[engine] Resolve root directory using git

Instead of assuming the current working directory (overridden by
`--root`) contains a shac.star file, locate the root of the current git
repository (if the current directory is in a git repository) and use the
shac.star file there, also analyzing all files in the git directory
instead of just files in the current working directory.

The `--root` flag is replaced by `-C` since it's not necessarily any
sort of root, instead being more analogous to the `-C` flag to git.

We have to keep around the `--root` flag for backwards compatibility
until references in other repos can be updated.

TODO: update the <files> positional argument to accept directories, to
make it possible to analyze just a single subdirectory (e.g. `shac check
subdir`).

Change-Id: Ic9aef678e2cb518a81ff2f36f3bec6fda969675d
Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/914336
Commit-Queue: Oliver Newman <olivernewman@google.com>
Reviewed-by: Marc-Antoine Ruel <maruel@google.com>
10 files changed
tree: 7510d0ceb2e573b26c422f1c21425320004d24aa
  1. .github/
  2. checks/
  3. doc/
  4. images/
  5. internal/
  6. scripts/
  7. vendor/
  8. .gitignore
  9. AUTHORS
  10. codecov.yml
  11. CONTRIBUTING.md
  12. go.mod
  13. go.sum
  14. LICENSE
  15. main.go
  16. OWNERS
  17. PATENTS
  18. README.md
  19. shac.star
  20. shac.textproto
README.md

shac

Shac (Scalable Hermetic Analysis and Checks) is a unified and ergonomic tool and framework for writing and running static analysis checks.

Shac checks are written in Starlark.

usage demonstration

Usage

go install go.fuchsia.dev/shac-project/shac@latest
shac check
shac doc shac.star | less

Documentation

Road map

Planned features/changes, in descending order by priority:

  • [x] Configuring files to exclude from shac analysis in shac.textproto
  • [x] Include unstaged files in analysis, including respecting unstaged shac.star files
  • [x] Automatic fix application with handling for conflicting suggestions
  • [ ] Provide a .shac cache directory that checks can write to
  • [ ] Mount checkout directory read-only
    • [x] By default
    • [ ] Unconditionally
  • [ ] Give checks access to the commit message via ctx.scm
  • [ ] Built-in formatting of Starlark files
  • [ ] Configurable “pass-throughs” - non-default environment variables and mounts that can optionally be passed through to the sandbox
  • [ ] Add glob arguments to ctx.scm.{all,affected}_files() functions for easier filtering
  • [ ] Filesystem sandboxing on MacOS
  • [ ] Windows sandboxing
  • [ ] Testing framework for checks

Contributing

⚠ The source of truth is at https://fuchsia.googlesource.com/shac-project/shac.git and uses Gerrit for code review.

See CONTRIBUTING.md to submit changes.