From d79a1c6988e32f311fe833fe7f6ee5b1e2b49446 Mon Sep 17 00:00:00 2001
From: CleverThis <hal9000@cleverthis.com>
Date: Wed, 22 Apr 2026 10:54:18 +0000
Subject: [PATCH] test-infra: fix Semgrep escape hatch and add exception
 chaining pattern

---
 .semgrep.yml | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/.semgrep.yml b/.semgrep.yml
index 5a4eb2583..88406bb5f 100644
--- a/.semgrep.yml
+++ b/.semgrep.yml
@@ -98,6 +98,16 @@ rules:
                     ...
                   except Exception as $VAR:
                     raise $VAR from $CAUSE
+              - pattern-not: |
+                  try:
+                    ...
+                  except Exception:  # error-propagation: allow
+                    ...
+              - pattern-not: |
+                  try:
+                    ...
+                  except Exception as $VAR:  # error-propagation: allow
+                    ...
           - patterns:
               - pattern: |
                   try:
@@ -134,6 +144,16 @@ rules:
                     ...
                   except BaseException as $VAR:
                     raise $VAR from $CAUSE
+              - pattern-not: |
+                  try:
+                    ...
+                  except BaseException:  # error-propagation: allow
+                    ...
+              - pattern-not: |
+                  try:
+                    ...
+                  except BaseException as $VAR:  # error-propagation: allow
+                    ...
     message: >
       Broad exception suppression detected. Do not suppress Exception or BaseException
       without re-raising or narrowing to a specific exception type.
@@ -141,12 +161,12 @@ rules:
       CRITICAL: Let exceptions propagate to top-level execution (see CONTRIBUTING.md).
 
       If you have specific recovery logic that justifies suppressing this exception,
-      add the annotation '# nosemgrep' on the except line to disable this rule.
+      add the annotation '# error-propagation: allow' on the except line to disable this rule.
 
       Example of allowed suppression:
         try:
           resource.cleanup()
-        except Exception:  # nosemgrep
+        except Exception:  # error-propagation: allow
           pass  # Resource already cleaned up; safe to ignore
     languages: [python]
     severity: ERROR
@@ -160,7 +180,7 @@ rules:
           - pattern: contextlib.suppress(Exception)
           - pattern: contextlib.suppress(BaseException)
       - pattern-not: |
-          # nosemgrep
+          # error-propagation: allow
           contextlib.suppress(...)
     message: >
       Use of contextlib.suppress(Exception) or contextlib.suppress(BaseException)
@@ -169,10 +189,10 @@ rules:
       CRITICAL: Let exceptions propagate to top-level execution (see CONTRIBUTING.md).
 
       If you have specific recovery logic that justifies suppressing this exception,
-      add the annotation '# nosemgrep' on the line above the suppress call.
+      add the annotation '# error-propagation: allow' on the line above the suppress call.
 
       Example of allowed suppression:
-        # nosemgrep
+        # error-propagation: allow
         with contextlib.suppress(Exception):
           resource.cleanup()  # Resource already cleaned up; safe to ignore
     languages: [python]