Bandit, release v1, use ifs over assert in src

.pre-commit-config.yaml

@@ -25,3 +25,9 @@ repos:
       # pre-commit's default_language_version, see
       # https://pre-commit.com/#top_level-default_language_version
       language_version: python3.9
+
+- repo: https://github.com/PyCQA/bandit
+  rev: 1.7.4
+  hooks:
+  - id: bandit
+    args: [-x, "tests"]

README.md

@@ -7,6 +7,8 @@
 [![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=ddmee_polling2&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=ddmee_polling2)
 [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=ddmee_polling2&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=ddmee_polling2)
 [![Code Smells](https://sonarcloud.io/api/project_badges/measure?project=ddmee_polling2&metric=code_smells)](https://sonarcloud.io/summary/new_code?id=ddmee_polling2)
+[![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
+[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
 
 # polling2
 

docs/index.rst

@@ -41,6 +41,14 @@ Release v\ |version|.
     :target: https://sonarcloud.io/summary/new_code?id=ddmee_polling2
     :alt: Code Smells
 
+.. image:: https://img.shields.io/badge/code%20style-black-000000.svg
+   :target: https://github.com/psf/black
+   :alt: Black autoformat
+
+.. image:: https://img.shields.io/badge/security-bandit-yellow.svg
+    :target: https://github.com/PyCQA/bandit
+    :alt: Bandit scanning
+
 **Polling2** is a powerful python utility used to wait for a function to return when the specified condition is met.
 
 Install

docs/release-notes.rst

@@ -1,8 +1,15 @@
 Release notes
 =============
 
+1.0.0
+-----
+
+- API change if you have been optimising asserts away.
+- Remove use of ``assert`` in ``poll()`` function. Issue raised that Bandit flags this as a low severity CWE because asserts can be removed at runtime by an optimiser. Switch to using if statements that raise ``AssertionError``. In practice, a user should see no difference in how they use the ``poll()`` function. Unless they have been optimising these asserts away and providing arguments combinations that would otherwise have tripped the assert clauses.
+
 0.5.0
 -----
+
 - NEW API addition: poll_decorator(). Per user-request, you can now use @poll_decorator() as a way to wrap a function with poll().
 - The api otherwise remains the same. See the new function poll_decorator(). All options and arguments remain equivalent in poll()/poll_decorator(). Fully backward compatible change.
 

polling2.py

@@ -4,7 +4,7 @@
 
 """
 
-__version__ = "0.5.0"
+__version__ = "1.0.0"
 
 import logging
 import time
@@ -180,15 +180,16 @@ def poll(
     This message should allow a user to work-out how long the poll could take, and thereby detect a hang in real-time
     if the poll takes longer than it should.
     """
-
-    assert (timeout is not None or max_tries is not None) or poll_forever, (
-        "You did not specify a maximum number of tries or a timeout. Without either of these set, the polling "
-        'function will poll forever. If this is the behavior you want, pass "poll_forever=True"'
-    )
-
-    assert not (
-        (timeout is not None or max_tries is not None) and poll_forever
-    ), "You cannot specify both the option to poll_forever and max_tries/timeout."
+    if not ((timeout is not None or max_tries is not None) or poll_forever):
+        raise AssertionError(
+            "You did not specify a maximum number of tries or a timeout. Without either of these set, the polling "
+            'function will poll forever. If this is the behavior you want, pass "poll_forever=True"'
+        )
+
+    if (timeout is not None or max_tries is not None) and poll_forever:
+        raise AssertionError(
+            "You cannot specify both the option to poll_forever and max_tries/timeout."
+        )
 
     kwargs = kwargs or dict()
     values = collect_values or Queue()