Semgrep: Semantic grep for code

Re:Semgrep: Semantic grep for code by westurner on Thursday April 22, 2021 @02:17PM (#26906038)

Is there a more complete example of how to call semgrep from pre-commit (which gets called before every git commit) in order to prevent e.g. Python print calls (print(), print \\n(), etc.) from being checked in?

https://semgrep.dev/docs/extensions/ describes how to do pre-commit.

Nvm, here's semgrep's own .pre-commit-config.yml for semgrep itself: https://github.com/returntocorp/semgrep/blob/develop/.pre-co...

[ Parent | on HN ]

Re:Semgrep: Semantic grep for code by theptip on Thursday April 22, 2021 @05:20PM (#26908362)

I've never used the `pre-commit` framework, but it's really simple to wire up arbitrary shell scripts; check out the

`.git/hooks` directory in your repo for samples, e.g. `.git/hooks/pre-commit.sample`.

You can run any old shell script there, without having to install a python tool.

[ Parent | on HN ]

Re:Semgrep: Semantic grep for code by westurner on Friday April 23, 2021 @10:44AM (#26915252)

Yeah but that githook will only be installed on that one repo on that one machine. And they may have no or a different version of bash installed (on e.g. MacOS or Windows). IMHO, POSIX-compatible portable shell scripts are more trouble than portable Python scripts.

Pre-commit requires Python and pre-commit to be installed (and then it downloads every hook function).

This fetches the latest version of every hook defined in the .pre-commit-config.yml:

  pre-commit autoupdate

https://pre-commit.com/#pre-commit-autoupdate

A person could easily `ln -s repo/.hooks/hook*.sh repo/.git/hooks/` after every git clone.

[ Parent | on HN ]

Re:Semgrep: Semantic grep for code by joj123 on Thursday April 22, 2021 @08:31PM (#26909757)

Out of curiosity, Is there value in doing this over (say) running a GitHub Action post commit and failing the build if it finds something nasty?

[ Parent | on HN ]

Re:Semgrep: Semantic grep for code by Spivak on Thursday April 22, 2021 @08:48PM (#26909859)

If you can catch it before the commit is even made then why do/wait for a build?

[ Parent | on HN ]

Re:Semgrep: Semantic grep for code by joj123 on Friday April 23, 2021 @01:56AM (#26911394)

Fair enough. Guess IDE plugins work even better for that

[ Parent | on HN ]

Re:Semgrep: Semantic grep for code by westurner on Friday April 23, 2021 @10:30AM (#26915130)

IDE plugins are not at all consistent from one IDE to another. Pre-commit is great for teams with different IDEs because all everyone needs to do is:

  [pip,] install pre-commit
  pre-commit install
  # git commit
  #   pre-commit run --all-files

  # pre-commit autoupdate

https://pre-commit.com/

[ Parent | on HN ]