Add [flake8].extra_files to allow configuring plugins like Bandit

src/python/pants/backend/python/lint/flake8/rules.py

@@ -14,10 +14,11 @@
 from pants.backend.python.util_rules import pex
 from pants.backend.python.util_rules.interpreter_constraints import InterpreterConstraints
 from pants.backend.python.util_rules.pex import PexRequest, VenvPex, VenvPexProcess
+from pants.base.glob_match_error_behavior import GlobMatchErrorBehavior
 from pants.core.goals.lint import REPORT_DIR, LintResult, LintResults, LintTargetsRequest
 from pants.core.util_rules.config_files import ConfigFiles, ConfigFilesRequest
 from pants.core.util_rules.source_files import SourceFiles, SourceFilesRequest
-from pants.engine.fs import CreateDigest, Digest, Directory, MergeDigests, RemovePrefix
+from pants.engine.fs import CreateDigest, Digest, Directory, MergeDigests, PathGlobs, RemovePrefix
 from pants.engine.process import FallibleProcessResult
 from pants.engine.rules import Get, MultiGet, collect_rules, rule
 from pants.engine.unions import UnionRule
@@ -62,10 +63,22 @@ async def flake8_lint_partition(
     source_files_get = Get(
         SourceFiles, SourceFilesRequest(field_set.source for field_set in partition.field_sets)
     )
+    extra_files_get = Get(
+        Digest,
+        PathGlobs(
+            globs=flake8.extra_files,
+            glob_match_error_behavior=GlobMatchErrorBehavior.error,
+            description_of_origin="the option [flake8].extra_files",
+        ),
+    )
     # Ensure that the empty report dir exists.
     report_directory_digest_get = Get(Digest, CreateDigest([Directory(REPORT_DIR)]))
-    flake8_pex, config_files, report_directory, source_files = await MultiGet(
-        flake8_pex_get, config_files_get, report_directory_digest_get, source_files_get
+    flake8_pex, config_files, report_directory, source_files, extra_files = await MultiGet(
+        flake8_pex_get,
+        config_files_get,
+        report_directory_digest_get,
+        source_files_get,
+        extra_files_get,
     )
 
     input_digest = await Get(
@@ -75,6 +88,7 @@ async def flake8_lint_partition(
                 source_files.snapshot.digest,
                 first_party_plugins.sources_digest,
                 config_files.snapshot.digest,
+                extra_files,
                 report_directory,
             )
         ),

src/python/pants/backend/python/lint/flake8/rules_integration_test.py

@@ -185,21 +185,26 @@ def test_skip(rule_runner: RuleRunner) -> None:
 
 
 def test_3rdparty_plugin(rule_runner: RuleRunner) -> None:
+    # Test extra_files option
     rule_runner.write_files(
-        {"f.py": "'constant' and 'constant2'\n", "BUILD": "python_sources(name='t')"}
+        {
+            "f.py": "assert None == 1\n",
+            ".bandit": 'skips: ["B101"]\n',
+            "BUILD": "python_sources(name='t')",
+        }
     )
     tgt = rule_runner.get_target(Address("", target_name="t", relative_file_path="f.py"))
     result = run_flake8(
         rule_runner,
         [tgt],
         extra_args=[
-            "--flake8-extra-requirements=flake8-pantsbuild>=2.0,<3",
+            "--flake8-extra-requirements=flake8-bandit==3.0.0",
             "--flake8-lockfile=<none>",
+            "--flake8-extra-files=['.bandit']",
         ],
     )
     assert len(result) == 1
-    assert result[0].exit_code == 1
-    assert "f.py:1:1: PB11" in result[0].stdout
+    assert result[0].exit_code == 0
 
 
 def test_report_file(rule_runner: RuleRunner) -> None:

src/python/pants/backend/python/lint/flake8/subsystem.py

@@ -43,6 +43,7 @@
 from pants.option.option_types import (
     ArgsListOption,
     BoolOption,
+    FileListOption,
     FileOption,
     SkipOption,
     TargetListOption,
@@ -94,6 +95,14 @@ class Flake8(PythonToolBase):
             """
         ),
     )
+    extra_files = FileListOption(
+        default=None,
+        advanced=True,
+        help=softwrap(
+            """Paths to extra files to include in the sandbox. This can be useful for Flake8 plugins,
+            like including config files for the `flake8-bandit` plugin."""
+        ),
+    )
     config_discovery = BoolOption(
         default=True,
         advanced=True,