Developers should consult the makefiles, which are documented. The steps to set up and build everything are normally:
$ make dev-setup # meant to be run infrequently, may not be sufficient
$ make # routine build
$ make test # test everything
There's no simple installation of the development version of the
semgrep command (Python wrapper + semgrep-core binary). To test
semgrep without installing it, use pipenv:
$ cd semgrep
$ pipenv shell
$ semgrep --help
Or more conveniently, you can create a shell function that will call
pipenv from the correct location. For example, if you cloned the
semgrep repo in your home folder (~), you can place the following
code in your ~/.bashrc file and then use semgrep-dev as your
semgrep command:
semgrep-dev() {
PIPENV_PIPFILE=~/semgrep/cli/Pipfile pipenv run semgrep "$@"
}
The Semgrep project has two main parts:
- The Python wrapper in the
cli/folder, which has its own makefile needed for some preprocessing and for testing. Read the makefile to see what targets are available. - The OCaml core in the
src/folder. Read the toplevel makefile to see what's available to the developer.
The main Dockerfile serves as a reference on how to
build Semgrep for Linux. The usual instructions for building a Docker
image apply. It should be:
$ docker build -t semgrep .
Contribution guidelines and developer documentation are available from Semgrep's documentation website.