feat: configure hypothesis fuzzing and bandit security scanning by eman · Pull Request #72 · eman/nwp500-python

eman · 2026-02-07T07:26:30Z

Summary

This PR adds comprehensive security and fuzzing capabilities to the nwp500-python project:

Property-based testing: Added hypothesis fuzzing tests for DeviceStatus model validation
Security scanning: Configured bandit security linting in CI/CD pipeline
Enhanced test coverage: Property-based tests that validate temperature conversions, unit switching, and data parsing across various input combinations

Changes Made

Testing Infrastructure

Added hypothesis to testing requirements in setup.cfg
Created tests/test_mqtt_hypothesis.py with property-based fuzz tests for:
- DeviceStatus model validation with varying temperature types (Celsius/Fahrenheit)
- Temperature conversion accuracy (HalfCelsius, DeciCelsius)
- Flow rate conversions between metric and imperial units
- Edge case handling for boundary values

Security Enhancements

Added bandit environment to tox.ini for security linting
Added dedicated security job to GitHub Actions workflow
Configured bandit to scan for common security vulnerabilities

Code Quality

All linting issues resolved (ruff formatting, import sorting, line length)
Comprehensive test coverage with both traditional and property-based tests
All tests pass locally and in CI

Testing

Property-based tests use Hypothesis to generate comprehensive test data
Tests validate temperature conversions, unit switching, and data parsing
Security scanning passes with no high-severity issues
Full test suite passes (403 passed, 3 skipped)

Breaking Changes

None. This is a purely additive feature that enhances security and test coverage.

- Add hypothesis to testing requirements in setup.cfg - Add property-based fuzz tests for DeviceStatus model in tests/test_mqtt_hypothesis.py - Add bandit environment to tox.ini for security linting - Add security job to GitHub Actions workflow to run bandit

- Fix import sorting and remove duplicate imports - Fix line length violations (>80 characters) - Remove trailing whitespace and blank line whitespace - Ensure proper code formatting for CI compliance

- Fix line length violations in comments (>80 characters) - Ensure all ruff linting checks pass - All tests continue to pass locally

- Add .bandit configuration file to skip B101 (assert_used) warnings - Update tox.ini bandit environment to use configuration file - Security check now passes while maintaining security scanning for actual vulnerabilities - Assert statements in CLI rich output are low-severity and acceptable for this use case

Copilot

Pull request overview

This PR adds property-based fuzz testing with Hypothesis and introduces Bandit security scanning via tox and GitHub Actions to improve test robustness and CI security checks.

Changes:

Added Hypothesis as a testing dependency and introduced a new property-based fuzz test suite for DeviceStatus.
Added a bandit tox environment and a dedicated CI job to run security scanning.
Added a .bandit configuration file to control Bandit rule behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`tox.ini`	Adds a `bandit` tox env and includes it in the envlist for security scanning.
`tests/test_mqtt_hypothesis.py`	Adds Hypothesis-based fuzz tests validating `DeviceStatus` parsing and unit conversions.
`setup.cfg`	Adds `hypothesis` under testing extras.
`.github/workflows/ci.yml`	Adds a separate CI job to run `tox -e bandit`.
`.bandit`	Configures Bandit skips (currently B101).

tests/test_mqtt_hypothesis.py

.bandit

- Fix flow rate test to use lenient tolerance (abs=0.01) instead of manual rounding This avoids brittle assumptions about the converter's rounding behavior and instead relies on pytest.approx() to account for the model's 2-decimal rounding - Improve bandit security scanning configuration Replaced global B101 skip with file-specific skip for src/nwp500/cli/rich_output.py This maintains security scanning rigor while acknowledging that assert statements are acceptable for type-narrowing checks in CLI optional feature code - Note: 'heLowerOnTDiffempSetting' field name retains the API's existing typo as documented in the model's alias - this is the correct key expected by the DeviceStatus model validation All 403 tests passing, security and linting checks passing

eman

Addressing review comments:

Line 96 - heLowerOnTDiffempSetting: This is the correct field name; it reflects an actual typo in the Navien cloud API payload. The model correctly handles this with an alias mapping "heLowerOnTDiffempSetting" to he_lower_on_diff_temp_setting. The test payload intentionally uses the API's typo to validate the model's alias handling.
Lines 48 & 69 - recircOperationBusy: These are NOT duplicates. Line 48 defines operationBusy (on line 48, different key), and line 69 defines recircOperationBusy. The reviewer may have misread the line numbers. Both keys are needed in the test payload.
Rounding in flow rate test: Updated to use pytest.approx(gpm_val, abs=0.01) with 0.01 tolerance instead of manual rounding. This is now tolerance-based and resilient to model rounding changes.
.bandit Configuration: Updated from global B101 skip to file-specific skip targeting only src/nwp500/cli/rich_output.py where asserts are used for type-narrowing when rich library is available. This maintains security rigor for the rest of the codebase.

eman · 2026-02-09T20:08:15Z

Re: Line 96 - heLowerOnTDiffempSetting

This is the correct field name reflecting an actual typo in the Navien API payload. The model correctly handles this with an alias mapping "heLowerOnTDiffempSetting" to the snake_case field he_lower_on_diff_temp_setting. The test payload intentionally uses the API's typo key to validate the model's alias handling works correctly.

eman · 2026-02-09T20:08:31Z

Re: Lines 48 & 69 - recircOperationBusy

These are NOT duplicates. Line 48 defines operationBusy (different key), and line 69 defines recircOperationBusy. Both keys are needed in the test payload and serve different purposes in the device status model.

eman · 2026-02-09T20:08:47Z

Re: Flow rate test rounding

Updated to use pytest.approx(gpm_val, abs=0.01) with 0.01 tolerance instead of manual rounding. This is now tolerance-based and resilient to model rounding changes.

eman · 2026-02-09T20:09:03Z

Re: .bandit B101 global skip

Updated from global B101 skip to file-specific configuration targeting only src/nwp500/cli/rich_output.py where asserts are used for type-narrowing when the optional rich library is available. This maintains full security scanning rigor for the rest of the codebase.

eman added 4 commits February 6, 2026 23:25

fix: resolve linting issues in test_mqtt_hypothesis.py

e035a43

- Fix import sorting and remove duplicate imports - Fix line length violations (>80 characters) - Remove trailing whitespace and blank line whitespace - Ensure proper code formatting for CI compliance

fix: resolve remaining linting issues in test_mqtt_hypothesis.py

22d4e71

- Fix line length violations in comments (>80 characters) - Ensure all ruff linting checks pass - All tests continue to pass locally

eman requested a review from Copilot February 9, 2026 19:42

Copilot AI reviewed Feb 9, 2026

View reviewed changes

tests/test_mqtt_hypothesis.py Show resolved Hide resolved

tests/test_mqtt_hypothesis.py Show resolved Hide resolved

tests/test_mqtt_hypothesis.py Show resolved Hide resolved

tests/test_mqtt_hypothesis.py Outdated Show resolved Hide resolved

.bandit Outdated Show resolved Hide resolved

eman added 2 commits February 9, 2026 11:58

Fix formatting in test_mqtt_hypothesis.py

0850051

eman commented Feb 9, 2026

View reviewed changes

eman merged commit 2329e97 into main Feb 13, 2026
8 checks passed

eman deleted the feat/security-and-fuzzing branch February 13, 2026 06:46

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: configure hypothesis fuzzing and bandit security scanning#72

feat: configure hypothesis fuzzing and bandit security scanning#72
eman merged 6 commits intomainfrom
feat/security-and-fuzzing

eman commented Feb 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eman left a comment

Uh oh!

eman commented Feb 9, 2026

Uh oh!

eman commented Feb 9, 2026

Uh oh!

eman commented Feb 9, 2026

Uh oh!

eman commented Feb 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

eman commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes Made

Testing Infrastructure

Security Enhancements

Code Quality

Testing

Breaking Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

eman left a comment

Choose a reason for hiding this comment

Uh oh!

eman commented Feb 9, 2026

Uh oh!

eman commented Feb 9, 2026

Uh oh!

eman commented Feb 9, 2026

Uh oh!

eman commented Feb 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

eman commented Feb 7, 2026 •

edited

Loading