globstar

es in Go) for any language with very high accuracy (which is where we have an advantage as compared to tools that use a custom DSL). To that extent, we're focused on improving the runtime itself so we can support complex use cases from our YAML and Go interfaces. If the community can help us port rules from other sources to our built-in checkers, we'd love that! [1] https://github.com/DeepSourceCorp/globstar/pulls

in the Go code — but this is on our roadmap to improve. We want to expose a lot more helpers to make doing things like taint analysis easily. Here's another idea [4] we're exploring to make the YAML interface more powerful: adding support for utilities (like entropy calculation) that you can call and perform a comparison. [1] https://globstar.dev/guides/writing-go-checker#_1-complex-pa... [2] https://globstar.dev/reference/checker-go#analysis-function [3] https://globstar.dev/reference/checker-go#state-tracking [4] https://github.com/DeepSourceCorp/globstar/issues/27

eate new checkers. We realized that making the framework open-source could solve this problem for everyone. Our key insight was that writing checkers isn't the hard part anymore. Modern AI assistants like ChatGPT and Claude are excellent at generating tree-sitter queries with very high accuracy. We realized that the tree-sitters' gnarly s-expression syntax isn’t a problem anymore (since the AI will be doing all the generation anyway), and we can instead focus on building a fast, flexible, and reliable checker runtime around it. So instead of creating yet another DSL, we use tree-sitter's native query syntax. Yes, the expressions look more complex than simplified DSLs, but they give you direct access to your code's actual AST structure – which means your rules work exactly as you'd expect them to. When you need to debug a rule, you're working with the actual structure of your code, not an abstraction that might hide important details. We've also designed Globstar to have a gradual learning curve: The YAML interface works well for simple checkers, and the Go Interface can handle complex scenarios when you need features like cross-file analysis, scope resolution, data flow analysis, and context awareness. The Go API gives you direct access to tree-sitter bindings, so you can write arbitrarily complex checkers on day one. Key features: - Written in Go with native tree-sitter bindings, distributed as a single binary - MIT-licensed - Write all your checkers in a “.globstar” folder in your repo, in YAML or Go, and just run “globstar check” without any build steps - Multi-language support through tree-sitter (20+ languages today) We have a long way to go and a very exciting roadmap for Globstar, and we’d love to hear your feedback! [1] https://globstar.dev/guides/writing-yaml-checker [2] https://globstar.dev/guides/writing-go-checker [3] https://tree-sitter.github.io/tree-sitter/