From 0589383b044988092b6eb5adc1cb77ba6d69a162 Mon Sep 17 00:00:00 2001 From: Lukas Holecek Date: Feb 28 2022 08:32:30 +0000 Subject: [PATCH 1/2] Enable GitHub Actions Inspired by GitHub Actions used by Cachito. --- diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..85006f3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,9 @@ +# Please see the documentation for all configuration options: +# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "daily" diff --git a/.github/workflows/gating.yaml b/.github/workflows/gating.yaml new file mode 100644 index 0000000..bd6038f --- /dev/null +++ b/.github/workflows/gating.yaml @@ -0,0 +1,101 @@ +name: Gating + +on: + pull_request: + push: + workflow_dispatch: + inputs: {} + +jobs: + tests: + name: Unit tests + runs-on: ubuntu-latest + strategy: + matrix: + python-version: ["3.10"] + + steps: + - uses: actions/checkout@v1 + + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v2 + with: + python-version: ${{ matrix.python-version }} + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install tox tox-gh-actions + + - name: Test with tox + run: tox -e py + + - name: Run coveralls-python + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + COVERALLS_FLAG_NAME: python-${{ matrix.python-version }} + COVERALLS_PARALLEL: true + run: | + pip3 install --upgrade pip + pip3 install --upgrade setuptools + pip3 install --upgrade coveralls==3.2.0 + coveralls --service=github + + coveralls-finish: + name: Finish coveralls-python + needs: tests + runs-on: ubuntu-latest + steps: + - name: Finished + run: | + pip3 install --upgrade pip + pip3 install --upgrade setuptools + pip3 install --upgrade coveralls + coveralls --finish --service=github + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + linters: + name: Linters + strategy: + matrix: + tox_env: + - bandit + - lint + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v1 + + - name: Set up Python + uses: actions/setup-python@v2 + with: + python-version: "3.10" + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install tox + + - name: Test '${{ matrix.tox_env }}' with tox + run: tox -e ${{ matrix.tox_env }} + + hadolint: + name: Hadolint + runs-on: ubuntu-latest + strategy: + matrix: + dockerfile: + - Dockerfile + + steps: + - uses: actions/checkout@v2 + + - uses: hadolint/hadolint-action@v1.5.0 + with: + dockerfile: ${{ matrix.dockerfile }} + # Ignore list: + # * DL3041 - Specify version with dnf install -y - + ignore: DL3041 + failure-threshold: warning diff --git a/tox.ini b/tox.ini index 2194843..a232175 100644 --- a/tox.ini +++ b/tox.ini @@ -1,5 +1,5 @@ [tox] -envlist = lint,py310,docs +envlist = bandit,lint,py310,docs # If the user is missing an interpreter, don't fail skip_missing_interpreters = True @@ -17,6 +17,13 @@ commands = --cov-config .coveragerc --cov=greenwave --cov-report term \ --cov-report xml --cov-report html {posargs} +[testenv:bandit] +skip_install = true +deps = + bandit +commands = + bandit -r greenwave + [testenv:docs] changedir = docs whitelist_externals = From 0bfa8934613b767dc04c7f2a5fff1f4c45e47d51 Mon Sep 17 00:00:00 2001 From: Lukas Holecek Date: Feb 28 2022 09:03:21 +0000 Subject: [PATCH 2/2] Fix problems reported by Bandit --- diff --git a/conf/settings.py.example b/conf/settings.py.example index 9e5f49e..039602b 100644 --- a/conf/settings.py.example +++ b/conf/settings.py.example @@ -1,5 +1,5 @@ # Copy this file to `conf/settings.py` to put it into effect. It overrides the values defined # in `greenwave/config.py`. -SECRET_KEY = 'replace-me-with-something-random' -HOST = '0.0.0.0' +SECRET_KEY = 'replace-me-with-something-random' # nosec +HOST = '127.0.0.1' PORT = 5005 diff --git a/docker/greenwave-settings.py b/docker/greenwave-settings.py index 067a9e0..30a5f8f 100644 --- a/docker/greenwave-settings.py +++ b/docker/greenwave-settings.py @@ -1,5 +1,5 @@ SECRET_KEY = 'greenwave' -HOST = '0.0.0.0' +HOST = '127.0.0.1' PORT = 8080 DEBUG = True POLICIES_DIR = '/etc/greenwave/policies/' diff --git a/docker/waiverdb-settings.py b/docker/waiverdb-settings.py index 813aa85..04e3fff 100644 --- a/docker/waiverdb-settings.py +++ b/docker/waiverdb-settings.py @@ -5,7 +5,7 @@ DATABASE_URI = 'postgresql+psycopg2://waiverdb:waiverdb@waiverdb-db:5433/waiverd if os.getenv('TEST') == 'true': DATABASE_URI += '_test' -HOST = '0.0.0.0' +HOST = '127.0.0.1' PORT = 5004 #AUTH_METHOD = 'OIDC' AUTH_METHOD = 'dummy' diff --git a/greenwave/api_v1.py b/greenwave/api_v1.py index de09501..33a7ee8 100644 --- a/greenwave/api_v1.py +++ b/greenwave/api_v1.py @@ -1,7 +1,6 @@ # SPDX-License-Identifier: GPL-2.0+ import logging -import random from flask import Blueprint, request, current_app, jsonify, url_for, redirect, Response from werkzeug.exceptions import BadRequest from prometheus_client import generate_latest @@ -430,38 +429,3 @@ def validate_gating_yaml_post(): @api.route('/metrics', methods=['GET']) def metrics(): return Response(generate_latest(registry)) - - -@api.route('/life-decision', methods=['GET']) -@jsonp -def life_decision(): - # Ask a question and Greenwave gives you an advice for your - # life decisions. - data = request.args - if not data or not data.get('question'): - return 'You need to ask me a question. Use the "question" parameter to ask me something' - RESPONSES = [ - 'If you take a step on every stone you find, you\'ll never arrive in Rome.', - 'Keep on doing what you do with passion, and you\'ll never regret it.', - 'Look inside yourself and you\'ll find the answer that you are looking for.', - 'A smile will gain you ten more years of life.', - 'A bird does not sing because it has an answer. It sings because it has a song.', - 'Be not afraid of growing slowly, be afraid only of standing still.', - 'Patience is a bitter plant, but its fruit is sweet.', - 'Whatever you\'ll decide to do, is going to be a success if it is your own decision.', - 'Never regret your own decision, better to follow your heart, than follow a fool.', - 'I see great things in your future.', - 'Why are you asking me, if you already know the answer?', - 'I know you already know the answer.', - 'Whatever will happen, face it with a smile.', - 'I will always be here, ready to reply when you\'ll need me.', - 'Good things will happen to you.', - 'If you fail, try again.', - 'I don\'t understand this questions.', - 'That\'s a good question. Are you really sure you should ask it to me?.', - 'If you want to find out about the road ahead, then ask about it from those coming back.', - 'Small people think they are small, great people never know they are great.', - 'If you are patient in one moment of anger, you will escape a hundred days of sorrow.', - 'Ask Jan Kaluza, he will know it.', - ] - return random.choice(RESPONSES) diff --git a/greenwave/app_factory.py b/greenwave/app_factory.py index ece6206..1a8a98c 100644 --- a/greenwave/app_factory.py +++ b/greenwave/app_factory.py @@ -21,7 +21,7 @@ def create_app(config_obj=None): app = Flask(__name__) app.config.update(load_config(config_obj)) - if app.config['PRODUCTION'] and app.secret_key == 'replace-me-with-something-random': + if app.config['PRODUCTION'] and app.secret_key == 'replace-me-with-something-random': # nosec raise Warning("You need to change the app.secret_key value for production") logging_config = app.config.get('LOGGING') diff --git a/greenwave/config.py b/greenwave/config.py index e09077e..8de0140 100644 --- a/greenwave/config.py +++ b/greenwave/config.py @@ -14,10 +14,10 @@ class Config(object): DEBUG = True # We configure logging explicitly, turn off the Flask-supplied log handler. LOGGER_HANDLER_POLICY = 'never' - HOST = '0.0.0.0' + HOST = '127.0.0.1' PORT = 5005 PRODUCTION = False - SECRET_KEY = 'replace-me-with-something-random' + SECRET_KEY = 'replace-me-with-something-random' # nosec RESULTSDB_API_URL = 'https://taskotron.fedoraproject.org/resultsdb_api/api/v2.0' WAIVERDB_API_URL = 'https://waiverdb.fedoraproject.org/api/v1.0' diff --git a/greenwave/policies.py b/greenwave/policies.py index 4f7bad7..edddf40 100644 --- a/greenwave/policies.py +++ b/greenwave/policies.py @@ -450,7 +450,7 @@ def _summarize_answers_without_errored(answers): if all(answer.is_satisfied for answer in answers): return 'All required tests passed' - assert False, 'Unexpected unsatisfied result' + logging.error('Unexpected unsatisfied result') return 'inexplicable result' diff --git a/greenwave/tests/test_api_v1.py b/greenwave/tests/test_api_v1.py index 3d8192d..92a4b41 100644 --- a/greenwave/tests/test_api_v1.py +++ b/greenwave/tests/test_api_v1.py @@ -223,15 +223,6 @@ def test_make_decision_with_missing_required_gating_yaml(mock_results, mock_waiv mock_waivers.assert_called_once() -def test_life_decision(client): - data = { - 'question': 'Where am I going to be in 5 years?' - } - response = client.get('/api/v1.0/life-decision', json=data) - assert response.status_code == 200 - assert type(response.data.decode("utf-8")) == str - - def test_subject_types(client): response = client.get('/api/v1.0/subject_types') assert response.status_code == 200 diff --git a/greenwave/utils.py b/greenwave/utils.py index af67269..560ee7b 100644 --- a/greenwave/utils.py +++ b/greenwave/utils.py @@ -133,7 +133,7 @@ def sha1_mangle_key(key): Python 3 with str keys (which must be encoded to bytes before passing them to hashlib.sha1()). """ - return hashlib.sha1(key.encode('utf-8')).hexdigest() + return hashlib.sha1(key.encode('utf-8')).hexdigest() # nosec def add_to_timestamp(timestamp, **kwargs): diff --git a/tox.ini b/tox.ini index a232175..a1e2b9e 100644 --- a/tox.ini +++ b/tox.ini @@ -22,7 +22,9 @@ skip_install = true deps = bandit commands = - bandit -r greenwave + bandit \ + --exclude functional-tests,greenwave/tests \ + --recursive greenwave [testenv:docs] changedir = docs