@comity-dev/validate 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +26 -0
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -57,6 +57,32 @@ Exit codes:
|
|
|
57
57
|
- `2` — configuration / discovery error
|
|
58
58
|
- `3` — required tool not installed
|
|
59
59
|
|
|
60
|
+
## Environment
|
|
61
|
+
|
|
62
|
+
The Semgrep engine shells out to a local Semgrep installation:
|
|
63
|
+
|
|
64
|
+
| Variable | Purpose |
|
|
65
|
+
| ---------------- | ------------------------------------------------------------------------------------------------ |
|
|
66
|
+
| `SEMGREP_BIN` | Path to the `semgrep` executable. Used as-is when it exists; otherwise resolved from PATH. |
|
|
67
|
+
| `SEMGREP_PYTHON` | Path to the Python interpreter that ships the `semgrep` module. The scan is executed with it. |
|
|
68
|
+
|
|
69
|
+
Rules:
|
|
70
|
+
|
|
71
|
+
- An explicit `SEMGREP_PYTHON` always wins and is never silently overridden.
|
|
72
|
+
- A set-but-missing `SEMGREP_PYTHON` is invalid configuration: the engine
|
|
73
|
+
reports `TOOL-UNAVAILABLE` naming the variable instead of falling back to
|
|
74
|
+
another interpreter.
|
|
75
|
+
- When `SEMGREP_PYTHON` is unset, the previous resolution applies
|
|
76
|
+
(`/usr/bin/python3`, `/usr/local/bin/python3`, `/opt/homebrew/bin/python3`,
|
|
77
|
+
then `python3` on PATH).
|
|
78
|
+
- The scan `PATH` is prefixed with the directories of the resolved
|
|
79
|
+
`SEMGREP_BIN` and interpreter so Semgrep finds its sibling `pysemgrep`.
|
|
80
|
+
|
|
81
|
+
```bash
|
|
82
|
+
SEMGREP_BIN=~/.local/bin/semgrep SEMGREP_PYTHON=/opt/homebrew/bin/python3 \
|
|
83
|
+
comity-validate --repo /path/to/repo
|
|
84
|
+
```
|
|
85
|
+
|
|
60
86
|
## Negative fixtures
|
|
61
87
|
|
|
62
88
|
The `src/__fixtures__/third-repo/` directory contains a deliberately invalid repository used by the package's own integration tests. It is **not** scanned by the canonical validate run (the engine excludes `__fixtures__/**`); it is asserted against failure by `src/__tests__/integration.test.ts`.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@comity-dev/validate",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"description": "Thin orchestrator over Comity shared validation tooling. Development tooling.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"private": false,
|
|
@@ -36,8 +36,8 @@
|
|
|
36
36
|
"eslint": "^9.39.5",
|
|
37
37
|
"@comity-dev/schemas": "0.1.1",
|
|
38
38
|
"@comity-dev/dependency-rules": "0.1.1",
|
|
39
|
-
"@comity-dev/eslint-plugin": "0.1.
|
|
40
|
-
"@comity-dev/semgrep-rules": "0.1.
|
|
39
|
+
"@comity-dev/eslint-plugin": "0.1.2",
|
|
40
|
+
"@comity-dev/semgrep-rules": "0.1.2"
|
|
41
41
|
},
|
|
42
42
|
"devDependencies": {
|
|
43
43
|
"@types/node": "^24.13.3",
|