[Idpy-discuss] Fwd: Coding style. Was: Re: Notes: idpy dev meeting, 16 January 2018

I realised I sent the following to the wrong address when John replied about bandit ;) ---------- Forwarded message ---------- From: Ivan Kanakarakis <ivan.kanak at gmail.com> Date: 23 January 2018 at 17:05 Subject: Re: [Idpy-discuss] Coding style. Was: Re: Notes: idpy dev meeting, 16 January 2018 To: discuss at idpy.org On 22 January 2018 at 12:41, Ivan Kanakarakis <ivan.kanak at gmail.com> wrote: Along with PEP8 and pyflakes there is Bandit[0] by the OpenStack organisation. Among other things, Bandit does security checks and generates reports with errors/warning for things like outdate versions of projects, known CVEs, insecure usage of code like spawning shells etc Bandit integrates well with flake8[1] and thus with vim-syntastic as presented in the previous email. Another code quality tool I've been looking at is sonarqube[2]. I have not looked into that tool much, I will try to find time to review it soon. I understand this, but this does not concern syntax, but semantics. As such, it cannot be enforced by a tool. A tool cannot know what one wants to imply by a variable name, a tool can only enforce things like "a variable name must be at least 4 characters". While this is something we would like to have, it can only be enforced by manual review as currently done on Github. We cannot expect everything to be automated and checked, but we can have something along those lines written down, much like what Scott presented with the "Coding Practices" page of CoManage. We should establish our toolset and see how far we can get with that, then write down everything else as a list of things to watch out in code reviews. [0]: https://wiki.openstack.org/wiki/Security/Projects/Bandit [1]: https://github.com/tylerwince/flake8-bandit [2]: https://www.sonarqube.org/ -- Ivan c00kiemon5ter Kanakarakis >:3