Add bandit to CI (#87)

* Add bandit to CI

* Create a Travis CI job for bandit

* Cover setup.py with bandit

* Keep consistency in Travis CI jobs

Author: Gallaecio

.travis.yml

@@ -12,7 +12,7 @@ matrix:
     - python: 3.7
       env: TOXENV=py37,stack-scrapy-2.2-py3,stack-scrapy-2.3-py3,stack-scrapy-2.4-py3
     - python: 3.8
-      env: TOXENV=py38,docs,stack-scrapy-2.2-py3,stack-scrapy-2.3-py3,stack-scrapy-2.4-py3
+      env: TOXENV=py38,security,docs,stack-scrapy-2.2-py3,stack-scrapy-2.3-py3,stack-scrapy-2.4-py3
 
 install:
     - pip install -U tox codecov

scrapy_crawlera/utils.py

@@ -11,6 +11,6 @@ def exp_backoff(step, max):
     max_attempts = math.log(max / step, 2)
     for attempt in count(0, 1):
         if attempt <= max_attempts:
-            yield random.uniform(0, step * 2 ** attempt)
+            yield random.uniform(0, step * 2 ** attempt)  # nosec
         else:
-            yield random.uniform(0, max)
+            yield random.uniform(0, max)  # nosec

tox.ini

@@ -1,6 +1,6 @@
 # tox.ini
 [tox]
-envlist = py27,py34,py35,py36,py37,py38,py39,docs
+envlist = py27,py34,py35,py36,py37,py38,py39,docs,security
 
 [testenv]
 deps =
@@ -9,6 +9,12 @@ deps =
 commands =
     py.test --doctest-modules --cov=scrapy_crawlera {posargs:scrapy_crawlera tests}
 
+[testenv:security]
+deps =
+    bandit
+commands =
+    bandit -r {posargs:scrapy_crawlera setup.py}
+
 [testenv:stack-scrapy-1.0]
 basepython = python2.7
 deps =