• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

pantsbuild / pants / 19015773527

02 Nov 2025 05:33PM UTC coverage: 17.872% (-62.4%) from 80.3%
19015773527

Pull #22816

github

web-flow
Merge a12d75757 into 6c024e162
Pull Request #22816: Update Pants internal Python to 3.14

4 of 5 new or added lines in 3 files covered. (80.0%)

28452 existing lines in 683 files now uncovered.

9831 of 55007 relevant lines covered (17.87%)

0.18 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/src/python/pants/backend/tools/semgrep/subsystem.py
1
# Copyright 2023 Pants project contributors (see CONTRIBUTORS.md).
2
# Licensed under the Apache License, Version 2.0 (see LICENSE).
3

UNCOV
4
from __future__ import annotations
×
5

UNCOV
6
from collections.abc import Iterable
×
UNCOV
7
from dataclasses import dataclass
×
8

UNCOV
9
from pants.backend.python.subsystems.python_tool_base import PythonToolBase
×
UNCOV
10
from pants.backend.python.target_types import ConsoleScript
×
UNCOV
11
from pants.core.goals.resolves import ExportableTool
×
UNCOV
12
from pants.engine.rules import Rule, collect_rules
×
UNCOV
13
from pants.engine.target import Dependencies, FieldSet, SingleSourceField, Target
×
UNCOV
14
from pants.engine.unions import UnionRule
×
UNCOV
15
from pants.option.option_types import ArgsListOption, BoolOption, SkipOption, StrOption
×
UNCOV
16
from pants.util.strutil import softwrap
×
17

18

UNCOV
19
@dataclass(frozen=True)
×
UNCOV
20
class SemgrepFieldSet(FieldSet):
×
UNCOV
21
    required_fields = (SingleSourceField, Dependencies)
×
UNCOV
22
    source: SingleSourceField
×
UNCOV
23
    dependencies: Dependencies
×
24

UNCOV
25
    @classmethod
×
UNCOV
26
    def opt_out(cls, tgt: Target) -> bool:
×
27
        # FIXME: global skip_semgrep field?
28
        return False
×
29

30

UNCOV
31
class SemgrepSubsystem(PythonToolBase):
×
UNCOV
32
    name = "Semgrep"
×
UNCOV
33
    options_scope = "semgrep"
×
UNCOV
34
    help_short = softwrap(
×
35
        """
36
        Lightweight static analysis for many languages. Find bug variants with patterns that look
37
        like source code. (https://semgrep.dev/)
38

39
        Pants automatically finds config files (`.semgrep.yml`, `.semgrep.yaml`, and `.yml` or
40
        `.yaml` files within `.semgrep/` directories), and runs semgrep against all _targets_ known
41
        to Pants.
42
        """
43
    )
44

UNCOV
45
    default_main = ConsoleScript("semgrep")
×
UNCOV
46
    default_requirements = [
×
47
        "semgrep>=1.20.0,<2",
48
        # As of version 1.79.0, semgrep depends on outdated opentelemetry packages, that
49
        # themselves depend on the deprecated pkg_resources API, leading to warnings.
50
        # When semgrep updates its own requirements appropriately, we can remove these pins.
51
        # See https://github.com/semgrep/semgrep/issues/11069.
52
        "opentelemetry-api~=1.34.1",
53
        "opentelemetry-sdk~=1.34.1",
54
        "opentelemetry-exporter-otlp-proto-http~=1.34.1",
55
        "opentelemetry-instrumentation-requests~=0.55b1",
56
    ]
57

UNCOV
58
    register_interpreter_constraints = True
×
UNCOV
59
    default_interpreter_constraints = ["CPython>=3.9,<3.14"]
×
60

UNCOV
61
    register_lockfile = True
×
UNCOV
62
    default_lockfile_resource = ("pants.backend.tools.semgrep", "semgrep.lock")
×
63

UNCOV
64
    config_name = StrOption(
×
65
        default=None,
66
        help=softwrap(
67
            """
68
            The name of the semgrep config file or directory, which will be discovered and used
69
            hierarchically. If using a file, it must have the extension `.yaml` or `.yml`.
70

71
            URLs and registry names are not supported.
72
            """
73
        ),
74
    )
75

UNCOV
76
    args = ArgsListOption(
×
77
        example="--verbose",
78
        default=["--quiet"],
79
        extra_help="This includes --quiet by default to reduce the volume of output.",
80
    )
81

UNCOV
82
    skip = SkipOption("lint")
×
83

UNCOV
84
    force = BoolOption(
×
85
        default=False,
86
        help=softwrap(
87
            """
88
            If true, semgrep is always run, even if the input files haven't changed. This can be
89
            used to run cloud rulesets like `pants lint --semgrep-force
90
            --semgrep-args='--config=p/python' ::`. Without `--semgrep-force`, using the cloud
91
            rulesets may give inconsistent results on different machines, due to caching, because
92
            the rulesets may change.
93
            """
94
        ),
95
        advanced=True,
96
    )
97

98

UNCOV
99
def rules() -> Iterable[Rule | UnionRule]:
×
UNCOV
100
    return [
×
101
        *collect_rules(),
102
        UnionRule(ExportableTool, SemgrepSubsystem),
103
    ]
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2025 Coveralls, Inc