b171490450
This adds the basic framework for registering and using default policy rules. Rules should be defined and returned from a module in heat/policies/, and then added to the list in heat/policies/__init__.py. new policy wrapers `registered_identified_stack` and `registered_policy_enforce` has been added for policy enforcement of registered rules with same parameter as `identified_stack` and `policy_enforce` besides set `is_registered_policy` flag to true. This flag will decide to use new policy framework or not. Now we can use `tox -e genpolicy` to check and generate policy file. Change-Id: I7a232b3ea7ce0f69a5b7ffa278ceace7a76b666f Partially-Implements: bp policy-in-code
110 lines
3.8 KiB
INI
110 lines
3.8 KiB
INI
[tox]
|
|
envlist = py35,py27,pep8
|
|
minversion = 1.6
|
|
skipsdist = True
|
|
|
|
[testenv]
|
|
setenv = VIRTUAL_ENV={envdir}
|
|
PYTHONWARNINGS=default::DeprecationWarning
|
|
OS_TEST_PATH=heat/tests
|
|
TESTR_START_DIR=heat/tests
|
|
usedevelop = True
|
|
install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
|
|
deps = -r{toxinidir}/requirements.txt
|
|
-r{toxinidir}/test-requirements.txt
|
|
commands =
|
|
find {toxinidir} -not -path '{toxinidir}/.tox/*' -name '*.py[c|o]' -delete
|
|
python setup.py testr --slowest --testr-args='{posargs}'
|
|
|
|
whitelist_externals =
|
|
bash
|
|
find
|
|
passenv = http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY
|
|
|
|
[testenv:py27log]
|
|
commands =
|
|
find . -type f -name "*.py[c|o]" -delete
|
|
ostestr '^(?!heat_integrationtests){posargs}'
|
|
|
|
[testenv:pep8]
|
|
commands =
|
|
flake8 heat bin/heat-api bin/heat-api-cfn bin/heat-api-cloudwatch bin/heat-engine bin/heat-manage contrib heat_integrationtests doc/source
|
|
python tools/custom_guidelines.py --exclude heat/engine/resources/aws
|
|
# The following bandit tests are being skipped:
|
|
# B101: Test for use of assert
|
|
# B104: Test for binding to all interfaces
|
|
# B107: Test for use of hard-coded password argument defaults
|
|
# B110: Try, Except, Pass detected.
|
|
# B310: Audit url open for permitted schemes
|
|
# B311: Standard pseudo-random generators are not suitable for security/cryptographic purposes
|
|
# B404: Import of subprocess module
|
|
# B410: Import of lxml module
|
|
# B504: Test for SSL use with no version specified
|
|
# B506: Test for use of yaml load
|
|
# B603: Test for use of subprocess with shell equals true
|
|
# B607: Test for starting a process with a partial path
|
|
bandit -r heat -x tests --skip B101,B104,B107,B110,B310,B311,B404,B410,B504,B506,B603,B607
|
|
|
|
[testenv:venv]
|
|
commands = {posargs}
|
|
|
|
[testenv:cover]
|
|
commands =
|
|
python setup.py testr --coverage --testr-args='^(?!heat_integrationtests){posargs}'
|
|
coverage report
|
|
|
|
[testenv:docs]
|
|
deps = -r{toxinidir}/requirements.txt
|
|
-r{toxinidir}/test-requirements.txt
|
|
sphinxcontrib-httpdomain
|
|
commands = python setup.py build_sphinx
|
|
|
|
[testenv:api-ref]
|
|
# This environment is called from CI scripts to test and publish
|
|
# the API Ref to developer.openstack.org.
|
|
whitelist_externals = bash
|
|
rm
|
|
commands =
|
|
rm -rf api-ref/build
|
|
sphinx-build -W -b html -d api-ref/build/doctrees api-ref/source api-ref/build/html
|
|
|
|
[testenv:genconfig]
|
|
commands =
|
|
oslo-config-generator --config-file=config-generator.conf
|
|
|
|
[testenv:genpolicy]
|
|
commands =
|
|
oslopolicy-sample-generator --config-file etc/heat/heat-policy-generator.conf
|
|
|
|
[testenv:bandit]
|
|
deps = -r{toxinidir}/test-requirements.txt
|
|
# The following bandit tests are being skipped:
|
|
# B101: Test for use of assert
|
|
# B104: Test for binding to all interfaces
|
|
# B107: Test for use of hard-coded password argument defaults
|
|
# B110: Try, Except, Pass detected.
|
|
# B310: Audit url open for permitted schemes
|
|
# B311: Standard pseudo-random generators are not suitable for security/cryptographic purposes
|
|
# B404: Import of subprocess module
|
|
# B410: Import of lxml module
|
|
# B504: Test for SSL use with no version specified
|
|
# B506: Test for use of yaml load
|
|
# B603: Test for use of subprocess with shell equals true
|
|
# B607: Test for starting a process with a partial path
|
|
commands = bandit -r heat -x tests --skip B101,B104,B107,B110,B310,B311,B404,B410,B504,B506,B603,B607
|
|
|
|
[flake8]
|
|
show-source = true
|
|
exclude=.*,dist,*lib/python*,*egg,build,*convergence/scenarios/*
|
|
max-complexity=20
|
|
|
|
[hacking]
|
|
import_exceptions = heat.common.i18n
|
|
local-check-factory = heat.hacking.checks.factory
|
|
|
|
[testenv:debug]
|
|
commands = oslo_debug_helper {posargs}
|
|
|
|
[testenv:releasenotes]
|
|
commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html
|