Google Git
Sign in
fuchsia / shac-project / shac / 7ecc1aad7d1ad60b2e796f3c505cdcfacbe38b09
commit7ecc1aad7d1ad60b2e796f3c505cdcfacbe38b09[log] [tgz]
authorOliver Newman <olivernewman@google.com>Wed Aug 30 19:21:46 2023 +0000
committerCQ Bot <fuchsia-internal-scoped@luci-project-accounts.iam.gserviceaccount.com>Wed Aug 30 19:21:46 2023 +0000
treedf2a63b71b6fede1edeed099db2aefe970b60187
parent23d3f1a91f552170487e3f93057dcfbed378af0c [diff]
Revert "[execsupport] Delete"

This reverts commit 23d3f1a91f552170487e3f93057dcfbed378af0c.

Reason for revert: "text file busy" flakes are happening more often
since this landed

Original change's description:
> [execsupport] Delete
>
> Adding locks around forking to prevent leaked nsjail file descriptors
> should no longer be necessary now that we open nsjail with O_CLOEXEC,
> which prevents the file descriptor from leaking.
>
> Change-Id: Id89a3f493c2322668a71cbd51f99e0bbd7f31efd
> Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/909333
> Reviewed-by: Marc-Antoine Ruel <maruel@google.com>
> Fuchsia-Auto-Submit: Oliver Newman <olivernewman@google.com>
> Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>

Change-Id: Icf5709923da0ec523d50db3fc82b94fbab8c91fc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/909855
Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>
Reviewed-by: RubberStamper 🤖 <android-build-ayeaye@system.gserviceaccount.com>
Fuchsia-Auto-Submit: Oliver Newman <olivernewman@google.com>
108 files changed
tree: df2a63b71b6fede1edeed099db2aefe970b60187
  1. .github/
  2. checks/
  3. cmd/
  4. doc/
  5. images/
  6. internal/
  7. scripts/
  8. vendor/
  9. .gitignore
  10. AUTHORS
  11. codecov.yml
  12. CONTRIBUTING.md
  13. go.mod
  14. go.sum
  15. LICENSE
  16. main.go
  17. OWNERS
  18. PATENTS
  19. README.md
  20. shac.star
  21. shac.textproto
README.md

shac

Shac (Scalable Hermetic Analysis and Checks) is a unified and ergonomic tool and framework for writing and running static analysis checks.

Shac checks are written in Starlark.

usage demonstration

Usage

go install go.fuchsia.dev/shac-project/shac@latest
shac check
shac doc shac.star | less

Documentation

Road map

Planned features/changes, in descending order by priority:

  • [x] Configuring files to exclude from shac analysis in shac.textproto
  • [x] Include unstaged files in analysis, including respecting unstaged shac.star files
  • [x] Automatic fix application with handling for conflicting suggestions
  • [ ] Provide a .shac cache directory that checks can write to
  • [ ] Mount checkout directory read-only
    • [x] By default
    • [ ] Unconditionally
  • [ ] Give checks access to the commit message via ctx.scm
  • [ ] Built-in formatting of Starlark files
  • [ ] Configurable “pass-throughs” - non-default environment variables and mounts that can optionally be passed through to the sandbox
  • [ ] Add glob arguments to ctx.scm.{all,affected}_files() functions for easier filtering
  • [ ] Filesystem sandboxing on MacOS
  • [ ] Windows sandboxing
  • [ ] Testing framework for checks

Contributing

âš  The source of truth is at https://fuchsia.googlesource.com/shac-project/shac.git and uses Gerrit for code review.

See CONTRIBUTING.md to submit changes.