# Python library

## Run static code security analysis
*Available since 1.2*

Run static code analysis using M2A standards with `bandit`.

*Info: `bandit` will be installed manually using the pre-configured version. `pip` **must** be availabe in the context runtime*


### Signature

`python.static_code_sec_analysis(String[] excluded = [])`

*Parameter*

- `excluded` is a list of path to exclude for the analysis. By default, it will ignore `test`, `packer`, `build` and `features`


### Examples

Simple usage:

```groovy
utils.build_notify(currentBuild, 'my-static-analysis', "Static analysis"){
    python.static_code_sec_analysis()
}
```

## Run dependency security vulnerability analysis
*Available since 1.2*

Run dependency analysis for known CVEs using M2A standards with `security`.

*Info: `security` will be installed manually using the pre-configured version. `pip` **must** be availabe in the context runtime*

### Signature

`python.dependency_sec_analysis()`

### Examples

Simple usage using `utils.build_notify`:

```groovy
utils.build_notify(currentBuild, 'my-dependecy-analysis', "Dependency analysis"){
    python.dependency_sec_analysis()
}
```

## Run isolated dependency security vulnerability analysis
*Available since 1.12*

Same check as `dependency_sec_analysis`, but `safety` runs from its own virtualenv in `/tmp/safety-venv` instead of
being installed into the project's environment. The project's installed packages are exported with
`pip list --format=freeze` to `safety/requirements.txt` and scanned from there.

Use this when the project's environment is incompatible with the pinned `safety` version, e.g. setuptools 81+ no
longer ships `pkg_resources`, which `safety` 2.x imports. It also keeps `safety`'s own dependencies out of both the
project's environment and the scan results.

*Info: `python` with the `venv` module and `pip` **must** be available in the context runtime*

### Signature

`python.isolated_dependency_sec_analysis(ArrayList extra_ignored_ids = [])`

*Parameter*

- `extra_ignored_ids` is a list of vulnerability IDs to ignore in addition to the M2A defaults

### Examples

Simple usage using `utils.build_notify`:

```groovy
utils.build_notify(currentBuild, 'my-dependecy-analysis', "Dependency analysis"){
    python.isolated_dependency_sec_analysis()
}
```