CONTRIBUTING.md

Contribution Guide

• Guides
  • Configure TestPyPi and PyPi
  • Configure Snapcraft
  • Test and publish a new Python release with PyPi and TestPyPi
  • Publish a new Snap release
  • Add a new source with Semgrep rules

Guides

Configure TestPyPi and PyPi

1. Configure TestPyPi: poetry config repositories.test-pypi https://test.pypi.org/legacy/
2. Grab your token from TestPyPi.
3. Configure the TestPyPi token: poetry config pypi-token.test-pypi <token>
4. Grab your token from PyPi.
5. Configure the TestPyPi token: poetry config pypi-token.pypi <token>

Configure Snapcraft

1. Install Snapcraft: snap install --classic snapcraft
2. Init LXD: lxd init --audo (optional)
3. Login to Snapcraft by following one official guide.

Test and publish a new Python release with PyPi and TestPyPi

1. If TestPyPi and PyPi are not configured, follow the corresponding guide.
2. Update the version in pyproject.toml.
3. Build the new version: poetry build
4. Publish to TestPyPi: poetry publish -r test-pypi -u <username>
5. Install the package through TestPyPi: pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ semgrep-rules-manager
6. Execute your tests by leveraging the semgrep-rules-manager command.
7. If all your tests are passing, publish to PyPi: poetry publish -u <username>
8. Try to install the package from PyPi: pip install semgrep-rules-manager

Publish a new Snap release

1. If Snapcraft is not configured, follow the corresponding guide.
2. Change the version in snap/snapcraft.yaml.
3. Build the snap: snapcraft
4. Install the created snap: snap install --dangerous semgrep-rules-manager_*.snap
5. Execute your tests by leveraging the semgrep-rules-manager command.
6. If all your tests are passing, upload to Snapstore: snapcraft push <snap_file>

Add a new source with Semgrep rules

1. Add a new entry in semgrep_rules_manager/data/sources.yaml.
2. Commit and push (eventually, through a fork) the changes.
3. Pull the README.* files automatically generated by the GitHub action.
4. Update the version in snap/snapcraft.yaml and pyproject.toml with a .post<N> prefix or a new minor version.
5. Publish a new PyPi release.
6. Publish a new Snap release.