Feature: Run a specific rule from the console

[Danil42Russia]

Pre-submission checks

• I am not reporting a bug (crash, false positive/negative, etc). These must be filed via the bug report template.
• I have looked through both the open and closed issues for a duplicate request.

What's the problem this feature will solve?

I want to run only a specific check by name without using the zizmor.yml config file.

Describe the solution you'd like

Add flag --select / --rules / other

Additional context

Here we need to think about how this should be combined with --collect. Perhaps we should prohibit their use together

[woodruffw]

Hi @Danil42Russia, thanks for opening an issue.

I'm hesitant to add this for two reasons:

1. IME, making it easy to de facto disable audits means people leave them disabled, even when they only mean to disable them temporarily.
2. Users can already de facto do this by using one of the machine readable output formats (JSON or SARIF) and filtering the results from there.

Does (2) work for your use case?

[Danil42Russia]

Yes, I chose the second option, but the error message is a bit depressing :( . I prefer the output in plain format for local work to json :D

In principle, I agree with your arguments as to why this should not be done (although I would add a ban on this flag if there is a CI environment variable, but it's a good thing I'm not the author xD).

It seems worth mentioning this point in the documentation; it certainly won't be superfluous.

P.S. I needed this to start sorting out the problems, because right now there are 355 findings (112 suppressed, 42 fixable): 7 informational, 35 low, 28 medium, 173 high D: And I wanted to start fixing them by correcting each individual rule and gradually getting to 0 warnings.

[woodruffw]

Yeah, it's kind of unfortunate that the plain format can't easily be filtered. I definitely see the value in that, especially for incremental fixes.

[woodruffw]

I'm going to convert this into a discussion since this is something I'm interested in, but don't have a clear design/picture for yet.

[woodruffw]

From @ytausch #2076 (comment):

Unfortunately,

Users can already de facto do this by using one of the machine readable output formats (JSON or SARIF) and filtering the results from there.

would not really help us because we rely on the autofix output of zizmor to make automated PRs. Hence, it's not enough for us to filter the machine-readable output. Also, would introducing the --rule option really increase the probability that people disable certain rules in a security-neglecting way? After all, you would only be able to execute certain rules, not exclude some via the CLI.

[woodruffw]

I think the problem here is that selecting certain rules is equivalent to excluding others, and IME users will unfortunately do so without revisiting their settings later.

With that said we've already crossed that bridge, since we support disablement in config now. So I'm okay with having some kind of --select here, it just needs a design.