Skip to main content

Git-aware utility for automated program analysis

Project description

[alpha] A Git-aware CLI for running semgrep patterns in the developer and CI workflow.

Installation · Usage · Help & Community

PyPI PyPI - Downloads Issues welcome! Follow @r2cdev

Installation

Requires Python 3.6+ and Docker 19.03+. It runs on macOS and Linux.

In a Git project directory:

$ pip3 install bento-headless

Usage

Upgrading

$ pip3 install --upgrade bento-headless

Command line options

$ bentoh --help
Usage: bentoh [OPTIONS] COMMAND [ARGS]...

Options:
  -h, --help  Show this message and exit.
  --version   Show the version and exit.

Commands:
  archive  Suppress current findings.
  check    Checks for new findings.

  To get help for a specific command, run `bentoh COMMAND --help`

Run custom semgrep checks on staged diffs

See semgrep Configuration for how to write custom rule files

vi .bento/semgrep.yml
bentoh check

Format output as JSON

bentoh check -f json

Run on file system current state

bentoh check --all

Run on staged diffs in a directory

bentoh check src

Ignore current findings

bentoh archive

Run public semgrep checks on staged diffs

BENTO_REGISTRY=r/r2c.python bentoh check

Run checks from extensions

bentoh check -t gosec -t r2c.registry.latest

Exit codes

bentoh check may exit with the following exit codes:

  • 0: Bento ran successfully and found no errors
  • 2: Bento ran successfully and found issues in your code
  • 3: Bento or one of its underlying tools failed to run

Extensions

bentoh ships with the following extensions:

Extension Description
bandit Finds common security issues in Python code
dlint A tool for encouraging best coding practices and helping ensure Python code is secure
eslint Identifies and reports on patterns in JavaScript and TypeScript
flake8 Finds common bugs in Python code
gosec Finds security bugs in Go code
hadolint Finds bugs in Docker files (requires Docker)
r2c.boto3 Checks for the AWS boto3 library in Python
r2c.flask Checks for the Python Flask framework
r2c.jinja Finds common security issues in Jinja templates
r2c.registry.latest Runs checks from r2c's check registry (experimental; requires Docker)
r2c.requests Checks for the Python Requests framework
shellcheck Finds bugs in shell scripts (requires Docker)

Help and community

Need help or want to share feedback? We’d love to hear from you!

We’re constantly shipping new features and improvements.

License and legal

Please refer to the terms and privacy document.



r2c logo

Copyright (c) r2c.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

bento-headless-0.11.2.tar.gz (88.2 kB view details)

Uploaded Source

Built Distribution

bento_headless-0.11.2-py3-none-any.whl (120.2 kB view details)

Uploaded Python 3

File details

Details for the file bento-headless-0.11.2.tar.gz.

File metadata

  • Download URL: bento-headless-0.11.2.tar.gz
  • Upload date:
  • Size: 88.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: poetry/1.0.3 CPython/3.7.4 Darwin/18.7.0

File hashes

Hashes for bento-headless-0.11.2.tar.gz
Algorithm Hash digest
SHA256 0cb9281a3db27a329ec49bb6f5a844b2981353c37fbab5393c40a197e4794e35
MD5 2de494856a3715ca9a60a6cf0b74eb75
BLAKE2b-256 d201f589e74576805405656941aa8f508300c3e819f19837d38f061e9e388793

See more details on using hashes here.

File details

Details for the file bento_headless-0.11.2-py3-none-any.whl.

File metadata

  • Download URL: bento_headless-0.11.2-py3-none-any.whl
  • Upload date:
  • Size: 120.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: poetry/1.0.3 CPython/3.7.4 Darwin/18.7.0

File hashes

Hashes for bento_headless-0.11.2-py3-none-any.whl
Algorithm Hash digest
SHA256 c23189bc2f0ab7af1d3c354a0f4be2984b1a973e37565e3a44811abaf5bc8106
MD5 cd33a34888da45534390f70d3e42eebf
BLAKE2b-256 9e94cf7b092469ee2dc7be66ced43ea53e9b66413d4d846e0b2fcd850f4e3a89

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page