31–40 of 54 posts
>The engine performs an automatic check each time code is committed to GitHub What if we don't use GitHub but something else? Are you hooks able to run purely in git?
Funny we built almost the same product 6 years ago (sold it to a competitor), we even did automated refactoring of Python code. We also developed a regex-like language that could operate on abstract syntax trees / annotated graphs, which we wrote all our checks with. We were working on extending that with a graph database backend and symbolic execution, basically building a large code graph that we would perform patt…
Funny we built almost the same product 6 years ago (sold it to a competitor), we even did automated refactoring of Python code. We also developed a regex-like language that could operate on abstract syntax trees / annotated graphs, which we wrote all our checks with. We were working on extending that with a graph database backend and symbolic execution, basically building a large code graph that we would perform patt…
I would love to hear more about your experience! could you please email me at Shimon [AT] Datree IO? I believe that now is the right time for a solution like Datree. I think so because of the way we develop software has evolved, companies moved from Waterfall into Agile, there is developer autonomy and the move towards distributed micro-services has brought many companies to the reality of having hundreds and thousan…
Beware that Github recently acquired Semmle, they had one of the best static analysis offerings and I think Github acquired them to integrate their solution natively into the platform, so I wouldn't focus exclusively on Github as they might become your competitor very soon. In many enterprise settings Gitlab seems to be the more popular choice already, so it might be worth looking at integrating with that as well.
>What we built is a rules engine, which is essentially a server-side git-hook platform. Isn't it too late once it is committed to github? It seems like this would be much more useful as a service running as a precommit hook on each workstation. Probably harder to ship/monetize that but as far as actually solving the problem wouldn't that be better?
>What we built is a rules engine, which is essentially a server-side git-hook platform. Isn't it too late once it is committed to github? It seems like this would be much more useful as a service running as a precommit hook on each workstation. Probably harder to ship/monetize that but as far as actually solving the problem wouldn't that be better?
As far as I know Github has their own technology for blocking code pushes that contains e.g. AWS secrets. I think it happened a lot that people pushed such secrets to the platform and Github's streaming API makes/made it really easy for adversaries to catch those and start abusing them within seconds.
We do several of these things, and bundling them together looks nice; I imagine troubleshooting the pipeline is much easier. We would need the enterprise version because we are on-prem, and our user count compared against the 'pro' edition makes me think this would be a hard sell - high 5 figures/year to replace a few shell scripts is tough.
Looks good. We were trying to implement this using a mix of CI, pre-commit hooks and Gitlab PR templates, but it was limiting. This looks like exactly what we needed. Regarding custom rules, does the tool run automated tests for those too?
Any plans to expand to other VCS hosting services(bitbucket specifically)?