Add codemod ID #35
Add codemod ID #35
Conversation
codetf.md
Outdated
|
|
||
| Each component of the ID has a particular meaning: | ||
|
|
||
| * `<origin>`: Origin describes the source of the analysis or transformation. For example, "find and fix" codemods provided by Pixee are labelled with the origin "pixee". Codemods that remediate issues found by a static analysis tool might be labelled with the origin corresponding to that tool name (e.g. "semgrep" or "codeql"). Implementers of custom codemods may use a unique identifier that is specific to their organization or tool. |
There was a problem hiding this comment.
Origin describes the source of the analysis or transformation
I feel like it should always be the source of the analysis and never the transformation.
Let's consider the custom codemod use case. If a user develops a custom Sonar codemod and wants to use it with our platform, the origin better be "sonar", or our platform will not consider it to be a Sonar codemod that gets access to Sonar results.
If you agree, then can we rename this to scanner()? I have come across places in our platform where we actually translate "origin" to "scanner", and I think the latter makes more sense.
There was a problem hiding this comment.
I don't like scanner because there's no reason codemodder couldn't take input from non-scanner sources of code information, like observability tools, IAST, etc.
There was a problem hiding this comment.
I like detector. This fits with the way we talk about it in codemodder architecture.
There was a problem hiding this comment.
I love it when we use the same words everywhere 😊
codetf.md
Outdated
|
|
||
| Each component of the ID has a particular meaning: | ||
|
|
||
| * `<origin>`: Origin describes the source of the analysis or transformation. For example, "find and fix" codemods provided by Pixee are labelled with the origin "pixee". Codemods that remediate issues found by a static analysis tool might be labelled with the origin corresponding to that tool name (e.g. "semgrep" or "codeql"). Implementers of custom codemods may use a unique identifier that is specific to their organization or tool. |
There was a problem hiding this comment.
Codemods that remediate issues found by a static analysis tool
Our docs use the term fix only codemods, but I don't think that has stuck.
I've left some wiggle room in the description of the "origin" component, but we may want to draw a harder line.