On: Semgrep: Semantic grep for code

[joj123]

Out of curiosity, Is there value in doing this over (say) running a GitHub Action post commit and failing the build if it finds something nasty?

[Spivak → joj123]

If you can catch it before the commit is even made then why do/wait for a build?

[joj123 → Spivak]

Fair enough. Guess IDE plugins work even better for that

[westurner → joj123]

IDE plugins are not at all consistent from one IDE to another. Pre-commit is great for teams with different IDEs because all everyone needs to do is:

  [pip,] install pre-commit
  pre-commit install
  # git commit
  #   pre-commit run --all-files

  # pre-commit autoupdate

https://pre-commit.com/