TEST-INFRA: [ci-execution-time] Parallelize security scan #1874

New issue

Open

opened 2026-04-03 00:03:31 +00:00 by freemo · 1 comment

freemo commented

2026-04-03 00:03:31 +00:00

Owner

Metadata

Branch: chore/ci-parallelize-security-scan
Commit Message: chore(ci): parallelize bandit, semgrep, and vulture in security_scan nox session
Milestone: v3.8.0
Parent Epic: #1678

Background and Context

The security_scan nox session runs multiple security tools sequentially: bandit, semgrep, and vulture. While each of these tools is relatively fast, their combined execution time can be significant, especially on large codebases. This contributes to unnecessary CI wall-clock time, which this Epic (#1678) is tracking and addressing.

Current Behavior

The security_scan nox session invokes bandit, semgrep, and vulture one after another in a single sequential process. Each tool must complete before the next one starts, even though they are fully independent of one another.

Expected Behavior

All three tools (bandit, semgrep, vulture) should run concurrently in separate subprocesses. The session should wait for all of them to complete and fail if any individual tool exits with a non-zero exit code.

Acceptance Criteria

The security_scan nox session launches bandit, semgrep, and vulture as parallel subprocesses.
If any tool exits with a non-zero code, the session is marked as failed.
The security scan output (findings, warnings) is the same as when tools are run sequentially.
The overall wall-clock time of the security_scan session is measurably reduced.
All existing nox sessions continue to pass.
Coverage remains ≥ 97%.

Supporting Information

Parent Epic: #1678 — CI Execution Time Optimization
Focus Area: ci-execution-time
Supervisor: Test Infrastructure | Agent: ca-test-infra-improver

Subtasks

Modify the security_scan nox session in noxfile.py to run bandit, semgrep, and vulture in parallel using subprocess (e.g., subprocess.Popen + wait()).
Ensure that the exit codes of all parallel processes are collected and that the session fails if any tool returns a non-zero exit code.
Update or add BDD scenarios in the relevant feature file to assert that the security scan runs tools in parallel.
Run nox (all default sessions) and fix any errors.
Verify coverage ≥ 97% via nox -s coverage_report.

Definition of Done

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly.
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `chore/ci-parallelize-security-scan` - **Commit Message**: `chore(ci): parallelize bandit, semgrep, and vulture in security_scan nox session` - **Milestone**: v3.8.0 - **Parent Epic**: #1678 ## Background and Context The `security_scan` nox session runs multiple security tools sequentially: `bandit`, `semgrep`, and `vulture`. While each of these tools is relatively fast, their combined execution time can be significant, especially on large codebases. This contributes to unnecessary CI wall-clock time, which this Epic (#1678) is tracking and addressing. ## Current Behavior The `security_scan` nox session invokes `bandit`, `semgrep`, and `vulture` one after another in a single sequential process. Each tool must complete before the next one starts, even though they are fully independent of one another. ## Expected Behavior All three tools (`bandit`, `semgrep`, `vulture`) should run concurrently in separate subprocesses. The session should wait for all of them to complete and fail if any individual tool exits with a non-zero exit code. ## Acceptance Criteria - The `security_scan` nox session launches `bandit`, `semgrep`, and `vulture` as parallel subprocesses. - If any tool exits with a non-zero code, the session is marked as failed. - The security scan output (findings, warnings) is the same as when tools are run sequentially. - The overall wall-clock time of the `security_scan` session is measurably reduced. - All existing nox sessions continue to pass. - Coverage remains ≥ 97%. ## Supporting Information - Parent Epic: #1678 — CI Execution Time Optimization - Focus Area: `ci-execution-time` - Supervisor: Test Infrastructure | Agent: ca-test-infra-improver ## Subtasks - [ ] Modify the `security_scan` nox session in `noxfile.py` to run `bandit`, `semgrep`, and `vulture` in parallel using `subprocess` (e.g., `subprocess.Popen` + `wait()`). - [ ] Ensure that the exit codes of all parallel processes are collected and that the session fails if any tool returns a non-zero exit code. - [ ] Update or add BDD scenarios in the relevant feature file to assert that the security scan runs tools in parallel. - [ ] Run `nox` (all default sessions) and fix any errors. - [ ] Verify coverage ≥ 97% via `nox -s coverage_report`. ## Definition of Done - [ ] All subtasks above are completed and checked off. - [ ] A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly, followed by a blank line, then additional lines providing relevant details about the implementation. - [ ] The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly. - [ ] The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.8.0 milestone

2026-04-03 00:03:40 +00:00

freemo added a new dependency

2026-04-03 00:08:32 +00:00

#1678 Epic: CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing

freemo commented

2026-04-03 00:12:53 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
MoSCoW: MoSCoW/Could Have — CI/test infrastructure improvement.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **MoSCoW**: MoSCoW/Could Have — CI/test infrastructure improvement. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo added the

MoSCoW

Could have

label

2026-04-03 00:12:54 +00:00