@codacy/tools-bandit-1 0.14.0 → 0.16.0

package/dist/index.js

@@ -753,7 +753,7 @@ var descriptor = {
   preferredVersion: "1.8.3",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"]
 };
@@ -786,9 +786,18 @@ function mapConfidence(confidence) {
   }
 }
 var CONFIG_FILE_CANDIDATES = [".bandit", "bandit.yml", "pyproject.toml"];
+var PYPROJECT_BANDIT_SECTION = /^\[tool\.bandit(\.[\w-]+)*\]/m;
+async function pyprojectHasBanditSection(pyprojectPath) {
+  try {
+    const content = await import_promises.default.readFile(pyprojectPath, "utf-8");
+    return PYPROJECT_BANDIT_SECTION.test(content);
+  } catch {
+    return false;
+  }
+}
 async function resolveBinaryPath(ctx) {
   const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, ADAPTER_ID);
-  const venvBin = import_path.default.join(venvDir, "bin", "bandit");
+  const venvBin = (0, import_tooling.resolveVenvBinary)((0, import_tooling.getVenvPaths)(venvDir), "bandit");
   try {
     await import_promises.default.access(venvBin);
     return venvBin;
@@ -844,14 +853,8 @@ var adapter = {
     ];
     const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, ADAPTER_ID);
     try {
-      const venvPython = import_path.default.join(venvDir, "bin", "python");
-      await import_promises.default.access(venvPython);
-      const venv = {
-        root: venvDir,
-        binDir: import_path.default.join(venvDir, "bin"),
-        python: venvPython,
-        pip: import_path.default.join(venvDir, "bin", "pip")
-      };
+      const venv = (0, import_tooling.getVenvPaths)(venvDir);
+      await import_promises.default.access(venv.python);
       const version = await (0, import_tooling.checkVenvTool)(
         venv,
         "bandit",
@@ -948,7 +951,9 @@ var adapter = {
    * Checks for bandit configuration files in the repository root.
    *
    * Looks for `.bandit`, `bandit.yml`, or `pyproject.toml` (in that order).
-   * Returns the first found file.
+   * `pyproject.toml` only counts if it actually has a `[tool.bandit]` table —
+   * unlike the other two candidates, its mere existence says nothing about
+   * whether Bandit is configured (see {@link pyprojectHasBanditSection}).
    */
   async checkLocalConfigurationFile(ctx) {
     ctx.logger.debug("Checking for local config", { toolId: TOOL_ID });
@@ -956,6 +961,9 @@ var adapter = {
       const candidatePath = import_path.default.join(ctx.repositoryRoot, candidate);
       try {
         await import_promises.default.access(candidatePath);
+        if (candidate === "pyproject.toml" && !await pyprojectHasBanditSection(candidatePath)) {
+          continue;
+        }
         ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: candidatePath });
         return { found: true, path: candidatePath };
       } catch {
@@ -1002,54 +1010,80 @@ var adapter = {
         args.push("-c", configPath);
       }
     }
-    args.push(...absoluteFiles);
+    const fileChunks = (0, import_tooling.chunkFilesForArgv)(absoluteFiles);
     try {
-      const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
-        cwd: ctx.repositoryRoot,
-        logger: ctx.logger
-      });
-      if (exitCode > 1) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "toolInvoke",
-          kind: "NonZeroExit",
-          message: `bandit exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
-          level: "error"
-        });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      if (!stdout.trim()) {
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      const jsonStart = stdout.indexOf("{");
-      const jsonPayload = jsonStart === -1 ? stdout : stdout.slice(jsonStart);
-      let banditOutput;
-      try {
-        banditOutput = JSON.parse(jsonPayload);
-      } catch (err) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "outputParse",
-          kind: "MalformedOutput",
-          message: `Failed to parse bandit JSON output: ${err instanceof Error ? err.message : String(err)}`,
-          level: "error"
+      const results = [];
+      for (const chunk of fileChunks) {
+        const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, [...args, ...chunk], {
+          cwd: ctx.repositoryRoot,
+          logger: ctx.logger
         });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
-      }
-      if (banditOutput.errors && banditOutput.errors.length > 0) {
-        for (const banditError of banditOutput.errors) {
+        if (exitCode > 1) {
           errors.push({
             toolId: TOOL_ID,
             phase: "toolInvoke",
-            kind: "FileError",
-            message: `${banditError.filename}: ${banditError.reason}`,
+            kind: "NonZeroExit",
+            message: `bandit exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+            level: "error"
+          });
+          return (0, import_tooling.buildResult)(
+            TOOL_ID,
+            startedAt,
+            /* @__PURE__ */ new Date(),
+            issues,
+            errors,
+            ctx.targetFiles.length
+          );
+        }
+        const stderrFiltered = stderr.split("\n").filter((line) => !/^\[.*\]\s+INFO\s+/.test(line.trim())).join("\n").trim();
+        if (stderrFiltered) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "outputParse",
+            kind: "ParseWarning",
+            message: `bandit stderr: ${stderrFiltered}`,
             level: "warning"
           });
         }
+        if (!stdout.trim()) continue;
+        const jsonStart = stdout.indexOf("{");
+        const jsonPayload = jsonStart === -1 ? stdout : stdout.slice(jsonStart);
+        let banditOutput;
+        try {
+          banditOutput = JSON.parse(jsonPayload);
+        } catch (err) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "outputParse",
+            kind: "MalformedOutput",
+            message: `Failed to parse bandit JSON output: ${err instanceof Error ? err.message : String(err)}`,
+            level: "error"
+          });
+          return (0, import_tooling.buildResult)(
+            TOOL_ID,
+            startedAt,
+            /* @__PURE__ */ new Date(),
+            issues,
+            errors,
+            ctx.targetFiles.length
+          );
+        }
+        if (banditOutput.errors && banditOutput.errors.length > 0) {
+          for (const banditError of banditOutput.errors) {
+            errors.push({
+              toolId: TOOL_ID,
+              phase: "toolInvoke",
+              kind: "FileError",
+              message: `${banditError.filename}: ${banditError.reason}`,
+              level: "warning"
+            });
+          }
+        }
+        results.push(...banditOutput.results);
       }
       const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
       const resultsByFile = /* @__PURE__ */ new Map();
-      for (const result2 of banditOutput.results) {
+      for (const result2 of results) {
         const list = resultsByFile.get(result2.filename) ?? [];
         list.push(result2);
         resultsByFile.set(result2.filename, list);
@@ -1085,16 +1119,6 @@ var adapter = {
           issues.push(issue);
         }
       }
-      const stderrFiltered = stderr.split("\n").filter((line) => !/^\[.*\]\s+INFO\s+/.test(line.trim())).join("\n").trim();
-      if (stderrFiltered) {
-        errors.push({
-          toolId: TOOL_ID,
-          phase: "outputParse",
-          kind: "ParseWarning",
-          message: `bandit stderr: ${stderrFiltered}`,
-          level: "warning"
-        });
-      }
     } catch (err) {
       errors.push({
         toolId: TOOL_ID,

package/dist/metadata.js

@@ -29,7 +29,7 @@ var descriptor = {
   preferredVersion: "1.8.3",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"]
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.14.0"
+    "@codacy/tooling": "0.16.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",