ci: move Bandit config to pyproject.toml

Author: Molkree

.pre-commit-config.yaml

@@ -39,7 +39,8 @@ repos:
     hooks:
       - id: bandit
         exclude: ^fuzz/generated/
-        args: ["-c", "bandit.conf"]
+        args: ["-c", "pyproject.toml"]
+        additional_dependencies: [ "bandit[toml]" ]
 
   - repo: https://github.com/jorisroovers/gitlint
     rev: v0.19.1

CONTRIBUTING.md

@@ -258,18 +258,18 @@ specify a whole folder using ```./```
 
 ### Running bandit by itself
 
-We have a configuration file for bandit called `bandit.conf` that you should use.  This disables a few of the checkers.
+We have configuration section for Bandit in our `pyproject.toml`.  This disables a few of the checkers.
 
 To run it on all the code we scan, use the following:
 
 ```bash
-bandit -c bandit.conf -r cve_bin_tool/ test/
+bandit -c pyproject.toml -r cve_bin_tool/ test/
 ```
 
 You can also run it on individual files:
 
 ```bash
-bandit -c bandit.conf filename.py
+bandit -c pyproject.toml filename.py
 ```
 
 If you run it without the config file, it will run a few extra checkers, so you'll get additional warnings.

bandit.conf

@@ -115,6 +115,12 @@ version = { attr = "cve_bin_tool.version.VERSION" }
 "sbom" = ["*.spdx", "*.json"]
 "mismatch" = ["*.py"]
 
+[tool.bandit]
+skips = ["B603", "B607", "B404"]
+
+[tool.bandit.assert_used]
+skips = ["*/test_*.py"]
+
 [tool.coverage.run]
 source = ["cve_bin_tool", "test"]
 branch = true

pyproject.toml

@@ -0,0 +1,4 @@
+raise OSError(
+    "Python no longer provides security updates for version 3.7 as of June 2023. "
+    "Please upgrade to python 3.8+ to use CVE Binary Tool."
+)