Google Git
Sign in
fuchsia / shac-project / shac / 556106ac3b922aa468a5524b928b0d8ee5cde473
commit556106ac3b922aa468a5524b928b0d8ee5cde473[log] [tgz]
authorOliver Newman <olivernewman@google.com>Wed Sep 20 16:32:11 2023 +0000
committerCQ Bot <fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com>Wed Sep 20 16:32:11 2023 +0000
tree5f66f44cd84af5047bcb41c01e8b8a8871493f72
parent052c1e42bcd92b9b44567ab7d927d48ab04ae2b4 [diff]
[cli] Let users override entry point file name

Some checks may require special permissions, or users may not want to
run them by default for some other reason. This allows such checks to be
written and registered in a separate Starlark file that can be run using
`shac check --entrypoint <filename>`.

Also change `main` terminology to `entrypoint` throughout the codebase
for consistency and clarity; `main` doesn't make it clear that the value
is the name of the Starlark file being run.

Bug: 130779
Change-Id: I92d962d7faba5830b791e0096f265539d9608d81
Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/919372
Reviewed-by: Anthony Fandrianto <atyfto@google.com>
Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>
Fuchsia-Auto-Submit: Oliver Newman <olivernewman@google.com>
5 files changed
tree: 5f66f44cd84af5047bcb41c01e8b8a8871493f72
  1. .github/
  2. checks/
  3. doc/
  4. images/
  5. internal/
  6. scripts/
  7. vendor/
  8. .gitignore
  9. AUTHORS
  10. codecov.yml
  11. CONTRIBUTING.md
  12. go.mod
  13. go.sum
  14. LICENSE
  15. main.go
  16. OWNERS
  17. PATENTS
  18. README.md
  19. shac.star
  20. shac.textproto
README.md

shac

Shac (Scalable Hermetic Analysis and Checks) is a unified and ergonomic tool and framework for writing and running static analysis checks.

Shac checks are written in Starlark.

usage demonstration

Usage

go install go.fuchsia.dev/shac-project/shac@latest
shac check
shac doc shac.star | less

Documentation

Road map

Planned features/changes, in descending order by priority:

  • [x] Configuring files to exclude from shac analysis in shac.textproto
  • [x] Include unstaged files in analysis, including respecting unstaged shac.star files
  • [x] Automatic fix application with handling for conflicting suggestions
  • [ ] Provide a .shac cache directory that checks can write to
  • [ ] Mount checkout directory read-only
    • [x] By default
    • [ ] Unconditionally
  • [ ] Give checks access to the commit message via ctx.scm
  • [ ] Built-in formatting of Starlark files
  • [ ] Configurable “pass-throughs” - non-default environment variables and mounts that can optionally be passed through to the sandbox
  • [ ] Add glob arguments to ctx.scm.{all,affected}_files() functions for easier filtering
  • [ ] Filesystem sandboxing on MacOS
  • [ ] Windows sandboxing
  • [ ] Testing framework for checks

Contributing

⚠ The source of truth is at https://fuchsia.googlesource.com/shac-project/shac.git and uses Gerrit for code review.

See CONTRIBUTING.md to submit changes.