Add bandit-baseline check job.

As bandit-baseline check just call tox to run tests, adding it to
in-tree checks instead of gate jobs.

Closes-Bug: #1618549
Change-Id: If6848c69e09117789d566ae47977034d5503fa09
Signed-off-by: Zhao Chao <zhaochao1984@gmail.com>

.zuul.yaml

@@ -22,6 +22,8 @@
             voting: false
         - trove-tox-fakemodetests
         - trove-tox-apiexamples
+        - trove-tox-bandit-baseline:
+            voting: false
     gate:
       queue: trove
       jobs:
@@ -331,3 +333,26 @@
     parent: openstack-tox-py27
     vars:
       tox_envlist: apiexamples
+
+- job:
+    name: trove-tox-bandit-baseline
+    parent: openstack-tox
+    timeout: 2400
+    vars:
+        tox_envlist: bandit-baseline
+    required-projects:
+        - openstack/requirements
+    irrelevant-files:
+        - ^.*\.rst$
+        - ^.*\.txt$
+        - ^api-ref/.*$
+        - ^apidocs/.*$
+        - ^contrib/.*$
+        - ^doc/.*$
+        - ^etc/.*$
+        - ^releasenotes/.*$
+        - ^setup.cfg$
+        - ^tools/.*$
+        - ^trove/hacking/.*$
+        - ^trove/tests/scenario/.*$
+        - ^trove/tests/unittests/.*$

tox.ini

@@ -100,6 +100,10 @@ commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasen
 [testenv:bandit]
 commands = bandit -r trove -n5 -x tests
 
+[testenv:bandit-baseline]
+envdir = {toxworkdir}/bandit
+commands = bandit-baseline -r trove -n5 -x tests -ii -ll
+
 [testenv:install-guide]
 commands = sphinx-build -a -E -W -d install-guide/build/doctrees -b html install-guide/source install-guide/build/html