratorTarget],
46	)
47
48
49	GOOD_FILE = "hashlib.sha256()\n"	3✔
50	BAD_FILE = "hashlib.md5()\n" # An insecure hashing function.	3✔
51
52
53	def run_bandit(	3✔
54	rule_runner: PythonRuleRunner, targets: list[Target], *, extra_args: list[str] \| None = None
55	) -> Sequence[LintResult]:
56	rule_runner.set_options(	3✔
57	[
58	"--backend-packages=pants.backend.python.lint.bandit",
59	*(extra_args or ()),
60	],
61	env_inherit={"PATH", "PYENV_ROOT", "HOME"},
62	)
63	partitions = rule_runner.request(	3✔
64	Partitions[BanditFieldSet, InterpreterConstraints],
65	[BanditRequest.PartitionRequest(tuple(BanditFieldSet.create(tgt) for tgt in targets))],
66	)
67	results = []	3✔
68	for partition in partitions:	3✔
69	result = rule_runner.request(	3✔
70	LintResult,
71	[BanditRequest.Batch("", partition.elements, partition.metadata)],
72	)
73	results.append(result)	3✔
74	return tuple(results)	3✔
75
76
77	def assert_success(	3✔
78	rule_runner: PythonRuleRunner, target: Target, *, extra_args: list[str] \| None = None
79	) -> None:
80	result = run_bandit(rule_runner, [target], extra_args=extra_args)	3✔
81	assert len(result) == 1	3✔
82	assert result[0].exit_code == 0	3✔
83	assert "No issues identified." in result[0].stdout.strip()	3✔
84	assert result[0].report == EMPTY_DIGEST	3✔
85
86
87	@pytest.mark.platform_specific_behavior	3✔
88	@pytest.mark.parametrize(	3✔
89	"major_minor_interpreter",
90	all_major_minor_python_versions(["CPython>=3.9,<4"]),
91	)
92	def test_passing(rule_runner: PythonRuleRunner, major_minor_interpreter: str) -> None:	3✔
93	rule_runner.write_files({"f.py": GOOD_FILE, "BUILD": "python_sources(name='t')"})	3✔
94	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	3✔
95	assert_success(	3✔
96	rule_runner,
97	tgt,
98	extra_args=[f"--python-interpreter-constraints=['=={major_minor_interpreter}.*']"],
99	)
100
101
102	def test_failing(rule_runner: PythonRuleRunner) -> None:	3✔
103	rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})	×
104	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	×
105	result = run_bandit(rule_runner, [tgt])	×
106	assert len(result) == 1	×
107	assert result[0].exit_code == 1	×
108	assert "Issue: [B324:hashlib] Use of weak MD5 hash for security." in result[0].stdout	×
109	assert result[0].report == EMPTY_DIGEST	×
110
111
112	def test_multiple_targets(rule_runner: PythonRuleRunner) -> None:	3✔
113	rule_runner.write_files(	×
114	{"good.py": GOOD_FILE, "bad.py": BAD_FILE, "BUILD": "python_sources(name='t')"}
115	)
116	tgts = [	×
117	rule_runner.get_target(Address("", target_name="t", relative_file_path="good.py")),
118	rule_runner.get_target(Address("", target_name="t", relative_file_path="bad.py")),
119	]
120	result = run_bandit(rule_runner, tgts)	×
121	assert len(result) == 1	×
122	assert result[0].exit_code == 1	×
123	assert "good.py" not in result[0].stdout	×
124	assert "Issue: [B324:hashlib] Use of weak MD5 hash for security." in result[0].stdout	×
125	assert result[0].report == EMPTY_DIGEST	×
126
127
128	@skip_unless_python310_and_python311_present	3✔
129	def test_uses_correct_python_version(rule_runner: PythonRuleRunner) -> None:	3✔
130	rule_runner.write_files(	×
131	{
132	"f.py": "eg = ExceptionGroup('', [Exception()])'\n",
133	"BUILD": dedent(
134	"""\
135	python_sources(name="py310", interpreter_constraints=["==3.10.*"])
136	python_sources(name="py311", interpreter_constraints=["==3.11.*"])
137	"""
138	),
139	}
140	)
141
142	py310_tgt = rule_runner.get_target(Address("", target_name="py310", relative_file_path="f.py"))	×
143	py310_result = run_bandit(rule_runner, [py310_tgt])	×
144	assert len(py310_result) == 1	×
145	assert py310_result[0].exit_code == 0	×
146	assert "f.py (syntax error while parsing AST from file)" in py310_result[0].stdout	×
147
148	py311_tgt = rule_runner.get_target(Address("", target_name="py311", relative_file_path="f.py"))	×
149	py311_result = run_bandit(rule_runner, [py311_tgt])	×
150	assert len(py311_result) == 1	×
151	assert py311_result[0].exit_code == 0	×
152	assert "No issues identified." in py311_result[0].stdout	×
153
154	# Test that we partition incompatible targets when passed in a single batch. We expect Py38
155	# to still fail, but Py39 should pass.
156	combined_result = run_bandit(rule_runner, [py310_tgt, py311_tgt])	×
157	assert len(combined_result) == 2	×
158
159	batched_py310_result, batched_py311_result = sorted(	×
160	combined_result, key=lambda result: result.stderr
161	)
162	assert batched_py310_result.exit_code == 0	×
163	assert batched_py310_result.partition_description == "['CPython==3.10.*']"	×
164	assert "f.py (syntax error while parsing AST from file)" in batched_py310_result.stdout	×
165
166	assert batched_py311_result.exit_code == 0	×
167	assert batched_py311_result.partition_description == "['CPython==3.11.*']"	×
168	assert "No issues identified." in batched_py311_result.stdout	×
169
170
171	def test_respects_config_file(rule_runner: PythonRuleRunner) -> None:	3✔
172	rule_runner.write_files(	×
173	{
174	"f.py": BAD_FILE,
175	"BUILD": "python_sources(name='t')",
176	".bandit": "skips: ['B324']",
177	}
178	)
179	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	×
180	assert_success(rule_runner, tgt, extra_args=["--bandit-config=.bandit"])	×
181
182
183	def test_respects_passthrough_args(rule_runner: PythonRuleRunner) -> None:	3✔
184	rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})	×
185	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	×
186	assert_success(rule_runner, tgt, extra_args=["--bandit-args='--skip=B324'"])	×
187
188
189	def test_skip(rule_runner: PythonRuleRunner) -> None:	3✔
190	rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})	×
191	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	×
192	result = run_bandit(rule_runner, [tgt], extra_args=["--bandit-skip"])	×
193	assert not result	×
194
195
196	@pytest.mark.skipif(not (has_python_version("3.11")), reason="Missing Python 3.11")	3✔
197	def test_3rdparty_plugin(rule_runner: PythonRuleRunner) -> None:	3✔
198	rule_runner.write_files(	×
199	{
200	"f.py": "aws_key = 'JalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY'\n",
201	"BUILD": "python_sources(name='t', interpreter_constraints=['>=3.11,<3.12'])",
202	"bandit.lock": read_sibling_resource(__name__, "bandit_plugin_test.lock"),
203	}
204	)
205	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	×
206	result = run_bandit(	×
207	rule_runner,
208	[tgt],
209	extra_args=[
210	"--python-resolves={'bandit':'bandit.lock'}",
211	"--bandit-install-from-resolve=bandit",
212	],
213	)
214	assert len(result) == 1	×
215	assert result[0].exit_code == 1	×
216	assert "Issue: [C100:hardcoded_aws_key]" in result[0].stdout	×
217	assert result[0].report == EMPTY_DIGEST	×
218
219
220	def test_report_file(rule_runner: PythonRuleRunner) -> None:	3✔
221	rule_runner.write_files({"f.py": BAD_FILE, "BUILD": "python_sources(name='t')"})	×
222	tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))	×
223	result = run_bandit(	×
224	rule_runner, [tgt], extra_args=["--bandit-args='--output=reports/output.txt'"]
225	)
226	assert len(result) == 1	×
227	assert result[0].exit_code == 1	×
228	assert result[0].stdout.strip() == ""	×
229	report_files = rule_runner.request(DigestContents, [result[0].report])	×
230	assert len(report_files) == 1	×
231	assert (	×
232	"Issue: [B324:hashlib] Use of weak MD5 hash for security."
233	in report_files[0].content.decode()
234	)
235
236
237	def test_type_stubs(rule_runner: PythonRuleRunner) -> None:	3✔
238	rule_runner.write_files(	×
239	{
240	"f.pyi": BAD_FILE,
241	"f.py": GOOD_FILE,
242	"BUILD": "python_sources(name='t')",
243	}
244	)
245	tgts = [	×
246	rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py")),
247	rule_runner.get_target(Address("", target_name="t", relative_file_path="f.pyi")),
248	]
249	result = run_bandit(rule_runner, tgts)	×
250	assert len(result) == 1	×
251	assert result[0].exit_code == 1	×
252	assert "f.py " not in result[0].stdout	×
253	assert "f.pyi" in result[0].stdout	×
254	assert "Issue: [B324:hashlib] Use of weak MD5 hash for security." in result[0].stdout	×
255	assert result[0].report == EMPTY_DIGEST	×

pantsbuild / pants / 18252174847

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous