Create summary table of all languages for Code and Supply Chain (#1918)

* begin adding summary table

* update supported languages product summary table

* move some sections down

* begin making more in depth changes

* arranged tables

* separate out code vs ce table, shorten page

* add cleanup

* add the semgrep CE languages to sidebars

* create separate doc for CE languages

* finish up supported languages in semgrep ce

* remove manifest in cell

* update tables

* reachability def

* update with definitions

* remove callout

* Update docs/supported-languages.md

Co-authored-by: Katie Horne <[email protected]>

* try to simplify table

* address review notes

* update header

* clarify the blank values under reachability

---------

Co-authored-by: Katie Horne <[email protected]>

Author: s-santillan

docs/semgrep-ce-languages.md

@@ -0,0 +1,40 @@
+---
+slug: semgrep-ce-languages
+title: Supported languages
+hide_title: true
+description: 
+  Semgrep CE supports more than two dozen languages. Learn about the language support differences between Semgrep CE and Semgrep Code.
+tags:
+  - Semgrep CE
+  - Semgrep Code
+---
+
+import SupportedLanguagesCe from '/src/components/reference/_supported-languages-ce.md'
+import LanguageMaturityCode from '/src/components/reference/_language-maturity-code.md'
+
+# Supported languages for Semgrep CE
+
+This document provides information about supported languages for Semgrep Community Edition (Semgrep CE) and Semgrep Code.
+
+## Semgrep Code and Community Edition
+
+Semgrep CE is a fast, lightweight program analysis tool that can help you detect bugs in your code. It makes use of Semgrep's LGPL 2.1 open source engine. These languages are supported by the Semgrep community, at best effort.
+
+Semgrep Code is a static application security testing (SAST) solution designed to detect complex security vulnerabilities. It makes use of proprietary Semgrep analyses, such as cross-file (interfile) dataflow analysis and framework specific analyses, in addition to Semgrep CE. This results in a [**higher true positive rate than Semgrep CE**](/semgrep-pro-vs-oss). Semgrep Code provides the highest quality support by the Semgrep team: reported issues are resolved promptly.
+
+Use either tool to scan local code or integrate it into your CI/CD pipeline to automate the continuous scanning of your repositories.
+
+<SupportedLanguagesCe />
+
+## Language maturity definitions
+
+Semgrep Code languages can be classified into four maturity levels:
+
+* Generally available (GA)
+* Beta
+* Experimental
+* Community supported\*
+
+\*Community supported languages meet the parse rate and syntax requirements of **Experimental** languages. Users can still access community rules or write their own rules.
+
+<LanguageMaturityCode />

docs/semgrep-supply-chain/glossary.md

@@ -8,6 +8,8 @@ title: Supply Chain glossary
 hide_title: true
 ---
 
+import DefReachability from "/src/components/concept/_def-reachability.md"
+
 # Semgrep Supply Chain glossary
 
 The terms and definitions provided here are specific to Semgrep Supply Chain.
@@ -60,9 +62,7 @@ See also [Reachability](#reachability).
 
 ## Reachability
 
-Reachability refers to whether or not a vulnerable piece of code from a dependency is used in the codebase that imports it. In Semgrep Supply Chain, both a dependency's vulnerable version and code pattern must match for a vulnerability to be considered reachable.
-
-See [Overview of Semgrep Supply Chain](/semgrep-supply-chain/overview) to learn how Semgrep leverages its code-scanning and rule syntax capabilities to provide high-signal rules that determine a finding's reachability. This assists security engineers in remediation and triage processes.
+<DefReachability />
 
 ## Reachability rules
 

docs/supported-languages.md

@@ -12,98 +12,60 @@ title: Supported languages
 
 import SupportedLanguagesTable from '/src/components/reference/_supported-languages-table.mdx'
 import SscIntro from "/src/components/concept/_ssc-intro.md"
-
+import LanguageMaturityCode from '/src/components/reference/_language-maturity-code.md'
 import SemgrepProEngineIntroduction from "/src/components/concept/_semgrep-pro-engine-introduction.mdx"
+import DefCrossFile from "/src/components/concept/_def-cross-file.mdx"
+import DefCrossFunction from "/src/components/concept/_def-cross-function.mdx"
+import DefReachability from "/src/components/concept/_def-reachability.md"
 
 # Supported languages
 
 This document provides information about supported languages and language maturity definitions for the following products:
 
-* Semgrep Code
-* Semgrep Community Edition (CE)
-* Semgrep Supply Chain
-
-## Semgrep Code and Community Edition
+* **Semgrep Code (SAST)** - a static application security testing (SAST) solution designed to detect complex security vulnerabilities. 
+* **Semgrep Supply Chain (SCA)** - a software composition analysis (SCA) tool that detects security vulnerabilities in your codebase introduced by open source dependencies.
 
-Semgrep CE is a fast, lightweight program analysis tool that can help you detect bugs in your code. It makes use of Semgrep's LGPL 2.1 open source engine. These languages are supported by the Semgrep community, at best effort.
+Semgrep Code and Semgrep Supply Chain are free for [small teams](https://semgrep.dev/pricing).
 
-Semgrep Code is a static application security testing (SAST) solution designed to detect complex security vulnerabilities. It makes use of proprietary Semgrep analyses, such as cross-file (interfile) dataflow analysis and framework specific analyses, in addition to Semgrep CE. This results in a [**higher true positive rate than Semgrep CE**](/semgrep-pro-vs-oss). Semgrep Code provides the highest quality support by the Semgrep team: reported issues are resolved promptly.
+## Language maturity summary
 
-Use either tool to scan local code or integrate it into your CI/CD pipeline to automate the continuous scanning of your repositories.
+The following table lists all **Generally available (GA)** and **Beta** languages for Semgrep Code and Semgrep Supply Chain.
 
-### Language support
-
-Semgrep Code supports over 35 languages.
+Languages are arranged by feature completeness from most to least. **Cross-file (interfile)** analysis for Semgrep Code and **reachability** analysis for Semgrep Supply Chain are the most advanced analyses that Semgrep provides; see [Feature definitions](#feature-definitions) for more details.
 
 <SupportedLanguagesTable />
 
-### Language maturity levels
+### Feature definitions
 
-Semgrep Code languages can be classified into four maturity levels:
+<details>
+<summary>Cross-file dataflow analysis</summary>
 
-* Generally available (GA)
-* Beta
-* Experimental
-* Community supported\*
+<DefCrossFile />
 
-\*Community supported languages meet the parse rate and syntax requirements of **Experimental** languages. Users can still access community rules or write their own rules.
+Languages with cross-file support also include cross-function support.
 
-Their differences are outlined in the following table:
+</details>
 
-<table>
-    <thead><tr>
-        <td><strong>Feature</strong></td>
-        <td><strong>GA</strong></td>
-        <td><strong>Beta</strong></td>
-        <td><strong>Experimental</strong></td>
-        <td><strong>Community supported</strong></td>
-    </tr></thead>
-    <tbody>
-    <tr>
-        <td>Support</td>
-        <td>Highest quality support by the Semgrep team. Reported issues are resolved promptly.</td>
-        <td>Supported by the Semgrep team. Reported issues are fixed after GA languages.</td>
-        <td>There are limitations to this language's functionality. Reported issues are tracked and prioritized with best effort.</td>
-        <td>These languages are supported by the Semgrep community. While Semgrep may develop rules or engine updates for these languages, they are not prioritized.</td>
-    </tr>
-    <tr>
-        <td>Parse Rate</td>
-        <td>99%+</td>
-        <td>95%+</td>
-        <td colspan="2">90%+</td>
-    </tr>
-    <tr>
-        <td>Number of Pro rules</td>
-        <td>10+</td>
-        <td>5+</td>
-        <td colspan="2">0+. Query the <a href="https://semgrep.dev/r">Registry</a> to see if any rules exist for your language.</td>
-    </tr>
-    <tr>
-        <td>Semgrep syntax</td>
-        <td>Regex, equivalence, deep expression operators, types and typing. All features supported in Beta.</td>
-        <td>Complete metavariable support, metavariable equality. All features supported in Experimental.</td>
-        <td colspan="2">Syntax, ellipsis operator, basic metavariable functionality.</td>
-    </tr>
-    </tbody>
-</table>
+<details>
+<summary>Cross-function dataflow analysis</summary>
+<DefCrossFunction />
+</details>
 
-### More information
-Visit the cheat sheet generation script and associated semgrep-core test files to learn more about each feature:
-* [Generation script](https://github.com/semgrep/semgrep/blob/develop/scripts/generate_cheatsheet.py)
-* [`semgrep-core` test files](https://github.com/semgrep/semgrep/tree/develop/tests)
+<details>
+<summary>Reachability analysis</summary>
+<DefReachability />
 
-Visit the Semgrep public language dashboard to see the parse rates for each language
-* See [Parse rates by language](https://dashboard.semgrep.dev/).
+</details>
 
-<!-- coupling: If you modify the features in the levels below, change also
-     /semgrep/blob/develop/tests/Test.ml and its maturity level regression testing code.
--->
+:::tip
+See [Language maturity levels](#language-maturity-levels) to learn which features define GA or beta language support.
+:::
 
-## Semgrep Supply Chain
+## Semgrep Supply Chain feature maturity
 
 <SscIntro/>
 
-For projects with lockfiles, Semgrep parses lockfiles for dependencies, then scans your codebase for reachable findings based on the lockfiles. Some languages, such as Java, have several supported lockfiles, depending on your repository's package manager. For a lockfile to be scanned by Semgrep Supply Chain, it must have one of the supported lockfile names.
+For projects with lockfiles, Semgrep parses lockfiles for dependencies, then scans your codebase for reachable findings based on the lockfiles. For a lockfile to be scanned by Semgrep Supply Chain, it must have one of the supported lockfile names.
 
 For some languages, such as JavaScript and Python, a lockfile or manifest file is parsed to determine [transitivity](/docs/semgrep-supply-chain/glossary/#transitive-or-indirect-dependency). For more information on transitivity, see [Transitive dependencies and reachability analysis](/docs/semgrep-supply-chain/overview/#transitive-dependencies-and-reachability-analysis).
 
@@ -118,7 +80,7 @@ Additionally, Semgrep offers beta support for the scanning of Java projects **wi
     <th>Manifest file or lockfile</th>
     <th><a href="#reachability-support-level">Reachability</a></th>
     <th>License detection support</th>
-    <th>Period of reachability rule coverage for CVEs/GHSAs</th>
+    <th><a href="#rule-coverage-support-level">Reachability rule coverage for CVEs/GHSAs</a></th>
 </tr></thead>
 <tbody>
 <tr>
@@ -127,21 +89,23 @@ Additionally, Semgrep offers beta support for the scanning of Java projects **wi
    <td><code>packages.lock.json</code></td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
-   <td rowspan="16">80% of all critical severity CVEs since 2017 and 100% of critical and high severity CVEs since May 2022</td>
+   <td style={{"text-align": "center"}}>GA</td>
 </tr>
 <tr>
    <td>Go</td>
    <td>Go modules (<code>go mod</code>)</td>
    <td><code>go.mod</code></td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
+   <td style={{"text-align": "center"}}>GA</td>
   </tr>
 <tr rowspan="2">
    <td rowspan="2">Java</td>
    <td>Gradle</td>
    <td><code>gradle.lockfile</code></td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
+   <td rowspan="2" style={{"text-align": "center"}}>GA</td>
   </tr>
   <tr>
    <td>Maven</td>
@@ -155,6 +119,7 @@ Additionally, Semgrep offers beta support for the scanning of Java projects **wi
    <td><code>package-lock.json</code></td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
+   <td rowspan="3" style={{"text-align": "center"}}>GA</td>
   </tr>
   <tr>
    <td>Yarn, Yarn 2, Yarn 3</td>
@@ -174,6 +139,7 @@ Additionally, Semgrep offers beta support for the scanning of Java projects **wi
    <td><code>gradle.lockfile</code></td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
+   <td rowspan="2" style={{"text-align": "center"}}>GA</td>
 </tr>
 <tr>
    <td>Maven</td>
@@ -186,7 +152,8 @@ Additionally, Semgrep offers beta support for the scanning of Java projects **wi
    <td>pip</td>
    <td rowspan="2">Any of the following: <ul><li>`*requirement*.txt` or `*requirement*.pip`</li><li>Any manifest file in a requirements folder, such as `**/requirements/*.txt` or `**/requirements/*.pip`</li></ul> The file must be generated automatically and have values set to exact versions (pinned dependencies).</td>
    <td style={{"text-align": "center"}}>GA</td>
-   <td rowspan="4">✅ (PyPI packages only)</td>
+   <td rowspan="4">(PyPI only)</td>
+   <td rowspan="4" style={{"text-align": "center"}}>GA</td>
   </tr>
   <tr>
    <td>pip-tools</td>
@@ -208,63 +175,97 @@ Additionally, Semgrep offers beta support for the scanning of Java projects **wi
    <td><code>Gemfile.lock</code></td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
+   <td style={{"text-align": "center"}}>GA</td>
   </tr>
 <tr>
    <td>Scala</td>
    <td>Maven</td>
    <td>Maven-generated dependency tree (See <a href="/docs/semgrep-supply-chain/setup-maven/">Setting up SSC scans for Apache Maven</a> for instructions.)</td>
    <td style={{"text-align": "center"}}>GA</td>
    <td>✅</td>
+   <td style={{"text-align": "center"}}>GA</td>
 </tr>
 <tr>
    <td>Swift</td>
    <td>SwiftPM</td>
    <td><code>Package.swift</code> file and Swift-generated <code>Package.resolved</code> file. (See <a href="https://www.swift.org/documentation/package-manager/">Swift documentation </a> for instructions.)</td>
    <td style={{"text-align": "center"}}>GA</td>
-   <td>✅ (License detection for new packages is asynchronous and processed after the initial scan. Policies aren't applied on first detection, but are enforced in subsequent scans.)</td>
+   <td>✅<strong>†</strong></td>
+   <td style={{"text-align": "center"}}>GA</td>
 </tr>
   <tr>
    <td>Rust</td>
    <td>Cargo*</td>
    <td><code>cargo.lock</code></td>
-   <td style={{"text-align": "center"}}>--</td>
+   <td rowspan="4">No reachability analysis. However, Semgrep can compare a package's version against a list of versions with known vulnerabilities.</td>
    <td>✅</td>
-   <td rowspan="5">Not applicable due to reachability support level</td>
+   <td rowspan="4">Not applicable due to reachability support level.</td>
 </tr>
 <tr>
    <td>Dart</td>
    <td>Pub</td>
    <td><code>pubspec.lock</code></td>
    <td style={{"text-align": "center"}}>--</td>
-   <td>--</td>
 </tr>
 <tr>
    <td>Elixir</td>
    <td>Hex</td>
    <td><code>mix.lock</code></td>
    <td style={{"text-align": "center"}}>--</td>
-   <td>--</td>
 </tr>
 <tr>
    <td>PHP</td>
    <td>Composer</td>
    <td><code>composer.lock</code></td>
    <td style={{"text-align": "center"}}>--</td>
-   <td>--</td>
 </tr>
   </tbody>
 </table>
 </div>
-_*Supply Chain does not analyze the transitivity of packages for these language and manifest file or lockfile combinations. All dependencies are listed as **No Reachability Analysis.**_
+_<strong>*</strong>Supply Chain does not analyze the transitivity of packages for these language and manifest file or lockfile combinations. All dependencies are listed as **No Reachability Analysis.**_<br />
+_<strong>†</strong>License detection for new packages is asynchronous and processed after the initial scan. Policies aren't applied on first detection, but are enforced in subsequent scans._
+
+#### Reachability support level
+
+GA coverage means that Semgrep provides full reachability analysis for that language.
+
+#### Rule coverage support level
+
+**GA** coverage means that Semgrep provides coverage and rules for the following:
 
-### Maturity levels
+- 80% of all **critical** severity CVEs since **2017**
+- 100% of **critical** and **high** severity CVEs since **May 2022**
 
-Semgrep Supply Chain has two maturity levels:
+## Language maturity levels
+
+### Semgrep Code
+
+Semgrep Code languages can be classified into four maturity levels:
+
+* Generally available (GA)
+* Beta
+* Experimental
+* Community supported\*
+
+\*Community supported languages meet the parse rate and syntax requirements of **Experimental** languages. Users can still access community rules or write their own rules.
+
+<details>
+<summary>Click to view table of definitions.</summary>
+
+<LanguageMaturityCode />
+
+</details>
+
+### Semgrep Supply Chain
+
+Semgrep Supply Chain has two language maturity levels:
 
 * Generally available
 * Beta
 
-Their differences are outlined in the following table:
+
+<details>
+<summary>Click to view table of definitions.</summary>
 
 <table>
   <tr>
@@ -275,7 +276,7 @@ Their differences are outlined in the following table:
   <tr>
    <td>Number of reachability rules</td>
    <td>10+</td>
-   <td>1+</td>
+   <td>No required number</td>
   </tr>
   <tr>
    <td>Semgrep, Inc. rule-writing support</td>
@@ -289,11 +290,20 @@ Their differences are outlined in the following table:
   </tr>
 </table>
 
-:::info Feature and product maturity levels
-* The detailed specifications previously provided apply only to language support. Language maturity levels differ from feature and product maturity levels.
-* Semgrep features and products documented as experimental, beta, or GA generally follow the definitions in a [Software release life cycle](https://en.wikipedia.org/wiki/Software_release_life_cycle).
-:::
+</details>
 
-#### Reachability support level
+### Feature and product maturity levels
+
+The detailed specifications previously provided apply only to language support. Language maturity levels differ from feature and product maturity levels.
+
+## More information
+
+Visit the cheat sheet generation script and associated semgrep-core test files to learn more about each feature:
+* [Generation script](https://github.com/semgrep/semgrep/blob/develop/scripts/generate_cheatsheet.py)
+* [`semgrep-core` test files](https://github.com/semgrep/semgrep/tree/develop/tests)
+
+To see the **parse rates** for each language, visit the Semgrep [public language dashboard](https://dashboard.semgrep.dev/).
 
-Reachability support level refers to the level of support for reachability analysis for the language. At the minimum, Semgrep Supply Chain compares a package's version against a list of versions with known vulnerabilities
+<!-- coupling: If you modify the features in the levels below, change also
+     /semgrep/blob/develop/tests/Test.ml and its maturity level regression testing code.
+-->