MergeStat

SQL for the software development lifecycle

[Daniel Bryant @danielbryantuk]

If you haven't bumped into @mergestat, it's very interesting! It enables you to write SQL queries over your git history to find out lots of useful things, such as:

- Versions of langs/libs
- Which repos had commits
- Which repos use Jenkins for CI/CD

https://t.co/9d6KIvJJ0Z

[Grafana @grafana]

Grafana community spotlight 💫 @patrickdevivo of @mergestat explains how to monitor CVE security vulnerabilities with Grafana, MergeStat, and OSV-Scanner. Today on the blog: https://t.co/T4CmWtVAlB

[Patrick DeVivo @patrickdevivo]

Today we're live on the @grafana blog! Learn how to manage CVE security vulnerabilities with Grafana, @mergestat, and @Google's OSV-Scanner

https://t.co/HFnazJu5dp

[Patrick DeVivo @patrickdevivo]

Peter Freiberg wrote a great post, "Finding A Pin in a Docker Stack 🪡" (get it? 🙂), showing how @mergestat can identify common issues in Dockerfiles across an org

"finding stale Dockerfiles" is a *type* of question our new UI experience (coming soon) can answer quickly!

[MergeStat @mergestat]

Terraform Meets SQL to Secure Cloud Infrastructure ☁️

Use @tfsec_dev + @grafana + @mergestat to understand, explore and report on misconfigurations across @HashiCorp terraform repos!

https://t.co/HNZTlPFa2S

[Patrick DeVivo @patrickdevivo]

we're putting together a @mergestat demo site that indexes the top 500 public GitHub repos by star count for ~20 languages. Playing with some questions - like how many of those repos use @nextjs? (or rather...how many have a file that looks like a nextjs config)

[Patrick DeVivo @patrickdevivo]

was very cool to hear of a @mergestat user joining CODEOWNERS content from their repos with vulnerability data from @AquaSecTeam's trivy, to get a report of CRITICALs CVEs *by team* across an org 😎

[Patrick DeVivo @patrickdevivo]

pinning to specific @Docker images is important for deterministic builds, but can be overlooked when maintaining dependency and security updates - @mergestat can be used to query Dockerfiles across an organization to better understand pinning practices 📍

https://t.co/koqJCmFXms

[Patrick DeVivo @patrickdevivo]

Today we're thrilled to announce @mergestat v2, a significant improvement to how we extract and sync data from git repos -> SQL!

tl;dr we're running @Podman_io containers defined externally to run an analysis on a repo and store the results in postgres

https://t.co/kE0uCtRKzY

[Patrick DeVivo @patrickdevivo]

I've been using @deno_land again to implement data syncs, in a new approach we've been working on @mergestat - and it's been really slick!

top-level await is 👌

[Patrick DeVivo @patrickdevivo]

We spent some time playing with git blame data, and came up with some interesting queries!

We also learned a bit about the @MongoDB source code running these queries

https://t.co/SRLKbu8sYv

[Patrick DeVivo @patrickdevivo]

until today, @mergestat has pretty much only supported repos on @github (and local repos on disk). Today we're very excited to add support for @Bitbucket and @gitlab as well🎉

https://t.co/YsyxUJ18o2

[Patrick DeVivo @patrickdevivo]

Are We Vulnerable? (e.g. Log4Shell) - Identifying Open-Source Library Risk Using @mergestat (Part 2) 🎉

https://t.co/a2h1nSFbff

[Patrick DeVivo @patrickdevivo]

Recently, someone asked how they could use @mergestat to query the contents of their YAML files (across many git repos) to validate configs.

We put together an interesting (weird? 😃) solution, using PostgreSQL, plv8, JavaScript, and MergeStat.

https://t.co/rSMV9hDv1d

[MergeStat @mergestat]

https://t.co/XSI6zPyZwG

[Patrick DeVivo @patrickdevivo]

Working on @mergestat, we often want to know about how frequently we ship new versions 🚀 (in particular, if we're due for a new release). We've been using @grafana to track this visually:

https://t.co/cfLiyEBtDu

[JJ @JosephJacks_]

👀 @mergestat https://t.co/rZnLtnErfK

[Patrick DeVivo @patrickdevivo]

@jaosorior told us about @renovatebot some time ago, and we ended up introducing it into @mergestat repos! Interestingly - querying for the presence of it has been a use case that's popped up several times now (across hundreds or thousands of codebases)

https://t.co/0faasC4FwI

[Patrick DeVivo @patrickdevivo]

put together some example SQL for managing open-source vulnerabilities (CVEs) in @mergestat using @GrypeProject and trivy (@AquaSecTeam).

for us, it's been valuable to see this data *across* our codebases and in some cases join it with git activity

https://t.co/fQbH7Mkwvh

[MergeStat @mergestat]

We're excited to announce that the most recent releases of MergeStat now include basic data visualization capabilities!

https://t.co/7k9y6bNbwT

[Patrick DeVivo @patrickdevivo]

Spent some time today putting together a CLI that uses @OpenAI codex models for natural language -> SQL: https://t.co/xE6dtn1LXN

(taking what we learned doing it in @mergestat-lite), but generalizing for any SQL database