enable bandit (#37693)

* enable bandit

* fix the issue with bandit not honoring the prebuilt wheel directory. AdditionalTestarts is what CONTAINS the artifacts directory argument. Not providing it is the reason for this not resolving

* we don't need to install the package to run bandit against the files on disk

---------

Co-authored-by: Scott Beddall <scbedd@microsoft.com>

Author: xiangyan99

eng/pipelines/templates/steps/run_bandit.yml

@@ -2,6 +2,7 @@ parameters:
   ServiceDirectory: ''
   TestMarkArgument: ''
   EnvVars: {}
+  AdditionalTestArgs: ''
 
 # Please use `$(TargetingString)` to refer to the python packages glob string. This variable is set from resolve-package-targeting.yml.
 steps:
@@ -21,5 +22,6 @@ steps:
         --toxenv="bandit"
         --disablecov
         --filter-type="Omit_management"
+        ${{ parameters.AdditionalTestArgs }}
     env: ${{ parameters.EnvVars }}
     condition: and(succeededOrFailed(), ne(variables['Skip.Bandit'],'true'))

eng/tox/tox.ini

@@ -471,11 +471,6 @@ setenv =
 deps =
   {[base]deps}
 commands =
-    python {repository_root}/eng/tox/create_package_and_install.py \
-      -d {envtmpdir} \
-      -p {tox_root} \
-      -w {envtmpdir} \
-      --package-type sdist
     python -m pip freeze
     python {repository_root}/eng/tox/run_bandit.py -t {tox_root}
 

sdk/evaluation/azure-ai-evaluation/pyproject.toml

@@ -3,7 +3,6 @@ mypy = true
 pyright = false
 pylint = true
 black = true
-bandit = false
 verifytypes = false
 
 [tool.isort]

sdk/storage/azure-storage-extensions/pyproject.toml

@@ -9,7 +9,6 @@ verifysdist = false
 verifywhl = false
 sdist = false
 breaking = false
-bandit = false
 # these can be any number of suppressions. note that * present means that ALL warnings will be suppressed for this package
 suppressed_skip_warnings = ["*"]