brotherton-erpnext/.github/helper/semgrep_rules
Ankush Menat 06b426e9c3
ci: rule to fail PRs that add a new manual commit (#27928)
Manual commits are frequent source of bugs, confusions or undefined
behaviour.

All new manual commits should be explcitly ignored with explanation on
why it's added. This will only fail for new additions. Existing ones
need to be cleaned up manually.
2021-10-12 23:01:37 +05:30
..
frappe_correctness.py chore: Clean up imports (#27302) 2021-09-02 16:44:59 +05:30
frappe_correctness.yml ci: rule to fail PRs that add a new manual commit (#27928) 2021-10-12 23:01:37 +05:30
README.md ci(semgrep): Add semgrep testing (#24871) 2021-04-16 21:44:49 +05:30
report.py ci(semgrep): add translation checks for report labels (#27280) 2021-09-01 14:19:39 +05:30
report.yml fix: General Ledger translation issues (#27298) 2021-09-08 16:28:05 +05:30
security.py ci(semgrep): Add semgrep testing (#24871) 2021-04-16 21:44:49 +05:30
security.yml chore: remove warning rules 2021-07-21 19:54:06 +05:30
translate.js ci: enable semgrep check on v13 branches and update rules (#25647) 2021-05-11 18:27:20 +05:30
translate.py ci(semgrep): fix false positives (#25823) 2021-05-25 14:06:10 +05:30
translate.yml ci(semgrep): fix false positives (#25823) 2021-05-25 14:06:10 +05:30
ux.js ci(semgrep): fix false positives (#25823) 2021-05-25 14:06:10 +05:30
ux.py ci(semgrep): fix false positives (#25823) 2021-05-25 14:06:10 +05:30
ux.yml ci(semgrep): fix false positives (#25823) 2021-05-25 14:06:10 +05:30

Semgrep linting

What is semgrep?

Semgrep or "semantic grep" is language agnostic static analysis tool. In simple terms semgrep is syntax-aware grep, so unlike regex it doesn't get confused by different ways of writing same thing or whitespaces or code split in multiple lines etc.

Example:

To check if a translate function is using f-string or not the regex would be r"_\(\s*f[\"']" while equivalent rule in semgrep would be _(f"..."). As semgrep knows grammer of language it takes care of unnecessary whitespace, type of quotation marks etc.

You can read more such examples in .github/helper/semgrep_rules directory.

Why/when to use this?

We want to maintain quality of contributions, at the same time remembering all the good practices can be pain to deal with while evaluating contributions. Using semgrep if you can translate "best practice" into a rule then it can automate the task for us.

Running locally

Install semgrep using homebrew brew install semgrep or pip pip install semgrep.

To run locally use following command:

semgrep --config=.github/helper/semgrep_rules [file/folder names]

Testing

semgrep allows testing the tests. Refer to this page: https://semgrep.dev/docs/writing-rules/testing-rules/

When writing new rules you should write few positive and few negative cases as shown in the guide and current tests.

To run current tests: semgrep --test --test-ignore-todo .github/helper/semgrep_rules

Reference

If you are new to Semgrep read following pages to get started on writing/modifying rules: