Support a fix mode?

[woodruffw]

Many findings are trivially fixable and insert-only, e.g. inserting persist-credentials: false. It would be nice to expose a --fix flag or similar that could apply these.

Implementation-wise, this should probably happen at tree-sitter level, since tree-sitter has mature support for modifying trees.

[woodruffw]

Thinking out loud: it wouldn't be too hard to add some kind of .fix(...) to each SymbolicLocation, which yamlpath would then need to properly situate. That would work fine for whole key replacements/insertions, but modifying pre-existing strings/values would be slightly more complicated.

[woodruffw]

#136 and #129 are continuing to reveal that there are a lot of false positives with template injection, since the github.* context's namespace is massive.

A fix mode could help a little bit here by offloading the work of identifying many of these: GitHub provides default environment variables that cover many common context accesses, and we could suggest/autofix users into those.

[netomi]

I would love to see a fix mode similar to e.g. ruff.

We developed a simple tool to do action pinning, see: https://github.com/eclipse-csi/octopin, but ultimately, we would like to do other fixes that your tool detects as well. So I could work on a PR to add some action pinning as initial fix. Though I have not used rust before, so that might require some iterations.

[woodruffw]

So I could work on a PR to add some action pinning as initial fix. Though I have not used rust before, so that might require some iterations.

Please feel free! The main challenge here (I think) will be doing this at the AST level, and not with regular expressions or other string patching techniques.

My plan was to look into doing that with tree-sitter-yaml, but I won't get to it in the near future so I welcome any efforts here 🙂

[netomi]

So I looked into tree-sitter for another usecase (to modify jsonnet AST), but apparently, tree-sitter does not support editing the AST it generates: tree-sitter/tree-sitter#2667

There are workarounds that I found, but that is not what you wanna do imho as they are very hacky afaict.

go-yaml seems to have some support to preserve whitespace and comments when you do a roundtrip, not sure if something like this exists for rust as well. Having a full blown AST parser that supports source preserving roundtrips would be preferred ofc.

[woodruffw]

https://github.com/langston-barrett/tree-sitter-edit looks like it might be exactly what we need here (hello @langston-barrett 😉)

[bepp-boop]

Yea I able to edit them by capture which give them index of it and from there you can stringify them and edit it and added back in from the index position. I.E
Added new line = Index 0. You added stuff you need to + original code.
Change something = Stringify the capture value, edit them with a function that scan for it.
It doesnt really solve a issues relate to intepolation though

[bepp-boop]

I saw ast-grep, any one have idea perspective as potential usage?

[woodruffw]

I hadn't see ast-grep before, but it looks promising. Looks like they have pattern matching and rewrite support for YAML.

Looks like ast_grep_core is what we'd want: https://docs.rs/ast-grep-core/latest/ast_grep_core/

[bepp-boop]

• name: Example step
  uses: roots/issue-closer@v1
  with:
  issue-close-message: Closing ${{ github.event.issue.title }}

it can be made safer by converting it into:

• name: Example step
  uses: roots/issue-closer@v1
  env:
  NAME: ${{ github.event.issue.title }} # <- Assign the expression to an environment variable
  with:
  issue-close-message: Closing ${process.env.NAME}

Yea the issues is determine the right shell which would then give it the right interpolation string

[bepp-boop]

but yea you are right, it support but the docs and tool is a bit a wrestling to get it to function properly

[woodruffw]

#858 will add the groundwork for this, thanks to @mostafa's hard work!

This is going to end up being quite a large feature, so I'm going to open up a separate meta-issue for tracking the various things a fix mode will ideally do.

[woodruffw]

Closing in favor of feature tracking in #876.