[engine] Make end_col exclusive

`end_col` now indicates the column of the character *after* the last
character of the span.

Rationale:
- Consistent with SARIF (see section 3.30.8 at
  https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html).
- Consistent with Rust's Clippy and Go's staticcheck.
- Consistent with Tricium (which uses zero-based column indexing unlike
  shac, but still an exclusive end column).
- Makes some common patterns work as expected. E.g. if end_col is
  inclusive then this is wrong:

    match = ctx.re.match("foo", line)
    if match:
      col = match.offset + 1
      ctx.emit.finding(
	message = "found foo",
	col = col,
	end_col = col + len(match.groups[0]),  # Wrong, 1 too high
      )

Change-Id: I7131a8fce93bce2701ef60d352a8e8d24453e553
Reviewed-on: https://fuchsia-review.googlesource.com/c/shac-project/shac/+/878432
Fuchsia-Auto-Submit: Oliver Newman <olivernewman@google.com>
Reviewed-by: Marc-Antoine Ruel <maruel@google.com>
Commit-Queue: Auto-Submit <auto-submit@fuchsia-infra.iam.gserviceaccount.com>
10 files changed
tree: 80b3eaf75c24a56a5bffd4b08928c2d097d47725
  1. .github/
  2. doc/
  3. images/
  4. internal/
  5. scripts/
  6. .gitignore
  7. AUTHORS
  8. check_doc.star
  9. codecov.yml
  10. CONTRIBUTING.md
  11. go.mod
  12. go.star
  13. go.sum
  14. LICENSE
  15. licenses.star
  16. main.go
  17. OWNERS
  18. PATENTS
  19. README.md
  20. shac.star
  21. shac.textproto
README.md

shac

Shac (Scalable Hermetic Analysis and Checks) is a unified and ergonomic tool and framework for writing and running static analysis checks.

Shac checks are written in Starlark.

usage demonstration

Usage

go install go.fuchsia.dev/shac-project/shac@latest
shac check
shac doc shac.star | less

Documentation

Contributing

⚠ The source of truth is at https://fuchsia.googlesource.com/shac-project/shac.git and uses Gerrit for code review.

See CONTRIBUTING.md to submit changes.