[xnyo]

Changes

• Extends the coderules analyzer (semgrep) to include marketplace licensing checks
• Add a way to disable specific semgrep rules by default

---

The new semgrep rules checks if a plugin contains marketplace licensing:

if err := datasource.Manage("grafana-marketplacetest-datasource", plugin.NewDatasource, datasource.ManageOpts{
    Licensing: marketplace.Licensing(marketplace.Opts{}),  // <--- this
}); err != nil {
    log.DefaultLogger.Error(err.Error())
    os.Exit(1)
}

or (for apps)

if err := app.Manage("grafana-marketplacetest-datasource", plugin.NewDatasource, app.ManageOpts{
    Licensing: marketplace.Licensing(marketplace.Opts{}),  // <--- this
}); err != nil {
    log.DefaultLogger.Error(err.Error())
    os.Exit(1)
}

or (nested plugins)

if err := app.Manage("grafana-marketplacetest-app", plugin.NewDatasource, app.ManageOpts{
    Licensing: marketplace.Licensing(marketplace.Opts{        // <--]
        ParentPluginID: "grafana-marketplacetest-datasource"  // <--]-- this
    }),                                                       // <--]
}); err != nil {
	log.DefaultLogger.Error(err.Error())
	os.Exit(1)
}

The new semgrep rules checks imports for both github.com/grafana/grafana-plugin-sdk-go/experimental/marketplace (current package) AND github.com/grafana/grafana-plugin-sdk-go/marketplace: the Go marketplace package will be moved out of experimental soon, and adding both paths will not require us to update the validator when we move marketplace pkg out of experimental pkg

These are disabled by default, they have to run only for marketplace plugins. Non-marketplace plugins will fail this check, and there's no way to fix it: it's a marketplace-specific thing.

To support this, the PR adds a system to disable specific semgrep rules via semgrep metadata field, which is part of its supported schema and can contain arbitrary data attached to the rule that's consumed by whoever runs semgrep:

In the semgrep rules yaml file, a rule can contain:

rules:
  - id: xyz
    metadata: # <-- new field
      plugin-validator:
        disabled-by-default: true
    message: don't do this
    patterns:
        - ...

Then, the rule can be enabled via the validator config:

analyzers:
  code-rules:
    rules:
      code-rules-require-marketplace-licensing:
        enabled: true
        severity: error

Note: disabled rules are still evaluated, but their output is filtered out, which is the same behavior when disabling them via config (when they are enabled by default).

[s4kh]

Somewhat related to #999 - this checks for links from the plugin.json.

[academo]

I generally don't like the idea of having marketplace-specific validator and I wonder if you can consider making this a more generic validator. like "sdk function calls" validator where we can define different rules that define specific symbols we want to find inside the binaries and these marketplace licensing ones being one of them.

[xnyo]

I did more research and it looks like we can use semgrep for this, without a new analyzer. It won't cover any case but it should still be reliable and won't introduce marketplace-specific analyzer. I'll see how it looks like and rework this PR accordingly

[xnyo]

Removed the dedicated analyzer and reworked to use semgrep instead. PR description has been updated with more details. PTAL.