semgrep: Add versions 1.175.0, 1.175.1, 1.176.0, 1.176.1, 1.177.0, 1.178.0

.github/workflows/build-semgrep.yml

@@ -65,11 +65,24 @@ jobs:
       SEMGREP_VERSION: ${{ matrix.version }}
 
     steps:
+      # Some semgrep patch releases (e.g. 1.175.1, 1.176.1) are republished under a
+      # bumped version with no corresponding git tag; fall back to the same
+      # major.minor's .0 tag, which their sdists are byte-identical to otherwise.
+      - name: Resolve upstream ref for v${{ env.SEMGREP_VERSION }}
+        id: upstream_ref
+        run: |
+          if git ls-remote --exit-code --tags https://github.com/semgrep/semgrep "refs/tags/v${SEMGREP_VERSION}" >/dev/null; then
+            ref="v${SEMGREP_VERSION}"
+          else
+            ref="v${SEMGREP_VERSION%.*}.0"
+          fi
+          echo "ref=${ref}" >> "$GITHUB_OUTPUT"
+
       - name: Checkout semgrep v${{ env.SEMGREP_VERSION }}
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: semgrep/semgrep
-          ref: v${{ env.SEMGREP_VERSION }}
+          ref: ${{ steps.upstream_ref.outputs.ref }}
           submodules: true
           persist-credentials: false
 
@@ -82,6 +95,48 @@ jobs:
       - name: Apply riscv64 patches
         run: git apply -v python-wheels/patches/semgrep/${{ env.SEMGREP_VERSION }}/*.patch
 
+      # v1.177.0's own tag has ~35 languages/*/tree-sitter/*/lib/parser.c files checked in
+      # as literal Git LFS pointer stubs instead of their generated content -- a real
+      # upstream bug from squash-merging the per-language submodules into the main tree
+      # without resolving their LFS objects first (fixed again in v1.178.0). No `lfs: true`
+      # fixes this: the tag's own .gitattributes never marks these paths for LFS, so a
+      # correct checkout produces exactly this pointer text. See CLAUDE.md gotcha 569.
+      # No-op (and harmless) for every version but 1.177.0, which is the only one with a
+      # fixups manifest.
+      - name: Repair upstream Git LFS pointer stubs
+        shell: bash
+        run: |
+          set -eu
+          manifest="python-wheels/patches/semgrep/${SEMGREP_VERSION}/lfs-pointer-fixups.tsv"
+          if [ ! -f "$manifest" ]; then
+            echo "No LFS pointer fixups listed for ${SEMGREP_VERSION}; nothing to repair."
+            exit 0
+          fi
+          while IFS=$'\t' read -r path org repo commit rel; do
+            case "$path" in ''|'#'*) continue ;; esac
+            first_line=$(head -n1 "$path")
+            if [ "$first_line" != "version https://git-lfs.github.com/spec/v1" ]; then
+              echo "skip $path: no longer an LFS pointer stub"
+              continue
+            fi
+            oid=$(sed -n 's/^oid sha256://p' "$path" | head -n1)
+            size=$(sed -n 's/^size //p' "$path" | head -n1)
+            echo "Repairing $path from $org/$repo@$commit:$rel (want sha256=$oid size=$size)"
+            curl -fsSL "https://raw.githubusercontent.com/$org/$repo/$commit/$rel" -o "$path.real"
+            actual_size=$(wc -c <"$path.real")
+            actual_oid=$(sha256sum "$path.real" | cut -d' ' -f1)
+            if [ "$actual_oid" != "$oid" ] || [ "$actual_size" != "$size" ]; then
+              echo "::error::LFS pointer repair mismatch for $path: expected sha256=$oid size=$size, got sha256=$actual_oid size=$actual_size"
+              exit 1
+            fi
+            mv "$path.real" "$path"
+          done < "$manifest"
+
+      - name: Stamp package version
+        run: |
+          sed -i "s/^version = \".*\"/version = \"${SEMGREP_VERSION}\"/" cli/pyproject.toml
+          sed -i "s/^__VERSION__ = \".*\"/__VERSION__ = \"${SEMGREP_VERSION}\"/" cli/src/semgrep/__init__.py
+
       - name: Build semgrep-core and the wheel
         shell: bash
         run: |

docs/packages/semgrep.yaml

@@ -12,3 +12,9 @@ versions:
   gpl-sources:
     filename: gpl-sources.tar
     description: the shared libraries bundled next to semgrep-core
+- version: 1.175.0
+- version: 1.175.1
+- version: 1.176.0
+- version: 1.176.1
+- version: 1.177.0
+- version: 1.178.0

patches/semgrep/1.175.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39.patch

@@ -0,0 +1,26 @@
+From: RISE Project <info@riseproject.dev>
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+
+

patches/semgrep/1.175.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39.patch

@@ -0,0 +1,26 @@
+From: RISE Project <info@riseproject.dev>
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+
+

patches/semgrep/1.176.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39.patch

@@ -0,0 +1,26 @@
+From: RISE Project <info@riseproject.dev>
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+
+

patches/semgrep/1.176.1/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39.patch

@@ -0,0 +1,26 @@
+From: RISE Project <info@riseproject.dev>
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+
+

patches/semgrep/1.177.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39.patch

@@ -0,0 +1,26 @@
+From: RISE Project <info@riseproject.dev>
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+
+

patches/semgrep/1.177.0/lfs-pointer-fixups.tsv

@@ -0,0 +1,45 @@
+# gotcha 187: semgrep v1.177.0's own git tag has these 34 languages/**/lib/parser.c
+# files checked in as literal Git LFS pointer stubs instead of their real generated
+# content (see the "Repair upstream Git LFS pointer stubs" step in
+# build-semgrep.yml). Verified upstream regression, fixed again in v1.178.0.
+#
+# Each row maps the broken monorepo path to the exact commit of the pre-merge
+# per-language submodule (as pinned by v1.176.0, the last tag before semgrep
+# inlined these submodules) that holds byte-identical content -- confirmed by
+# matching each pointer's sha256 oid against the fetched blob before it's used.
+#
+# path	org	repo	commit	path-in-submodule
+languages/bash/tree-sitter/semgrep-bash/lib/parser.c	returntocorp	semgrep-bash	c9a4e36f11b202061eb219a309580b903266c47c	lib/parser.c
+languages/cairo/tree-sitter/semgrep-cairo/lib/parser.c	returntocorp	semgrep-cairo	a8e2d5d5dcf8345735b15268b76b24377103a188	lib/parser.c
+languages/circom/tree-sitter/semgrep-circom/lib/parser.c	semgrep	semgrep-circom	4e1e82bad56bccfe63e12cedd830b768789e239d	lib/parser.c
+languages/cpp/tree-sitter/semgrep-cpp/lib/parser.c	returntocorp	semgrep-cpp	9186c38ddf4d16113209e344f1e5de3d1b30be83	lib/parser.c
+languages/csharp/tree-sitter/semgrep-c-sharp/lib/parser.c	returntocorp	semgrep-c-sharp	a20746f8fa5c155453f91d58d5bf3b736d1fbdb4	lib/parser.c
+languages/dart/tree-sitter/semgrep-dart/lib/parser.c	returntocorp	semgrep-dart	4a9be34e29ac6691d2050c10179e809e4f6bedf3	lib/parser.c
+languages/dockerfile/tree-sitter/semgrep-dockerfile/lib/parser.c	returntocorp	semgrep-dockerfile	88b70c9520964c696f1c833b8e8fb9645d4233d6	lib/parser.c
+languages/fga/tree-sitter/semgrep-fga/lib/parser.c	semgrep	semgrep-fga	05a4b6c58299a290ad11af178568490af63f1d37	lib/parser.c
+languages/go/tree-sitter/semgrep-go/lib/parser.c	returntocorp	semgrep-go	d2e55851fea0f5bd6705198e6282994d5bba4803	lib/parser.c
+languages/hack/tree-sitter/semgrep-hack/lib/parser.c	returntocorp	semgrep-hack	401a92b1ef61e526bad118f3c97119c714384519	lib/parser.c
+languages/html/tree-sitter/semgrep-html/lib/parser.c	returntocorp	semgrep-html	2bde56bff950da7984ae729c656e10c05ede3ddf	lib/parser.c
+languages/java/tree-sitter/semgrep-java/lib/parser.c	returntocorp	semgrep-java	75161f747b9342254c7a132bb0ca7458618cd0a7	lib/parser.c
+languages/jsonnet/tree-sitter/semgrep-jsonnet/lib/parser.c	returntocorp	semgrep-jsonnet	90e1fbc65e25e1dbef85776777adb3cd53184ec5	lib/parser.c
+languages/julia/tree-sitter/semgrep-julia/lib/parser.c	returntocorp	semgrep-julia	3dabca267d6565b1a5f50db3f654e5f837a8ea29	lib/parser.c
+languages/kotlin/tree-sitter/semgrep-kotlin/lib/parser.c	returntocorp	semgrep-kotlin	1bddb22061147533add5a66bfe8530254ae81675	lib/parser.c
+languages/lisp/tree-sitter/semgrep-clojure/lib/parser.c	returntocorp	semgrep-clojure	f56ba7e347cb078a40551a5b2657b1351d086922	lib/parser.c
+languages/lua/tree-sitter/semgrep-lua/lib/parser.c	returntocorp	semgrep-lua	49a7ed0d0c4859cc91ad0c43b0cf92d7448d007e	lib/parser.c
+languages/move_on_aptos/tree-sitter/semgrep-move-on-aptos/lib/parser.c	semgrep	semgrep-move-on-aptos	667944faf4c1d81299cc34e4f09f5ab34330df09	lib/parser.c
+languages/move_on_sui/tree-sitter/semgrep-move-on-sui/lib/parser.c	semgrep	semgrep-move-on-sui	4fe01c06c24ada6a9b0a99d49cc488964fa11046	lib/parser.c
+languages/ocaml/tree-sitter/semgrep-ocaml/lib/parser.c	returntocorp	semgrep-ocaml	62466992084e2b75c048ded706e3a9119f9ded2c	lib/parser.c
+languages/php/tree-sitter/semgrep-php/lib/parser.c	returntocorp	semgrep-php	507f87c239d00f0dc501cd4c9105fb35aee4c10b	lib/parser.c
+languages/promql/tree-sitter/semgrep-promql/lib/parser.c	returntocorp	semgrep-promql	3436085e1638264516ce75c484adf45fc96382d1	lib/parser.c
+languages/protobuf/tree-sitter/semgrep-proto/lib/parser.c	returntocorp	semgrep-proto	6754f93b8c89e9e62b48821081300460648f534f	lib/parser.c
+languages/python/tree-sitter/semgrep-python/lib/parser.c	returntocorp	semgrep-python	647a20f8207740b0a76541bb27e1eaaf111dca7e	lib/parser.c
+languages/ql/tree-sitter/semgrep-ql/lib/parser.c	semgrep	semgrep-ql	55749f3c2124dfe1661453ab0790042035a16d41	lib/parser.c
+languages/r/tree-sitter/semgrep-r/lib/parser.c	returntocorp	semgrep-r	d8576644f8c813ea1ec4403866f661861e43969a	lib/parser.c
+languages/ruby/tree-sitter/semgrep-ruby/lib/parser.c	returntocorp	semgrep-ruby	6cf62c7417a3f2961327ee97babf96454b734b19	lib/parser.c
+languages/rust/tree-sitter/semgrep-rust/lib/parser.c	returntocorp	semgrep-rust	64fe5d06dfafad9c2a9764524db036cd31820e3c	lib/parser.c
+languages/scala/tree-sitter/semgrep-scala/lib/parser.c	semgrep	semgrep-scala	b89a80db4bb076e74f9059eb67f5af7d6195b32d	lib/parser.c
+languages/solidity/tree-sitter/semgrep-solidity/lib/parser.c	returntocorp	semgrep-solidity	2f369b589d29ae351bca32cd9d82f554748594ad	lib/parser.c
+languages/swift/tree-sitter/semgrep-swift/lib/parser.c	returntocorp	semgrep-swift	f62f0c1dffa87b84dd1513374687513e6e091de1	lib/parser.c
+languages/terraform/tree-sitter/semgrep-hcl/lib/parser.c	returntocorp	semgrep-hcl	51c3c26af2b5e23d879fbefa61639254140adc0a	lib/parser.c
+languages/typescript/tree-sitter/semgrep-tsx/lib/parser.c	returntocorp	semgrep-tsx	6005de74ed9e2fb891785a3df8582dbb91e272bc	lib/parser.c
+languages/typescript/tree-sitter/semgrep-typescript/lib/parser.c	returntocorp	semgrep-typescript	50fe6a5c46d3dee74d1d176b9767ffc520a1003e	lib/parser.c

patches/semgrep/1.178.0/0001-setup.py-tag-riscv64-linux-wheels-as-manylinux_2_39.patch

@@ -0,0 +1,26 @@
+From: RISE Project <info@riseproject.dev>
+Subject: [PATCH] setup.py: tag riscv64 linux wheels as manylinux_2_39_riscv64
+
+cli/setup.py rewrites the default linux_<arch> platform tag into a
+manylinux/musllinux one through plat_libc_to_tag, which only knows x86_64
+and aarch64. On riscv64 the lookup raises KeyError and no wheel can be
+built at all.
+
+Add the glibc riscv64 entry. Unlike x86_64/aarch64, riscv64 has no glibc
+2.34 build environment available, so the tag names glibc 2.39 (Ubuntu
+24.04 / Debian trixie), the oldest riscv64 userland in general use.
+
+Upstream-Status: To upstream [only meaningful together with a riscv64 semgrep-core build job, which semgrep does not have yet]
+
+--- a/cli/setup.py
++++ b/cli/setup.py
+@@ -57,6 +57,9 @@ plat_libc_to_tag = {
+     ("linux_x86_64", "musl"): "musllinux_1_2_x86_64",
+     ("linux_aarch64", "glibc"): "manylinux_2_34_aarch64",
+     ("linux_x86_64", "glibc"): "manylinux_2_34_x86_64",
++    # riscv64 has no glibc 2.34 build environment; the oldest widely available
++    # one is glibc 2.39 (Ubuntu 24.04 / Debian trixie), so tag it accordingly.
++    ("linux_riscv64", "glibc"): "manylinux_2_39_riscv64",
+ }
+
+