[DRAFT][DO NOT MERGE] Remote hooks prototype#37
Closed
liukatkat wants to merge 36 commits into
Closed
Conversation
* initial setup update workflow tests and mcp * remove session start hook * set version to 0
update workflow tests and mcp add session start hook
update workflow tests and mcp add session start hook
* initial setup update workflow tests and mcp add session start hook * output errors to stderr * update version
* fix semgrep-version not accessible by plugin * fix workflow * bump version
This PR adds a PR checklist that includes tasks that will help us maintain consistent versioning and make sure that the plugin still works!
fix: use semgrep login --force, to avoid issues with envvars
* fix secure by default test and disable hooks tests * add comma
These are managed in the template repo going forward. Removes: - .github/workflows/test.yml - .github/scripts/check-plugin-version.sh - .github/pull_request_template.md - CONTRIBUTING.md - tests/ (all test shell scripts) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* [create-pull-request] automated change * chore: bump version to 0.5.0 --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This PR updates the description to better describe the plugin.
Collaborator
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
liukatkat
changed the title
liukatkat
changed the title
![semgrep-zcs-prod-semgrep[bot]](https://avatars.githubusercontent.com/u/29760937?s=60&v=4){kind=small}
Comment on lines
+135
to
+224
| if __name__ == "__main__": | ||
| local_url = "http://127.0.0.1:8000/api/run" | ||
| # remote_url = f"https://mcp-dev.semgrep.ai/fragment" | ||
| env_url = os.environ.get("SEMGREP_FRAGMENT_URL", None) | ||
|
|
||
| url = env_url or local_url | ||
| scan_rule = None | ||
|
|
||
| config = {} | ||
| files = [] | ||
| trace = None | ||
| args = list(sys.argv[1:]) | ||
|
|
||
| subcommand = args.pop(0) | ||
| if subcommand != "scan": | ||
| print(f"error: use {sys.argv[0]} scan ...") | ||
| sys.exit(-1) | ||
|
|
||
| while args: | ||
| arg = args.pop(0) | ||
| if arg.startswith("--"): | ||
| arg = arg[2:] | ||
| if arg == "config": | ||
| arg = args.pop(0) | ||
| config["rule"] = Path(arg).read_text() | ||
| else: | ||
| config[arg] = True | ||
| else: | ||
| files.append(arg) | ||
|
|
||
| file_path = load_file_path_claude() | ||
| files.append(file_path) | ||
|
|
||
| if trace: # check env | ||
| trace = { | ||
| "level": "...", | ||
| "span_id": "...", | ||
| "trace_id": "....", | ||
| "endpoint": "....", | ||
| } | ||
|
|
||
| app_token = os.environ.get("SEMGREP_APP_TOKEN", "") | ||
| auth = None | ||
| # check env for app token, then check settings file | ||
| if not app_token: | ||
| app_token = get_app_token_from_settings() | ||
|
|
||
| # print(f"app_token: {app_token}") | ||
|
|
||
| if app_token: | ||
| config["app_token"] = app_token | ||
| auth = SemgrepAppToken(app_token) | ||
|
|
||
| scan_files = load_files(Path.cwd(), files) | ||
|
|
||
| scan_args = { | ||
| "name": "scan", | ||
| "files": scan_files, | ||
| "config": config, | ||
| "trace": trace, | ||
| } | ||
|
|
||
| run_args = {"command": scan_args} | ||
|
|
||
| response = request_scan(url, run_args, auth=auth).json() | ||
| result = response.pop("result", None) | ||
|
|
||
| if result and result["json"]: | ||
| findings = result["json"]["results"] | ||
| if findings and len(findings) > 0: | ||
| reason = str( | ||
| [ | ||
| { | ||
| "line": r["start"]["line"], | ||
| "display_name": r["extra"]["metadata"].get("display-name"), | ||
| "message": r["extra"]["message"], | ||
| "severity": r["extra"]["severity"], | ||
| "cwe": r["extra"]["metadata"].get("cwe"), | ||
| } | ||
| for r in findings | ||
| ] | ||
| ) | ||
| response = PostToolHookResponse(decision="block", reason=reason) | ||
| print(response.model_dump_json()) | ||
| else: | ||
| response = PostToolHookResponse(decision="allow", reason="No findings") | ||
| print(response.model_dump_json()) | ||
| else: | ||
| response = PostToolHookResponse(decision="allow", reason="No results") | ||
| print(response.model_dump_json()) |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Please move all the code under if __name__ == "__main__": into a function and make the if block just call that function. This is because any imports, variable assignments, and function definitions under the if __name__ == "__main__": block will be seen by linters and editors as if they're always available module-wide. Our linters and type checkers will not be able to identify missing imports and undefined variables if they're defined in this block but are missing outside it.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by if-name-main-blocks-should-not-define-anything.
You can view more details about this finding in the Semgrep AppSec Platform.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.