Writing Python Codemods for Fun and Profit
summary
Open-source codemodder installs via pip and runs over a Python repo, applying about 40–50 ready codemods and custom plugins. It consumes SARIF or invokes semgrep rules, transforms code with libCST, and emits a machine-readable codeTF report. Built fixes include replacing unsafe PyYAML loaders, switching to defusedxml, adding missing imports, converting file operations to context managers, and parameterizing SQL; it can add dependencies to pyproject/requirements and integrates with a free Pixiebot GitHub app and CLI for automated PRs.
AI-written summary · about
chapters (31)
- 0:00intro
- 0:20preamble
- 1:24https://github.com/pixee/codemodder-python
- 1:55there is a problem
- 3:42security tools
- 6:03we need to fix and harden codes
- 7:57code + modification
- 10:19codemodder philosophy
- 12:01leverage open-source tools
- 12:52process results from other tools
- 13:43invoke open-source tools
- 14:54codemods tell a story
- 15:53how can i use it?
- 16:44what does it do?
- 18:04what can we fix?
- 18:32replace unsafe pyyaml loader
- 19:29use defusedxml for parsing xml
- 21:06automatically close resources
- 22:05parametrize sql queries
- 22:57use generator expressions
- 24:09codemodder architecture
- 26:27codemod metadata
- 28:07dependency management
- 30:11let's write a codemod
- 30:57codemod plugin template
- 38:41make the easy things easy
- 39:59make the hard things possible
- 41:47looking ahead
- 44:16we want your feedback!
- 44:50pixeebot app
- 46:06about pixee
related talks
21mMeta: Enabling Programming Languages to Learn from the Crowd
43m5 Years of Bad Ideas
21mTeach Your Old Code New Tricks: Automating Code Quality in Large Projects
33mSource code processing with Python
24m"A Confession of My Python Sins"
27mDream in Code
27mStatic Code Analysis with Python
37mBoost The Performance with Codon