Skip to content

Commit e45baf9

Browse files
authored
Add some <ocaml repr="classic"> to a few SCA types (#366)
I don't like polymorphic variants (`Xxx) and prefer classic variants. Also rename transitivity to dependency_kind test plan: see related PR in semgrep - [x] I ran `make setup && make` to update the generated code after editing a `.atd` file (TODO: have a CI check) - [x] I made sure we're still backward compatible with old versions of the CLI. For example, the Semgrep backend need to still be able to *consume* data generated by Semgrep 1.50.0. See https://atd.readthedocs.io/en/latest/atdgen-tutorial.html#smooth-protocol-upgrades Note that the types related to the semgrep-core JSON output or the semgrep-core RPC do not need to be backward compatible!
1 parent 68e5129 commit e45baf9

File tree

7 files changed

+2882
-2855
lines changed

7 files changed

+2882
-2855
lines changed

semgrep_output_v1.atd

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -495,7 +495,7 @@ type match_intermediate_var <python decorator="dataclass(frozen=True)"> = {
495495
(* both ecosystem and transitivity below have frozen=True so the generated
496496
* classes can be hashed and put in sets (see calls to reachable_deps.add()
497497
* in semgrep SCA code)
498-
* TODO: use <ocaml repr="classic">, and do the same for manifest
498+
* alt: type package_manager
499499
*)
500500
type ecosystem
501501
<python decorator="dataclass(frozen=True)">
@@ -516,28 +516,30 @@ type ecosystem
516516
| Mix <json name="mix">
517517
| Hex <json name="hex">
518518
| Opam <json name="opam">
519-
]
519+
] <ocaml repr="classic">
520520

521-
type transitivity
521+
type dependency_kind
522522
<python decorator="dataclass(frozen=True)">
523523
<ocaml attr="deriving show,eq"> =
524524
[
525525
(* we depend directly on the 3rd-party library mentioned in the lockfile
526526
* (e.g., use of log4j library and concrete calls to log4j in 1st-party code).
527527
* log4j must be declared as a direct dependency in the manifest file.
528-
*)
528+
*)
529529
| Direct <json name="direct">
530530
(* we depend indirectly (transitively) on the 3rd-party library
531531
* (e.g., if we use lodash which itself uses internally log4j then
532532
* lodash is a Direct dependency and log4j a Transitive one)
533+
* alt: Indirect
534+
* TODO? add and detect shadow dependencies?
533535
*)
534536
| Transitive <json name="transitive">
535537
(* If there is insufficient information to determine the transitivity,
536538
* such as a requirements.txt file without a requirements.in manifest,
537539
* we leave it Unknown.
538540
*)
539541
| Unknown <json name="unknown">
540-
]
542+
] <ocaml repr="classic">
541543

542544
(* part of cli_match_extra, core_match_extra, and finding *)
543545
type sca_match = {
@@ -565,7 +567,7 @@ type sca_match_kind = [
565567
* the dependency; for a dependency that is both direct and transitive
566568
* two findings should be generated.
567569
*)
568-
| LockfileOnlyMatch of transitivity
570+
| LockfileOnlyMatch of dependency_kind
569571
(* found the pattern-part of the SCA rule in 1st-party code
570572
* (reachable as originally defined by Semgrep Inc.)
571573
* the match location will be in some target code.
@@ -640,7 +642,7 @@ type found_dependency = {
640642
allowed_hashes: (string * string list) list
641643
<json repr="object"> <python repr="dict"> <ts repr="map">;
642644
?resolved_url: string option;
643-
transitivity: transitivity;
645+
transitivity: dependency_kind;
644646
(* Path to the manifest file that defines the project containing this
645647
* dependency. Examples: package.json, nested/folder/pom.xml
646648
*)
@@ -2225,7 +2227,7 @@ type lockfile_kind
22252227
| YarnLock
22262228
| PnpmLock
22272229
| GemfileLock
2228-
| GoMod
2230+
| GoModLock <json name="GoMod">
22292231
| CargoLock
22302232
| MavenDepTree (* Not a real lockfile *)
22312233
| GradleLockfile
@@ -2239,7 +2241,6 @@ type lockfile_kind
22392241
| OpamLocked
22402242
] <ocaml repr="classic">
22412243

2242-
(* TODO: use <ocaml repr="classic"> *)
22432244
type manifest_kind
22442245
<ocaml attr="deriving show, eq">
22452246
<python decorator="dataclass(frozen=True)"> =
@@ -2257,7 +2258,7 @@ type manifest_kind
22572258
(* A Ruby Gemfile manifest https://bundler.io/v2.5/man/gemfile.5.html *)
22582259
| Gemfile
22592260
(* go.modhttps://go.dev/doc/modules/gomod-ref *)
2260-
| GoMod
2261+
| GoModManifest <json name="GoMod">
22612262
(* cargo.toml - https://doc.rust-lang.org/cargo/reference/manifest.html *)
22622263
| CargoToml
22632264
(* A Maven pom.xml manifest file
@@ -2301,7 +2302,7 @@ type manifest_kind
23012302
| Csproj
23022303
(* .opam - https://opam.ocaml.org/doc/Manual.html#Package-definitions *)
23032304
| OpamFile
2304-
]
2305+
] <ocaml repr="classic">
23052306

23062307
type manifest
23072308
<ocaml attr="deriving show, eq">

semgrep_output_v1.jsonschema

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

semgrep_output_v1.proto

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)