Port Semgrep Rules to New Languages

Ports an existing Semgrep rule to one or more target languages, producing per-language directories each containing the ported YAML rule and an annotated test file (for example, porting sql-injection to Go and Java yields sql-injection-golang/ and sql-injection-java/, each with a .yaml rule and a language-specific test file). Each target language runs an independent, strict four-phase cycle rather than a shared pass: Phase 1 Applicability Analysis, verdicting APPLICABLE, APPLICABLE_WITH_ADAPTATION, or NOT_APPLICABLE by checking whether the vulnerability class exists in the target language, whether an equivalent construct exists, and whether the semantics are similar enough for meaningful detection; Phase 2 Test Creation, written before the rule, with a minimum of 2 vulnerable (ruleid:) and 2 safe (ok:) cases plus language-specific edge cases; Phase 3 Rule Creation, dumping the target language's AST (semgrep --dump-ast -l <lang> test-file), translating patterns to its syntax, and updating the language key, message, and rule ID; and Phase 4 Validation, requiring the test run to show All tests passed before moving on.

# Validate YAML
semgrep --validate --config rule.yaml

# Run tests
semgrep --test --config rule.yaml test-file

The workflow rejects seven named rationalizations for skipping steps - assuming identical pattern structure translates across languages (ASTs differ), assuming the same vulnerability gets the same detection (data flow differs), skipping new tests because the original rule worked, skipping applicability analysis because a pattern "obviously applies," creating all variants before testing any, treating a similar library as close enough without verifying API semantics, and translating syntax 1:1 instead of researching target-language idioms. It builds on a separate semgrep-rule-creator skill as the authoritative reference for rule-creation fundamentals - taint mode versus pattern matching, test-first methodology, anti-patterns, the validation loop, and rule optimization - applying those same principles in each new language context.

Use it to port an existing Semgrep rule to one or more target languages, create language-specific variants of a universal vulnerability pattern, expand rule coverage across a polyglot codebase, or translate rules between languages with equivalent constructs.

Do NOT use it to create a brand-new Semgrep rule from scratch (use semgrep-rule-creator instead), to run existing rules against code, for languages where the vulnerability pattern fundamentally doesn't apply, or for minor syntax variations within the same language.

Requires an existing Semgrep rule (a YAML file path or YAML content) and one or more target languages. For each applicable language it outputs a <rule-id>-<language>/ directory with the ported .yaml rule and a matching test file. For taint-rule debugging, semgrep --dataflow-traces -f rule.yaml test-file traces the flow. Required reading before porting: Semgrep's Rule Syntax, Pattern Syntax, Pattern Examples, and Testing Rules documentation, plus the Trail of Bits static-analysis testing handbook.

Depends on semgrep-rule-creator for rule-writing fundamentals and defers to its detailed guidance rather than duplicating it; supporting references applicability-analysis.md, language-syntax-guide.md, and workflow.md hold the deeper per-phase guidance.

Security engineers expanding Semgrep rule coverage across a polyglot codebase who need a disciplined, test-first process per target language rather than a quick syntax translation that risks missing language-specific data-flow or idiom differences.