feat(catalog): add opengrep (fully-OSS Semgrep fork)#77
Conversation
Opengrep is an LGPL-2.1 fork of Semgrep that keeps the full analysis engine open-source and avoids the Semgrep Community rule registry's CC-BY-NC-SA restrictions. The CLI is drop-in compatible, so existing semgrep rules and .semgrepignore files work unchanged. - catalog/opengrep.json: github_release_binary install, auto-update on - catalog/COVERAGE.md: bump tool count 55 → 56 - upstream_versions.json: cache latest baseline (1.19.0) Semgrep entry is retained; both tools coexist in the catalog so teams can choose based on licensing needs. Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #77 +/- ##
=======================================
Coverage 66.87% 66.87%
=======================================
Files 21 21
Lines 3230 3230
=======================================
Hits 2160 2160
Misses 1070 1070
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds opengrep to the tool catalog, including its configuration file, upstream version tracking, and documentation updates. The review feedback identifies consistency issues in the coverage documentation where summary counts were not fully updated and suggests maintaining alphabetical order for the new entry in the upstream versions file.
There was a problem hiding this comment.
Pull request overview
Adds opengrep as a new installable tool in the catalog (alongside semgrep), and updates the repository’s tracking/coverage metadata accordingly.
Changes:
- Add
catalog/opengrep.jsonto install opengrep via the existinggithub_release_binaryinstaller (auto-update enabled). - Add an
opengrepentry toupstream_versions.jsonfor upstream version tracking. - Update
catalog/COVERAGE.mdtool count and list to include opengrep.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
upstream_versions.json |
Adds opengrep to the upstream baseline version registry. |
catalog/opengrep.json |
New catalog definition for installing the opengrep binary from GitHub releases. |
catalog/COVERAGE.md |
Increments catalog tool count and inserts opengrep into the listed tools. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…seline - COVERAGE.md: bump github_release_binary 31→32, total 69→71, catalog entries 54→56 (all follow-ons to the opengrep addition that were missed in the first commit) - upstream_versions.json: move opengrep alphabetically between npm and parallel (rest of file was already sorted) Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Summary
catalog/opengrep.json— installs the statically-linked opengrep binary from GitHub releases (v1.19.0 latest) via the existinggithub_release_binaryinstaller; auto-update enabled.semgrepin the catalog alongside — both tools coexist so users can choose based on license/feature needs.upstream_versions.jsonbaseline (+1 entry) and bumpsCOVERAGE.mdtool count 55 → 56.Why both? Opengrep is an LGPL-2.1 fork of Semgrep, created after Semgrep relicensed the Community rule registry to CC-BY-NC-SA. CLI-compatible (same rules, same
.semgrepignore, samenosemgrep:comments), fully-OSS engine, no Pro/account gating. See the companion PR in security-audit-skill for audit guidance.Test plan
bash scripts/installers/github_release_binary.sh opengrep→ installs to~/.local/bin/opengrep, reports1.19.0opengrep --version→1.19.0✅uv run python audit.py opengrep→ ✅ UP-TO-DATE with proper upstream linkuv run pytest -x -q→ 546 passed, 1 skippeduv run pre-commit run --files catalog/opengrep.json catalog/COVERAGE.md upstream_versions.json→ all passing