press-semgrep-rules.yml

rules:
  - id: possible-mutable-default-args
    pattern-either:
      - pattern: |
          def $FUNC(..., $ARG = $FUNC2(...), ...):
            ...
      - pattern: |
          def $FUNC(..., $ARG = $FUNC2(...).$ATTR, ...):
            ...
      - pattern: |
          def $FUNC(..., $ARG = frappe.$ATTR, ...):
            ...

    message: |
      `$ARG` is possibly a mutable default argument. May not work as expected during subsequent calls of `$FUNC` without $ARG.
    languages:
      - python
    severity: WARNING
    metadata:
      category: correctness
      technology:
        - python
      references:
        - https://docs.python-guide.org/writing/gotchas/#mutable-default-arguments

  - id: frappe-using-db-sql
    pattern-either:
      - pattern: frappe.db.sql(...)
      - pattern: frappe.db.sql_ddl(...)
      - pattern: frappe.db.sql_list(...)
    paths:
      exclude:
        - "test_*.py"
    message: |
      The PR contains a SQL query that may be re-written with frappe.qb (https://frappeframework.com/docs/user/en/api/query-builder) or the Database API (https://frappeframework.com/docs/user/en/api/database)
    languages: [python]
    severity: WARNING

  - id: except-with-db-code
    languages:
      - python
    patterns:
      - pattern-inside: |
          try:
            ...
          except ...:
            $ERR_HANDL_BLK
      - pattern-either:
          - pattern: |
              try:
                ...
              except ...:
                ...
                $DOC.save(...)
                ...
                raise
                ...
          - pattern: |
              try:
                ...
              except ...:
                ...
                frappe. ... .set_value(...)
                ...
                raise
                ...
          - pattern: |
              try:
                ...
              except ...:
                ...
                $DOC.db_set(...)
                ...
                raise
                ...
      - pattern-not: |
          try:
            ...
          except ...:
            ...
            $DOC.save(...)
            ...
            frappe.db.commit(...)
            raise
          ...
      - pattern-not: |
          try:
            ...
          except ...:
            ...
            frappe. ... .set_value(...)
            ...
            frappe.db.commit(...)
            raise
            ...
      - pattern-not: |
          try:
            ...
          except ...:
            ...
            $DOC.db_set(...)
            ...
            frappe.db.commit(...)
            ...
            raise
            ...
      - focus-metavariable: $ERR_HANDL_BLK

    message: except block has no db commit before raise. The db changes made won't persist assuming innodb tables.
    severity: ERROR

  - id: retries-without-until
    languages:
      - yaml
    patterns:
      - pattern: |
          ...
          retries: $RETRIES
          delay: $DELAY
          ...

      - pattern-not: |
          ...
          retries: $RETRIES
          delay: $DELAY
          until: $UNTIL
          ...

    paths:
      include:
        - 'press/playbooks/**/*.yml'
    message: retry block doesn't have until condition. Only works with ansible 2.16 and above.
    severity: ERROR
    metadata:
      category: correctness
      references:
        - https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_loops.html#retrying-a-task-until-a-condition-is-met
        - https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-community-changelogs