Rework GitPython dependency to be an extra for bandit-baseline

[ericwb]

The only piece of code that requires GitPython is bandit-baseline. There tends to be an abundance of CVEs in the GitPython library due to its dependency on Git. By making GitPython optional via an extra, users who mostly use just the bandit command line and not bandit-baseline can benefit.

However, this will require different install if a user wants to use bandit-baseline. This is now noted in the Getting Started doc, but you simply do:

pip install bandit[GitPython]

FYI, this option was suggested in PR #976.

[sigmavirus24]

Please, let's do something different here:

if git is None:
    valid = False
    LOG.error("GitPython not available to generate baseline file, run 'pip install --force-reinstall bandit[baseline]'")
    return

try:
   repo = git.Repo(os.getcwd())
except ...
...
...

[sigmavirus24]

I didn't properly object before to the usage of toml as the extra name, that should have been pyproject. But I don't think bleeding implementation details of functionality behind extras is the right decision either. This should be bandit[baseline] or bandit[baseline-deps]

[sigmavirus24]

This is not how you add a new extra. L33 above starts the extras section. After L37 I would add

baseline =
    GitPython>=3.1.30

[ericwb]

That makes sense. I was reading the docs which stated the extra in the [] had to be a package. But I assume that extras acts as an alias of sorts.

[sigmavirus24]

Yes the extra name can be anything. See the old security extra for requests

[sigmavirus24]

I don't know why we have tomli and GitPython here but not pyyaml. (I'm guessing PyYAML is transitively installed elsewhere.)

I would rather replace those with:

-e .[yaml,toml,baseline]

As that will install whatever the dependencies are for the extras in our metadata, not just what we remembered to add here.