tyhal / crie Goto Github PK

Straight forward meta-linter trying to cover all languages

License: MIT License

Dockerfile 6.80% CSS 0.15% Shell 8.14% CMake 0.56% C++ 1.37% Go 64.38% Groovy 0.04% Haskell 0.06% JavaScript 3.16% Python 3.10% R 0.08% HCL 0.33% C 1.93% Less 0.62% SCSS 9.27%

code-quality linter static-code-analysis docker

crie's Introduction

crie.

Effectively format and lint code for a variety of languages

Features

This tool enables teams of developers to use static-analysis where they normally wouldn't:

Avoid remembering multiple run configurations
Avoid various install instructions

Quality of Life:

Git friendly - Only check changed files in the last few commits
Extendable for more languages
Fast and clean output
Batteries included but swappable - Swap any implementation with another linter
Identify files lacking any static-analysis

Install

Getting the tool

    go install github.com/tyhal/crie/cmd/crie@latest

The suggested way to start running crie is to run chk at the top of your project and add --continue to see every error in the project (this will not change any code)

    crie chk --continue

crie's People

Stargazers

Watchers

Forkers

largerock lgtm-migrator

crie's Issues

Dependabot can't parse your go.mod

Dependabot couldn't parse the go.mod found at /go.mod.

The error Dependabot encountered was:

go: gopkg.in/[email protected] requires
	gopkg.in/[email protected]: invalid version: git fetch -f origin refs/heads/*:refs/heads/* refs/tags/*:refs/tags/* in /opt/go/gopath/pkg/mod/cache/vcs/9241c28341fcedca6a799ab7a465dd6924dc5d94044cbfabb75778817250adfc: exit status 128:
	fatal: The remote end hung up unexpectedly

View the update logs.

Ansible Galaxy install for ansible-lint

make another tool that wraps the api and integrates with things

CPP Projects

INFO type=stdout
ERRO type=stderr
DEBU pipe2: too many open files type=err
INFO type=stdout
ERRO type=stderr
DEBU pipe2: too many open files type=err

list command is ugly need to be a table

Configuration files not in standard location

Generate codeclimate.json

https://docs.gitlab.com/ee/user/project/merge_requests/code_quality_diff.html

Project configuration to use logstash for logs

https://github.com/bshuster-repo/logrus-logstash-hook

git-diff 10 doesn't grab last ten

but git-diff 9 works correctly

looks like passing args to git incorrectly

File naming convention enforcement

Add scn (scan) to do security checks

Checkstyle for Java

https://github.com/checkstyle/checkstyle

Duplicated error message

➜ crie cmt
Error: unknown command "cmt" for "crie"

Did you mean this?
chk
fmt

Run 'crie --help' for usage.
unknown command "cmt" for "crie"

Did you mean this?
chk
fmt

Fix colour missing on shellcheck

Add pinup for upgrading scripts and dockerfiles

Go Metalinter

https://github.com/alecthomas/gometalinter

use an inteface for Fmt and Chk

Cant download latest

➜ crie fmt
Unable to find image 'tyhal/crie:latest' locally
docker: Error response from daemon: manifest for tyhal/crie:latest not found.
See 'docker run --help'.

Project NONs

kubernetes/kubernetes

Original:

+------------+-------+
| EXTENSION  | COUNT |
+------------+-------+
| BUILD      |  3167 |
| OWNERS     |   477 |
| LICENSE    |   226 |
| .s         |   123 |
| .gitignore |   103 |
| .mod       |    79 |
| Makefile   |    65 |
| .sum       |    61 |
| .response  |    61 |
| .request   |    61 |
| VERSION    |    36 |
+------------+-------+

Latest:
7m 13s - crie all

+------------+-------+
| EXTENSION  | COUNT |
+------------+-------+
| BUILD      |  3203 |
| OWNERS     |   476 |
| LICENSE    |   227 |
| .s         |   123 |
| .gitignore |   103 |
| .mod       |    80 |
| Makefile   |    62 |
| .request   |    61 |
| .response  |    61 |
| .sum       |    61 |
| VERSION    |    32 |
+------------+-------+

Fix up CLI information

Lots of minor errors

Case, Description, Remove quotes

Need to upgrade hadolint to use new shellcheck

logrus formatter that reduces clutter of INFO

CVE-2017-18342 (High) detected in PyYAML-3.13.tar.gz

CVE-2017-18342 - High Severity Vulnerability

Vulnerable Library - PyYAML-3.13.tar.gz

YAML parser and emitter for Python

Library home page: https://files.pythonhosted.org/packages/9e/a3/1d13970c3f36777c583f136c136f804d70f500168edc1edea6daa7200769/PyYAML-3.13.tar.gz

Path to dependency file: /crie/requirements.txt

Path to vulnerable library: teSource-ArchiveExtractor_2dd19b17-724d-4c99-9d1e-9a4b98d0e525/20190714111911_81288/20190714111853_depth_0/2/PyYAML-3.13.tar/PyYAML-3.13

Dependency Hierarchy:

❌ PyYAML-3.13.tar.gz (Vulnerable Library)

Found in HEAD commit: 2f95a094e895c72ded51fdc62e0398ae3ad0d04c

Vulnerability Details

In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.

Publish Date: 2018-06-27

URL: CVE-2017-18342

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-18342

Release Date: 2018-06-27

Fix Resolution: 4.1

Step up your Open Source Security Game with WhiteSource here