@codacy/tools-bandit-1 0.15.0 → 0.16.0

package/dist/index.js

@@ -786,6 +786,15 @@ function mapConfidence(confidence) {
   }
 }
 var CONFIG_FILE_CANDIDATES = [".bandit", "bandit.yml", "pyproject.toml"];
+var PYPROJECT_BANDIT_SECTION = /^\[tool\.bandit(\.[\w-]+)*\]/m;
+async function pyprojectHasBanditSection(pyprojectPath) {
+  try {
+    const content = await import_promises.default.readFile(pyprojectPath, "utf-8");
+    return PYPROJECT_BANDIT_SECTION.test(content);
+  } catch {
+    return false;
+  }
+}
 async function resolveBinaryPath(ctx) {
   const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, ADAPTER_ID);
   const venvBin = (0, import_tooling.resolveVenvBinary)((0, import_tooling.getVenvPaths)(venvDir), "bandit");
@@ -942,7 +951,9 @@ var adapter = {
    * Checks for bandit configuration files in the repository root.
    *
    * Looks for `.bandit`, `bandit.yml`, or `pyproject.toml` (in that order).
-   * Returns the first found file.
+   * `pyproject.toml` only counts if it actually has a `[tool.bandit]` table —
+   * unlike the other two candidates, its mere existence says nothing about
+   * whether Bandit is configured (see {@link pyprojectHasBanditSection}).
    */
   async checkLocalConfigurationFile(ctx) {
     ctx.logger.debug("Checking for local config", { toolId: TOOL_ID });
@@ -950,6 +961,9 @@ var adapter = {
       const candidatePath = import_path.default.join(ctx.repositoryRoot, candidate);
       try {
         await import_promises.default.access(candidatePath);
+        if (candidate === "pyproject.toml" && !await pyprojectHasBanditSection(candidatePath)) {
+          continue;
+        }
         ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: candidatePath });
         return { found: true, path: candidatePath };
       } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.15.0"
+    "@codacy/tooling": "0.16.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",