21 lines
1.9 KiB
Markdown
21 lines
1.9 KiB
Markdown
# Questions - Part 1
|
|
|
|
## Unit tests - Secret keys - Linter - optimized CI/CD pipeline
|
|
|
|
- **Q1.1**: Provide additional unit tests to ensure that wrong input (type, values, ...) doesn't crash the application, but gets intercepted and produce a controlled error. It is possible that you have also to adjust slightly the application
|
|
- **Q1.2**: The secret key for flask is hard coded. Is this good practice? What are the dangers? How could this be fixed?
|
|
- **Q1.3**: Give a short description of *Linter*. Integrate a basic linter like [Flake8](https://flake8.pycqa.org/en/latest/) or [Ruff](https://github.com/astral-sh/ruff) in the existing CI/CD pipeline
|
|
- **Q1.4 (optional)**: The run of the current CI/CD pipeline takes some time. Especially the time to setup the docker with the update and installation of all the dependencies is quite time consuming compared to the real testing time. Do you see any alternatives to speed up this process? Describe and try to implement it in your pipeline.
|
|
|
|
# Answers - Part 1
|
|
## Q1.2
|
|
- It's a very bad practice. The secret key will be exposed in the codebase and can be easily accessed by anyone who has access to the codebase. This can lead to security vulnerabilities and compromise the integrity of the application.
|
|
- To fix this, you can use environment variables to store the secret key.
|
|
|
|
## Q1.3
|
|
- A linter is a tool to statically analyse code for readability and improving code quality. It is usually executed from a standalone tool.
|
|
- It is used to check for errors, vulns, code smells or general issues but also to enforce a coding style over the whole project.
|
|
|
|
## Q1.4
|
|
The minimum is to change the image on the CI to put an Alpine or a basic python image. Another option (which we implemented) is to create a custom Docker image that includes all the necessary dependencies for the application. This can significantly reduce the time required to set up the environment and speed up the CI/CD pipeline.
|