Update linter and add auto-formatter config

.gitignore

@@ -18,6 +18,7 @@ tests/htmlcov/*
 .python-version
 *~
 *.tmp
+.pre-commit-config.yaml
 
 # Debian generated files
 debian/.debhelper/*

docs/CONTRIBUTORS.rst

@@ -5,8 +5,8 @@ Note: Development of TUF occurs on the "develop" branch of this repository.
 
 Contributions can be made by submitting GitHub pull requests. Submitted code
 should follow our `code style guidelines
-<https://github.com/secure-systems-lab/code-style-guidelines>`_, which provide
-examples of what to do (or not to do) when writing Python code.
+<https://github.com/secure-systems-lab/code-style-guidelines>`_, which are
+enforced with linters and auto-formatters (details below).
 
 Contributors must also indicate acceptance of the `Developer Certificate of
 Origin <https://developercertificate.org/>`_ (DCO) when making a contribution
@@ -105,6 +105,26 @@ To work on the TUF project, it's best to perform a development install.
  $ pip install -r requirements-dev.txt
 
 
+Auto-formatting
+===============
+
+CI/CD will check that new TUF code is formatted with `black
+<https://black.readthedocs.io/>`__ and `isort <https://pycqa.github.io/isort>`__.
+Auto-formatting can be done on the command line:
+::
+
+ $ # TODO: configure black and isort args in pyproject.toml (see #1161)
+ $ black --line-length 80 tuf/api
+ $ isort --line-length 80 --profile black -p tuf tuf/api
+
+or via source code editor plugin
+[`black <https://black.readthedocs.io/en/stable/editor_integration.html>`__,
+`isort <https://github.com/pycqa/isort/wiki/isort-Plugins>`__] or
+`pre-commit <https://pre-commit.com/>`__-powered git hooks
+[`black <https://black.readthedocs.io/en/stable/version_control_integration.html>`__,
+`isort <https://pycqa.github.io/isort/docs/configuration/pre-commit/>`__].
+
+
 Testing
 =======
 

docs/GOVERNANCE.md

@@ -31,6 +31,8 @@ undergo review and automated testing, including, but not limited to:
 [Tox](https://tox.readthedocs.io/en/latest/).
 * Static code analysis via [Pylint](https://www.pylint.org/) and
 [Bandit](https://wiki.openstack.org/wiki/Security/Projects/Bandit).
+- Auto-formatting with [black](https://black.readthedocs.io/) and
+[isort](https://pycqa.github.io/isort/).
 * Checks for Signed-off-by commits via [Probot: DCO](https://github.com/probot/dco).
 * Review by one or more
 [maintainers](MAINTAINERS.txt).

requirements-test.txt

@@ -8,5 +8,7 @@ python-dateutil
 
 # additional test tools for linting and coverage measurement
 coverage
+black
+isort
 pylint
 bandit

tox.ini

@@ -42,9 +42,14 @@ commands =
 
 [testenv:lint]
 commands =
- # Use different pylint configs for legacy and new (tuf/api) code
+ # Use different configs for new (tuf/api/*) and legacy code
+ # TODO: configure black and isort args in pyproject.toml (see #1161)
+ black --check --diff --line-length 80 {toxinidir}/tuf/api
+ isort --check --diff --line-length 80 --profile black -p tuf {toxinidir}/tuf/api
+ pylint {toxinidir}/tuf/api --rcfile={toxinidir}/tuf/api/pylintrc
+
  # NOTE: Contrary to what the pylint docs suggest, ignoring full paths does
  # work, unfortunately each subdirectory has to be ignored explicitly.
  pylint {toxinidir}/tuf --ignore={toxinidir}/tuf/api,{toxinidir}/tuf/api/serialization
- pylint {toxinidir}/tuf/api --rcfile={toxinidir}/tuf/api/pylintrc
+
  bandit -r {toxinidir}/tuf