Add default ini file + enable recursive option in ini

[Babarberousse]

See: #467

I think making recursive a default would make sense. However it could break some ci pipelines so maybe in a future PR.

Also, I made .bandit the default ini file, which means users who do not specify an ini file and don't have a .bandit file will now get a warning. Not sure we should keep it.

[ericwb]

This change results in an warning message every time for the typical case where bandit is run with no .bandit file, yet does provide a target.

[utils]	WARNING	Unable to parse config file .bandit or missing [bandit] section

I'd rather not see warning messages when the arguments given to the CLI are correct and complete.

[bittner]

@Babarberousse Can you rebase your PR to make it ready for merging?

Also, you may address @ericwb's concern and remove the chatty warning. We may still have that, but maybe show it only with --verbose or --debug or so.

[bittner]

This limits the default to just a single possibility.

Other popular tools, such as flake8, behave, etc., allow the configuration to be discovered from various popular configuration files (to save the project home directory from being polluted with numerous configuration files).

I tend to place all configuration into a tox.ini file, for example. This makes sense as Tox is my main driver and single point of entry for running all tests and checks on Python projects.

[bittner]

You are awesome! 🥇

[bittner]

This change results in an warning message every time for the typical case where bandit is run with no .bandit file, yet does provide a target.

[utils]	WARNING	Unable to parse config file .bandit or missing [bandit] section

I'd rather not see warning messages when the arguments given to the CLI are correct and complete.

@ericwb This seems fixed now.

[Babarberousse]

I think there are still a few problems, although not related to this pull request. The recursive parameter is set to False by default when parsing empty CLI args. Given that CLI args prevail over ini files, this means recursivity cannot be set through ini file. I think recursivity argument could be a store_const=True instead of a store_true so it is set to None without CLI args.

Also, there's a bit of redundancy between my find_ini_files function and the _get_options_from_ini function.

I'll try to look at these issues this week-end and try to make it a bit cleaner.

[Babarberousse]

I went a bit further than what my initial PR was supposed to be and:

• Made recursivity true as a default
• fixed the issue with the broken bool params in the ini files. The default values for bool params are not set with argparse anymore as it would have prevented the ini file from overriding these default values. I suspect some non-bool params still don't work although I haven't tested them (aggregates, level, confidence,...)
• Abstracted some existing argparse logic into new functions.
• Added support for setup.cfg and tox.ini
• Removed parser.set_defaults lines as I couldn't figure out what they were meant to do. Please confirm you are ok with this removal.

[bittner]

@Babarberousse could you rebase this PR and try to get it merged? 🎸 🚀

This still seems like a desperately needed UX improvement to me.

[bittner]

Note to self: This PR would address issues #318 and #736.

[Babarberousse]

I don't have much time at the moment but I'll try to get it done in the next few weeks.

[Babarberousse]

I went a bit further than what my initial PR was supposed to be and:

• Made recursivity true as a default
• fixed the issue with the broken bool params in the ini files. The default values for bool params are not set with argparse anymore as it would have prevented the ini file from overriding these default values. I suspect some non-bool params still don't work although I haven't tested them (aggregates, level, confidence,...)
• Abstracted some existing argparse logic into new functions.
• Added support for setup.cfg and tox.ini
• Removed parser.set_defaults lines as I couldn't figure out what they were meant to do. Please confirm you are ok with this removal.

I kept recursivity as false as a default and kept the parser.set_defaults() lines to reduce the scope of this PR.