close
The Wayback Machine - https://web.archive.org/web/20200918101040/https://github.com/PowerShell/PSScriptAnalyzer/wiki/Community-Meetings
Skip to content

/ PSScriptAnalyzer

Community Meetings

Jump to bottom
Kapil Borle edited this page Oct 18, 2016 · 6 revisions

October 18, 2016

Notes

  • For Plaster templates, PowerShell source is located in src/ directory whereas PSScriptAnalyzerSettings.psd1 is located in the project root. When PSScriptAnalyzer is pointed to the root, it should scan only src/. PSSA settings file needs a include/exclude directory key to facilitate such behavior.
  • Some possible actions to alleviate PSAvoidUsingConvertToSecureStringWithPlainText issues
    • Provide more information in the violation description and possible point to relevant online resources
    • Can narrow down the applicability of the rule by scanning for Read-Host followed by ConvertTo-Securestring -AsPlainText invocation
  • Provide a more convenient way to suppress rules through comments, e.g., 
    ### disable rule: PSUseApprovedVerbs
function obtain-foo { }
    will suppress PSUseApprovedVerbs on the entire script following the ### disable rule flag.

(We would like to thank all the people who could attend the community call and provide their valuable suggestions. Also, we would like to apologize to all the people who dialed in at 10:00 am because of the the incorrect meeting time posted on the blog.)

Agenda

May 24, 2016

Notes

  • DSC Parse error fix changes
    • Change SaveDscResourceDependency to SaveDscDependency
    • Have logic to clear module cache
  • Settings file precedence
    • No module name in project-scoped settings file
  • Find way to filter module manifest .psd1 files for analysis so that non-module manifest .psd1 are not flagged by the rules
  • Analyze helper function for presence of shouldprocess
  • Implement rulesets functionality and enable them to be easily discoverable by the user
    • implementing tags may prove useful for this feature

Agenda

  • Thank the community
  • Brief overview of the next release
    • Engine
      • Add a SaveDSCResourceDependency switch to allow Invoke-ScriptAnalyzer to download a DSC Resource module from PSGallery in the event of a ModuleNotFoundDuringParse parse error.
      • Add SuggestedCorrections property to DiagnosticRecord
        • This property emits text that can rectify the violation which triggered the rule
        • The primary purpose of this feature is to enable quick-fix scenarios in editors (vscode)
      • Add Name as a positional parameter in Get-ScriptAnalyzerRule
      • Add Remove verb to UseShouldProcessForStateChangingFunctions rule
      • Add a ScriptPath property to DiagnosticRecord that returns the full path of the script
      • Fix the parsing of Settings parameter value when a hashtable is given
      • Fix writing error record while running rule suppression
      • Fix rule suppression in DSC Configuration definitions
    • Rules
      • Add suggested correction feature to the following rules:
        • PSAvoidUsingCmdletAliases
        • PSAvoidUsingPlainTextForPassword
        • PSMisleadingBacktick
        • PSUseToExportFieldsInManifest
        • PSMissingModuleManifestField
      • Fix extents of:
        • UseSingularNoun
        • UseApprovedVerb
        • AvoidUsernameAndPasswordParams
  • Discuss the following issues:
    • SaveDscResourceModule switch name (PR #534, issue #520)
      • Should it be ‘SaveModuleDependency’ to future proof it?
    • Settings file precedence #518
    • PSShouldProcess false positives #521
    • Rule sets #383
    • Binary Modules #447

03/29/2016

Notes

  • Implement style-based rules (not enabled by default)?
    • Keith: used to having two separate
    • Need a way to tell the difference between style rules and functionality rules
    • SourceName getting cutoff in smaller conhost buffers
  • Autocorrection of rules
    • Prototyped already using a single extent emitted by Inovke-ScriptAnalzyer
    • Useful going forward with style rules
    • Don't need command-line autocorrect right now
  • User-configurable rules
    • Generic set of configurability: ability to override severity
    • Global switch: "treat warnings as error"
    • Cmdlet alias rule has a whitelist
    • AvoidUserNameAndPasswordParams can also take a whitelist of strings
    • Could edit the number of allowed positional params in AvoidPositionalParams
      • Also have a switch for positional params allowed for built-in
  • Alias the SuppressMessage attribute
    • Totally fine to take an array of rules to suppress
  • Username and password is still firing a noisy extent

Agenda

  • Thank community for feedback/issues/suggestions. Also for PRs containing bug fixes and updates to help content

  • Need Opinion: Identify Style based rules in default rule set

    • We need to consider adding certain Style based rules that have community consensus to the default rule set

  • Need Opinion: Up for grab items:

    • How do we make progress on these? There are new rules/features suggested in the list.

  • Feature asks: [Discuss scope/specifics]

    • Metadata management for Rules

      • Need a way of configuring rule behavior (Ex: cmdlet alias rule, deprecated cmdlet rule, shouldprocess)

    • Auto correction in ScriptAnalyzer

      • ScriptAnalyzer needs to emit suggested ‘extent’ for rule violations

    • SuppressMessage usage suggestion:

  • Go over issues page

  • [Low Pri - FYI] ScriptAnalyzer v1.5 release content [4/1]:

    • Perf optimization when handling Severity
    • Updates to fix inconsistencies in severity emitted by rules (Get vs Invoke)
    • Updates to PSCredential Usage error message and UserName and Password message
    • Change image to WMF 5 for Appveyor
    • New code review process using reviewable.io
    • API layer now accepts Profile input

02/02/2016

Topics Discussed:

  • Highlight items in v1.3.0 release
  • Thanks to community for contributions to rule, documentation and general feedback!
  • Support for PowerShell v3
    • Have not seen any issues in this area – Connect with community to understand the usage
  • How is the current release working in terms of rule accuracy, Engine stability, perf? – Any other feedback.
  • Ability of the ruleset to recognize variable scopes - global, local, script, private
  • Go over remaining items from changelog
  • Open Items – Issues, Bugs
  • Feedback on “ScriptDefinition” feature – Ability to consume scripts as streams
  • [Feature] Feature to enable supplying configuration data to rules – Ex: cmdlet alias rule – supplying list of aliases to whitelist/blacklist – How does the community feel about this feature?
  • [Feature] Scope for module manifest work
  • [Rule] Credential/Securestring enforcement for parameters
  • Issue #397 - Should PSScriptAnalyzer suggest use of the RemotingCapability cmdlet attribute when a ComputerName parameter is used?
  • Issue #416 – Using ScriptAnalyzer engine in a multithreaded environment in the same process – currently this is a singleton instance for perf reasons – Get better understanding of the ask..
  • Issue #434 - Should suggest explicit *ToExport entries in module manifest
  • [Contribution required] Looking for contributions to issues marked as “New Rules, Up for grabs”
  • Wiki – Opened this to be editable by world – Content the community wants to publish here? Can we use the existing Agenda/Meeting notes template?

######[Announce on Twitter about upcoming meetings]

  • Skype Recording of the online meeting:

10/13/2015

Recording of the Skype Meeting:

http://1drv.ms/1MnjTWo

Agenda:

Discuss features to get community opinion:

  • Additional properties in the emitted diagnostic records
  • ScriptAnalyzer categories for rule severities
  • Optional logging metrics for rule applications
  • Support for custom rules as streams
  • Close issues that have no consensus

Open Items:

Updates from our team:

New Rule/Bug fixes:

  • [Rule] Validate BOM Encoding
  • [Rule] Validate UTF8 encoding in help files
  • [Fix] Handling PSDrives
  • [Improvements] Positional Parameter rule

08/18/2015

Recording of the Skype Meeting:

https://onedrive.live.com/redir?resid=EF4B329A5EB9EA4D!125&authkey=!AD6j7fgt_17oFXU&ithint=video%2cmp4

07/07/2015

  • PS v3 support
  • For V3/v4, make sure the help info are consistent
  • Important for script migration
  • Profiles
  • What profiles of rules we ship instead of how profiles work
    • Different scenarios
    • Provide default rule profiles
  • Rules
  • Validate help comments
  • Help file should be utf-8

  • Have a Youtube channel

  • Recording of the Skype Meeting

06/16/2015

  • Suppressing rule scenario requirements
  • Scott's team [ScriptAnalyzer ISE Plugin] to finish the suppression feature -> right click and enable suppression source/file
  • Profile discussion
  • Kirk: Only need to turn some things off
  • Chendra: VS dev teams need a few rules to develop and verify?
  • Joel: Only want to disable some rules for modules like ShowUI and XML.
  • Pass along rule profiles
  • Additional request for PowerShell grammars via DSLs
  • LaunguagePx
  • Open issues
  • Backticks: bad?
  • Create a stylistic rule set as add-on?
  • Style guide:
  • Every style guide can be different
  • Too late to decide certain language uses such as : whether a backtick should be used
  • Collaboration: every rule can be linkable

05/08/2015

  • Rule suppression baseline (Issue opened by Keith on GitHub)

  • We need to distinguish the line between publishing and good practice

  • Validate if suppression works with namespace imported

  • How to engage more community members to use this tool : providing easier compilation process

    • Two binaries, hard to make it a nice upgradable module

    • Break the binaries, version problem

  • Wording of "Guidelines" may not be restrictive enough compared to "Rules"

  • Version 3.0/5.0/nanoserver, it would be useful if the tool could figure out what version a module supports without minimum version specified.(Issue opened by Keith on GitHub)

  • Kirk will work on a version that is compatible with PS 3.0 and will publish it in his forked branch.

  • We will need lots of community’s feedback/input on what rules to implement, what should be the severity of the rules

  • A full documentation of what we consider as “best practice” will be posted on the repository and we want to know if you have more!

  • A video recording of the meeting has been posted here: https://onedrive.live.com/redir?resid=ef4b329a5eb9ea4d!120&authkey=!AO0elIRHskAjtCM&ithint=folder%2cmp4

Clone this wiki locally
You can’t perform that action at this time.