Skip to content

Commit e853fbe

Browse files
xmo-odooxmo-odoo
committed
initial commit
The pylint maintainers decided that the interaction with an external standard and validation using a somewhat large schema (whether vendored or downloaded on the fly) risked slowing down and hindering the main project a bit too much so this makes more sense as a separate project, even if it ends up under the pylint-dev umbrella. Setup loosely inspired by emmanuel-ferdman/pylint-qt. Fixes pylint-dev/pylint#5493 Obsoletes pylint-dev/pylint#10759
0 parents  commit e853fbe

9 files changed

Lines changed: 738 additions & 0 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
permissions: {}
8+
9+
jobs:
10+
lint:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
with:
15+
persist-credentials: false
16+
- uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
17+
with:
18+
python-version: "3.10"
19+
- run: uv run ruff check
20+
- if: always()
21+
run: uv run ruff format --diff
22+
- if: always()
23+
run: uv run mypy .
24+
25+
test:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29+
with:
30+
persist-credentials: false
31+
- uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
32+
with:
33+
python-version: "3.10"
34+
- run: uv run pytest
35+
36+
zizmor:
37+
runs-on: ubuntu-latest
38+
39+
permissions:
40+
security-events: write
41+
42+
steps:
43+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
with:
45+
persist-credentials: false
46+
- uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0

‎.gitignore‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Python-generated files
2+
__pycache__/
3+
*.py[oc]
4+
build/
5+
dist/
6+
wheels/
7+
*.egg-info
8+
9+
.python-version
10+
uv.lock
11+
12+
# Virtual environments
13+
.venv
14+
15+
# misc
16+
.pytest_cache
17+
.idea

‎CONTRIBUTING.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Contributing
2+
3+
All contributions are welcome, such that updates for documentation, new code,
4+
assistance with issue triage, issues for bug reports or feature requests,
5+
feedback discussions, ... in respect to the Pylint [code of conduct][].
6+
7+
## Code checking
8+
9+
The project currently uses and requires [ruff](https://docs.astral.sh/ruff/)
10+
for formatting and basic linting, along with [mypy](https://www.mypy-lang.org/)
11+
for type checking. It is fully type checked, enforced by configuration.
12+
13+
The test suite is located in `tests/` and uses
14+
[pytest](https://docs.pytest.org/en/stable/). A
15+
[tox](https://github.com/tox-dev/tox) configuration is available to facilitate
16+
running all the checkers locally, but `uv run` can be used to run the tools
17+
explicitly.
18+
19+
[contributor guides]:
20+
https://pylint.readthedocs.io/en/stable/development_guide/contributor_guide/
21+
[code of conduct]:
22+
https://github.com/pylint-dev/pylint/blob/main/CODE_OF_CONDUCT.md

‎README.md‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# pylint-sarif
2+
3+
pylint-sarif is a [pylint](http://pylint.org) plugin which allows outputting
4+
[SARIF][] report files.
5+
6+
[SARIF][] is a standardized structured interchange format used to exchange
7+
information between static analysis and security tools (e.g. pylint) and
8+
various types of alert systems, formatters, aggregators, ...
9+
10+
## Usage
11+
12+
pylint --load-plugins=pylint_sarif --output-format=sarif <path to source>
13+
14+
or in `pyproject.toml`:
15+
16+
[tool.pylint.main]
17+
load-plugins = ["pylint_sarif"]
18+
19+
then pass the `--output-format` still.
20+
21+
Note that pylint supports [multi-output configurations][] so it's possible
22+
to output e.g. both a machine-readable report to a file and a human-readable
23+
output to stdout.
24+
25+
## Limitations
26+
27+
[SARIF][] is a massive format, consumers only implements the bits they
28+
care about (which makes sense), but some of them may require properties
29+
which are optional per-standard, this reporter primarily targets GitHub
30+
with the official [SARIF validator][] being a secondary goal[^2].
31+
32+
Other *production* consumers should have the same status as GitHub (unless
33+
they are kind enough to remove their extra requirements). One might hope
34+
they would contribute their requirements as a validation rule but that
35+
seems challenging[^1].
36+
37+
### On URIs
38+
39+
The reporter makes use of URIs for artifacts (~files). Per
40+
["guidance on the use of artifactLocation objects"][3.4.7], `uri` *should*
41+
capture the deterministic part `of` the artifact location and `uriBaseId`
42+
*should* capture the non-deterministic part. However as far as I can tell
43+
pylint has no requirement of (and no clean way to require) consistent
44+
resolution roots: `path` is just relative to the cwd, and there is no
45+
requirement to have project-level files to use pylint. This makes the use of
46+
relative uris dodgy, but absolute uris are pretty much always broken for the
47+
purpose of *interchange* so they're not really any better.
48+
49+
As a side-note, Github [asserts][relative-uri-guidance]
50+
51+
> While this [nb: `originalUriBaseIds`] is not required by GitHub for the
52+
> code scanning results to be displayed correctly, it is required to produce
53+
> a valid SARIF output when using relative URI references.
54+
55+
However per [3.4.4][] this is incorrect, the `uriBaseId` can be resolved
56+
through end-user configuration, `originalUriBaseIds`, external information
57+
(e.g. envvars), or heuristics.
58+
59+
It would be nice to document the "relative root" via `originalUriBaseIds`
60+
(which may be omitted for that purpose per [3.14.14][], but per the above
61+
claiming a consistent project root is dodgy.
62+
63+
We *could* resolve known project files (e.g. pyproject.toml, tox.ini, etc...)
64+
in order to find a consistent root (project root, repo root, ...) and
65+
set / use that for relative URIs but that's a lot of additional complexity
66+
which I'm not sure is warranted.
67+
68+
## Prior art
69+
70+
- [pylint2sarif](https://github.com/GrammaTech/pylint-sarif) by @fishoak
71+
(Paul Anderson, member of the SARIF committee)
72+
- [`Sarif.Multitool convert`][] advertises pylint json input
73+
74+
## TODO
75+
76+
- Validation test via the official validator?
77+
78+
It's a bit difficult as `Sarif.Multitool` is a C# utility distributed via
79+
nuget, there is also a distribution via npm (`@microsoft/sarif-multitool`)
80+
but it's just an installation convenience, it fetches and runs the C#
81+
package (including a redistributable C# runtime, see
82+
`@microsoft/sarif-multitool-linux`)
83+
84+
[^1]: the validator seems like a pretty complicated C# project, the
85+
[Contributing a SARIF Validation Rule](https://github.com/microsoft/sarif-sdk/blob/main/docs/Contributing%20a%20SARIF%20Validation%20Rule.md)
86+
document is all dead links, and requests have mostly been rotting:
87+
right now there are 14 "New rule" issues open (8 fixed) and
88+
9 "RULE REQUEST" issues (3 fixed, 1 closed as duplicate), looks
89+
like the primary rules contributor / driver has deleted their
90+
account and the rest have generally moved away from the project
91+
(or at least reduced their activity on it)
92+
[^2]: but it's got a bunch of weird rules which either are nonsensical
93+
or are not really provided-for by pylint
94+
95+
[SARIF]: https://sarif.info/
96+
[SARIF validator]: https://sarif.info/Validation
97+
[multi-output configurations]:
98+
https://pylint.readthedocs.io/en/stable/user_guide/usage/output.html#output-options
99+
[`Sarif.Multitool convert`]:
100+
https://github.com/microsoft/sarif-sdk/blob/main/docs/multitool-usage.md
101+
[3.4.4]:
102+
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Toc10540869
103+
[3.4.7]:
104+
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Toc10540872
105+
[3.14.14]:
106+
https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html#_Toc10540936
107+
[relative-uri-guidance]:
108+
https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#relative-uri-guidance-for-sarif-producers

‎pyproject.toml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
[build-system]
2+
requires = ["uv_build>=0.9.25,<0.10.0"]
3+
build-backend = "uv_build"
4+
5+
[project]
6+
name = "pylint-sarif"
7+
version = "0.1.0"
8+
license = "GPL-2.0-only"
9+
description = "SARIF reporter for PyLint"
10+
readme = "README.md"
11+
authors = [
12+
{ name = "Xavier Morel", email = "[email protected]" }
13+
]
14+
keywords = ["pylint", "plugin", "reporter", "sarif"]
15+
classifiers = [
16+
"Development Status :: 4 - Beta",
17+
"Environment :: Plugins",
18+
"Intended Audience :: Developers",
19+
"Operating System :: OS Independent",
20+
"Programming Language :: Python :: 3",
21+
"Programming Language :: Python :: 3.10",
22+
"Programming Language :: Python :: 3.11",
23+
"Programming Language :: Python :: 3.12",
24+
"Programming Language :: Python :: 3.13",
25+
"Programming Language :: Python :: 3.14",
26+
"Topic :: Software Development :: Quality Assurance",
27+
]
28+
requires-python = ">=3.10"
29+
dependencies = [
30+
"pylint>=3.0,<5",
31+
]
32+
33+
[dependency-groups]
34+
dev = [
35+
"tox",
36+
{include-group = "lint"},
37+
{include-group = "typecheck"},
38+
{include-group = "test"},
39+
]
40+
lint = ["ruff"]
41+
typecheck = [
42+
"mypy",
43+
{include-group = "test"}
44+
]
45+
test = [
46+
"pytest",
47+
"jsonschema",
48+
]
49+
50+
[tool.pytest.ini_options]
51+
testpaths = ["tests"]
52+
addopts = "-v"
53+
54+
[tool.ruff]
55+
target-version = "py310"
56+
lint = {"select" = ["E", "F", "W", "I", "UP", "B", "RUF"]}
57+
58+
[tool.mypy]
59+
python_version = "3.10"
60+
strict = true
61+
warn_unreachable = true
62+
show_error_codes = true
63+
exclude = [
64+
"^.venv",
65+
"^build/",
66+
"^dist/",
67+
]
68+
69+
[[tool.mypy.overrides]]
70+
module = [
71+
"astroid.*",
72+
"pylint.*",
73+
]
74+
ignore_missing_imports = true

0 commit comments

Comments
 (0)