ci: bandit radon coverage

[chrisk314]

Summary

Closes #96 by modifying the CI pipeline and pre-commit hooks with the enhancements listed below.

Uses this Github Action for the Coverage badge in the README.

Changes

• Adds radon and xenon dev dependencies for code quality checks
• Adds mypy and xenon pre-commit hooks for type analysis and code complexity checks respectively
• Adds xenon check to lint and test github workflow for code complexity check
• Modifies Ruff select rules to include the "S" set which contains security related lint checks
• Adds test coverage check with pytest-cov plugin
• Add badges to README for test coverage, licence, pypi version (anticpated), python versions, mypy typing status

[gemini-code-assist]

Hello @chrisk314, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

Summary of Changes

This pull request focuses on enhancing the CI pipeline and pre-commit hooks for improved code quality and security. It introduces several new tools and configurations to achieve this, including radon and xenon for code quality checks, mypy for type analysis, and updates to Ruff for security-related linting. The author, chrisk314, has also included a TODO section for future improvements like test coverage checks and badges in the README.

Highlights

• Code Quality Checks: Introduces radon and xenon as dev dependencies and adds a xenon check to the lint and test workflow to enforce code complexity standards.
• Pre-commit Hooks: Adds mypy and xenon pre-commit hooks to automate type analysis and code complexity checks before committing.
• Security Linting: Modifies Ruff's select rules to include the 'S' set, which contains security-related lint checks, enhancing the project's security posture.
• Dependency Management: Adds pyzmq as a dependency and removes it from the ray extra dependencies, and updates various dependency versions in pyproject.toml and uv.lock.

Changelog

Click here to see the changelog

• .github/workflows/lint-test.yaml
  • Adds a 'Code complexity' job that runs xenon to check for code complexity issues, failing the CI if complexity exceeds configured thresholds.
  • Ensures all checks run even if some fail by using if: always() for mypy, xenon, and pytest jobs.
• .pre-commit-config.yaml
  • Adds mypy pre-commit hook with additional dependencies for type checking.
  • Adds xenon pre-commit hook to check code complexity before commits.
• plugboard/connector/serde_channel.py
  • Adds a # noqa: S301 comment to the pickle.loads call in _deserialise to suppress a security warning from Bandit, acknowledging the inherent risks of using pickle.
• plugboard/utils/random.py
  • Adds a # noqa: S311 comment to the random.choices call in gen_rand_str to suppress a security warning from Bandit, acknowledging the use of a non-cryptographically secure random number generator.
• pyproject.toml
  • Updates the project description to clarify the framework's capabilities.
  • Adds pyzmq as a direct dependency.
  • Moves pyzmq from the ray extra dependencies to the base dependencies.
  • Adds radon and xenon to the dev dependencies.
  • Modifies Ruff's select rules to include security checks ('S').
  • Adds a radon section to configure complexity and maintainability thresholds.
• uv.lock
  • Updates various dependency versions and hashes to reflect changes in pyproject.toml.
  • Adds entries for mando, radon, and xenon.
  • Removes pyzmq from ray extra dependencies.
  • Updates platform markers for click, ipykernel, portalocker, and tqdm to use sys_platform instead of platform_system.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

---

Did you know?

The 'noqa' comment in Python is used to tell linters (like Ruff or Flake8) to ignore a specific line of code. It's a combination of 'no' and 'quality assurance'.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request enhances the CI pipeline and pre-commit hooks with several code quality and security checks. The changes include adding radon and xenon for code quality, mypy for type analysis, and updating Ruff rules for security linting. Overall, this is a good step towards improving the project's code quality and security.

Summary of Findings

• Potential Security Risk with Pickle: The use of pickle.loads without input validation in serde_channel.py poses a security risk, as it can lead to arbitrary code execution if the received data is malicious. While a noqa directive is used to suppress the Bandit warning, it's crucial to address the underlying vulnerability with proper input sanitization or consider using a safer serialization method.
• Insecure Random Number Generator: The use of random.choices in random.py is flagged as potentially insecure by Bandit. While a noqa directive is used to suppress the warning, it's important to evaluate whether the usage context requires a cryptographically secure random number generator. If security is paramount, consider using secrets.choice instead.
• uv.lock changes: The changes to uv.lock are extensive and difficult to review manually. It's important to ensure that these changes are intentional and don't introduce any unintended dependency updates or conflicts. Consider using a tool to verify the integrity and correctness of the lockfile changes.

Merge Readiness

While the pull request introduces valuable code quality and security checks, the potential security risks associated with pickle.loads and random.choices need to be addressed. It's recommended to either implement proper input sanitization or use safer alternatives before merging. Additionally, the extensive changes in uv.lock should be carefully reviewed to ensure no unintended consequences. I am unable to approve this pull request, and other reviewers should carefully consider these points before merging.

[chrisk314]

@toby-coleman this is ready for review. Hopefully the coverage bits are setup correctly... I'm not sure if the coverage svg url is correct. Maybe we need to do more setup of Github Pages first - not sure on that part...

Unfortunately I'm not sure if we can verify the correctness until the pipeline has run on main, so might need a fixup post merge!

[toby-coleman]

Looks good to me - one suggestion on the badges, and you'll need to merge from main to pick up the change I made to smoke test the package wheel file.

Added comments for sec ignores