Skip to content

Update config docs to reflect current as-is behaviour (#528)#1356

Open
doctorlard wants to merge 1 commit intoPyCQA:mainfrom
doctorlard:docs-as-is
Open

Update config docs to reflect current as-is behaviour (#528)#1356
doctorlard wants to merge 1 commit intoPyCQA:mainfrom
doctorlard:docs-as-is

Conversation

@doctorlard
Copy link

@doctorlard doctorlard commented Feb 12, 2026

The configuration tyrefire makes a bit more sense if we document its current behaviour correctly. From my testing, the targets, recursive, configfile, and exclude options don't do anything in TOML/YAML configuration files. The exclude option works from an INI file, and can include directories, but paths need to have a leading slash, similar to the way a .gitignore file works. For some reason the misleadingly-named exclude_dirs, only available in a TOML/YAML file, can also do any paths (including files as well as directories), and do not require leading slashes.

One result of all this is that one can simplify invocation, by just specifying an INI file from the command line:

bandit --ini tox.ini

and have targets = . and recursive = True in the INI file, and a configfile = pyproject.toml (for example) to configure everything else. This however does not work if you try it using the default .bandit INI file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant