48 lines
2.0 KiB
Plaintext
48 lines
2.0 KiB
Plaintext
*** Settings ***
|
|
Documentation Integration tests for security scanning via nox
|
|
... Validates that nox -s security_scan runs Bandit, Semgrep, and Vulture
|
|
... with the correct configurations.
|
|
Resource ${CURDIR}/common.resource
|
|
Suite Setup Setup Test Environment
|
|
Suite Teardown Cleanup Test Environment
|
|
|
|
*** Variables ***
|
|
${HELPER_SCRIPT} robot/helper_security_scan.py
|
|
|
|
*** Test Cases ***
|
|
Bandit Config Exists In Pyproject
|
|
[Documentation] Verify bandit configuration section exists in pyproject.toml
|
|
[Tags] security config
|
|
${content}= Get File ${WORKSPACE}/pyproject.toml
|
|
Should Contain ${content} [tool.bandit]
|
|
|
|
Semgrep Config File Exists
|
|
[Documentation] Verify .semgrep.yml exists at project root
|
|
[Tags] security config
|
|
File Should Exist ${WORKSPACE}/.semgrep.yml
|
|
|
|
Semgrep Config Contains Rules
|
|
[Documentation] Verify .semgrep.yml has at least one rule defined
|
|
[Tags] security config
|
|
${content}= Get File ${WORKSPACE}/.semgrep.yml
|
|
Should Contain ${content} rules:
|
|
|
|
Pre-commit Config Has Bandit Hook
|
|
[Documentation] Verify bandit hook is declared in pre-commit config
|
|
[Tags] security precommit
|
|
${content}= Get File ${WORKSPACE}/.pre-commit-config.yaml
|
|
Should Contain ${content} id: bandit
|
|
|
|
Pre-commit Config Has Semgrep Hook
|
|
[Documentation] Verify semgrep hook is declared in pre-commit config
|
|
[Tags] security precommit
|
|
${content}= Get File ${WORKSPACE}/.pre-commit-config.yaml
|
|
Should Contain ${content} id: semgrep-eval-exec
|
|
|
|
Nox Security Scan Session Exists
|
|
[Documentation] Verify security_scan is listed as a nox session
|
|
[Tags] security nox
|
|
${result}= Run Process ${PYTHON} ${HELPER_SCRIPT} verify-session-exists cwd=${WORKSPACE}
|
|
Should Be Equal As Integers ${result.rc} 0
|
|
Should Contain ${result.stdout} security-scan-session-ok
|