TEST-INFRA: [ci-execution-time] Parallelize security scans #2274

New issue

Open

opened 2026-04-03 12:33:30 +00:00 by freemo · 1 comment

freemo commented

2026-04-03 12:33:30 +00:00

Owner

Metadata

Branch: chore/ci-execution-time-parallelize-security-scans
Commit Message: chore(ci): parallelize bandit, semgrep, and vulture in security_scan nox session
Milestone: v3.8.0
Parent Epic: #1678

Background and Context

The security_scan nox session currently runs three static analysis tools — bandit, semgrep, and vulture — sequentially, one after the other. Each tool performs an independent analysis of the codebase and produces its own report; none of them depend on the output of the others. This means the total wall-clock time for the session is the sum of all three tools' runtimes, even though they could safely run in parallel.

On a moderately sized codebase, this sequential execution adds unnecessary latency to every CI run and every local nox -s security_scan invocation. As the codebase grows, this overhead will compound.

Current Behavior

In noxfile.py, the security_scan session invokes bandit, semgrep, and vulture in sequence:

session.run("bandit", ...)
session.run("semgrep", ...)
session.run("vulture", ...)

Each tool must finish before the next one starts, even though they are fully independent.

Expected Behavior

All three tools should be launched concurrently (e.g., via concurrent.futures.ThreadPoolExecutor or Python's subprocess module with parallel execution), and the session should collect and report results from all three. The session should fail if any tool exits with a non-zero status code, preserving the existing fail-fast semantics.

Acceptance Criteria

bandit, semgrep, and vulture are launched in parallel within the security_scan nox session.
The session fails if any one of the three tools reports a non-zero exit code.
All tool output (stdout/stderr) is captured and surfaced to the developer in a readable format.
The total wall-clock time of nox -s security_scan is measurably reduced compared to the sequential baseline on a representative run.
No existing security findings are suppressed or hidden by the parallelization change.
All nox stages continue to pass after the change.
Coverage remains ≥ 97%.

Supporting Information

Parent Epic: #1678 — CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing
Related tools: bandit (SAST), semgrep (SAST/pattern matching), vulture (dead code detection)
The parallelization approach must be compatible with nox's session model and must not require external dependencies beyond the Python standard library.

Subtasks

Audit the current security_scan session in noxfile.py to confirm all three tools are independent
Implement parallel execution of bandit, semgrep, and vulture using concurrent.futures.ThreadPoolExecutor or equivalent
Ensure non-zero exit codes from any tool cause the nox session to fail
Capture and display stdout/stderr from all three tools in a clear, readable format
Tests (Behave): Add/update BDD scenarios covering the parallel security scan session behaviour
Tests (Robot): Add/update integration test asserting all three tools are invoked and results are collected
Verify coverage ≥ 97% via nox -s coverage_report
Run nox (all default sessions), fix any errors

Definition of Done

This issue is complete when:

All subtasks above are completed and checked off.
A Git commit is created where the first line of the commit message matches the Commit Message in Metadata exactly (chore(ci): parallelize bandit, semgrep, and vulture in security_scan nox session), followed by a blank line, then additional lines providing relevant implementation details.
The commit is pushed to the remote on the branch matching the Branch in Metadata exactly (chore/ci-execution-time-parallelize-security-scans).
The commit is submitted as a pull request to master, reviewed, and merged before this issue is marked done.
All nox stages pass.
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

## Metadata - **Branch**: `chore/ci-execution-time-parallelize-security-scans` - **Commit Message**: `chore(ci): parallelize bandit, semgrep, and vulture in security_scan nox session` - **Milestone**: v3.8.0 - **Parent Epic**: #1678 ## Background and Context The `security_scan` nox session currently runs three static analysis tools — `bandit`, `semgrep`, and `vulture` — **sequentially**, one after the other. Each tool performs an independent analysis of the codebase and produces its own report; none of them depend on the output of the others. This means the total wall-clock time for the session is the sum of all three tools' runtimes, even though they could safely run in parallel. On a moderately sized codebase, this sequential execution adds unnecessary latency to every CI run and every local `nox -s security_scan` invocation. As the codebase grows, this overhead will compound. ## Current Behavior In `noxfile.py`, the `security_scan` session invokes `bandit`, `semgrep`, and `vulture` in sequence: ```python session.run("bandit", ...) session.run("semgrep", ...) session.run("vulture", ...) ``` Each tool must finish before the next one starts, even though they are fully independent. ## Expected Behavior All three tools should be launched concurrently (e.g., via `concurrent.futures.ThreadPoolExecutor` or Python's `subprocess` module with parallel execution), and the session should collect and report results from all three. The session should fail if **any** tool exits with a non-zero status code, preserving the existing fail-fast semantics. ## Acceptance Criteria - `bandit`, `semgrep`, and `vulture` are launched in parallel within the `security_scan` nox session. - The session fails if any one of the three tools reports a non-zero exit code. - All tool output (stdout/stderr) is captured and surfaced to the developer in a readable format. - The total wall-clock time of `nox -s security_scan` is measurably reduced compared to the sequential baseline on a representative run. - No existing security findings are suppressed or hidden by the parallelization change. - All nox stages continue to pass after the change. - Coverage remains ≥ 97%. ## Supporting Information - Parent Epic: #1678 — CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing - Related tools: `bandit` (SAST), `semgrep` (SAST/pattern matching), `vulture` (dead code detection) - The parallelization approach must be compatible with nox's session model and must not require external dependencies beyond the Python standard library. ## Subtasks - [ ] Audit the current `security_scan` session in `noxfile.py` to confirm all three tools are independent - [ ] Implement parallel execution of `bandit`, `semgrep`, and `vulture` using `concurrent.futures.ThreadPoolExecutor` or equivalent - [ ] Ensure non-zero exit codes from any tool cause the nox session to fail - [ ] Capture and display stdout/stderr from all three tools in a clear, readable format - [ ] Tests (Behave): Add/update BDD scenarios covering the parallel security scan session behaviour - [ ] Tests (Robot): Add/update integration test asserting all three tools are invoked and results are collected - [ ] Verify coverage ≥ 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done This issue is complete when: - All subtasks above are completed and checked off. - A Git commit is created where the **first line** of the commit message matches the Commit Message in Metadata exactly (`chore(ci): parallelize bandit, semgrep, and vulture in security_scan nox session`), followed by a blank line, then additional lines providing relevant implementation details. - The commit is pushed to the remote on the branch matching the **Branch** in Metadata exactly (`chore/ci-execution-time-parallelize-security-scans`). - The commit is submitted as a **pull request** to `master`, reviewed, and **merged** before this issue is marked done. - All nox stages pass. - Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Test Infrastructure | Agent: ca-new-issue-creator

freemo added this to the v3.8.0 milestone

2026-04-03 12:34:50 +00:00

freemo commented

2026-04-03 12:36:25 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Medium (confirmed)
Milestone: v3.8.0 (confirmed — CI infrastructure)
MoSCoW: Could Have — Parallelizing security scans is a CI performance optimization. Not blocking any deliverables.
Parent Epic: #1678 (confirmed correct)

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Medium (confirmed) - **Milestone**: v3.8.0 (confirmed — CI infrastructure) - **MoSCoW**: Could Have — Parallelizing security scans is a CI performance optimization. Not blocking any deliverables. - **Parent Epic**: #1678 (confirmed correct) --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo added the

MoSCoW

Could have

label

2026-04-03 12:36:27 +00:00

freemo added a new dependency

2026-04-03 12:39:59 +00:00

#1678 Epic: CI Execution Time Optimization — Timeouts, Concurrency, and Coverage Artifact Sharing

freemo referenced this issue

2026-04-03 12:48:31 +00:00

TEST-INFRA: [ci-execution-time] Optimize default nox run #2282

freemo removed the