rules:
  # ruleid: metadata-technology
  - id: unchecked-subprocess-call
    patterns:
      - pattern-either:
          - pattern: |
              subprocess.call(...)
          - pattern: |
              subprocess.call(...)
      - pattern-not-inside: |
          $S = subprocess.call(...)
      - pattern-not-inside: |
          subprocess.call(...) == $X
    message: >-
      bad stuff
    severity: WARNING
    fix: subprocess.check_call(...)
    metadata:
      category: best-practice
  # ok: metadata-technology
  - id: subprocess-run
    patterns: subprocess.run(...)
    message: >-
      bad stuff
    severity: WARNING
    fix: subprocess.check_call(...)
    metadata:
      category: python
      technology:
        - semgrep
  # ok: metadata-technology
  - metadata:
      category: python
      technology:
        - semgrep
    id: subprocess-run-2
    patterns: subprocess.run(...)
    message: >-
      bad stuff
    severity: WARNING
    fix: subprocess.check_call(...)
  # ok: metadata-technology
  - id: join-ok
    message: join-ok
    severity: WARNING
    mode: join
    metadata:
      category: python
      technology:
        - semgrep
    join:
      rules:
        - id: ok-first
          languages: [generic]
          patterns: |
            first
        - id: ok-second
          languages: [generic]
          patterns: |
            second
  # ruleid: metadata-technology
  - id: join-bad
    message: join-bad
    severity: WARNING
    mode: join
    metadata:
      category: python
    join:
      rules:
        - id: bad-first
          languages: [generic]
          patterns: |
            first
        - id: bad-second
          languages: [generic]
          patterns: |
            second