@codacy/tools-opengrep-1 0.11.0 → 0.12.0

package/README.md

@@ -126,3 +126,6 @@ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh |
 - **Opengrep errors**: Parse errors (syntax errors, partial parsing) from Opengrep's JSON `errors` array are converted to structured `AnalysisError` objects with `filePath`. Stderr (scan status table) is logged at debug level only.
 - **Rule ID format**: Semgrep-rules use `{dir}.{filename}.{ruleId}` (dots), GitLab rules use `{dir}_{filename}` (underscores), Codacy custom rules keep their original IDs.
 - **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.16.4`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
+- **Argv-size chunking (no directory walk)**: The adapter always passes Opengrep an **explicit file list** — the runner's already git-ignored, exclude-filtered target set — so Opengrep never walks the repository tree itself. `chunkFilesByArgvBudget()` splits that list into the **fewest, largest** chunks that each fit `ARGV_BYTE_BUDGET` (200 KB, well under `ARG_MAX`), and each chunk is scanned in its own `opengrep scan` invocation; findings and errors are merged across chunks. Chunk by **size, not count**: every invocation re-compiles `rules.yaml`, so fewer/larger chunks amortize that fixed cost. The earlier directory/“root” fallback was removed because on huge repos (a single tracked file at the repo root collapsed the minimal-cover dirs to `.`) it made Opengrep walk the entire tree — re-scanning excluded/generated/vendored files and timing out at the runner's 10-minute limit.
+- **File-size cap**: invocations pass `--max-target-bytes 1000000` (~1 MB). This restores Opengrep's default size cap — the adapter previously passed `0`, which **disables** the cap, so giant generated/minified bundles were scanned and dominated runtime. The cap applies to explicitly-listed files (verified on v1.16.4). Note: `--exclude-minified-files` is **not** used — that flag is rejected by the bundled binary unless `--experimental` (a different engine) is also passed, so we rely on the size cap instead. (The runner also enforces a tighter 150 KB per-file limit centrally before files reach the adapter, so this `--max-target-bytes` is now a secondary defense.)
+- **Partial results on timeout**: the per-chunk loop checks `ctx.signal` (the runner's timeout abort) between chunks and passes it to `spawnTool`, so an in-flight scan is killed promptly. On abort the adapter keeps the findings from completed chunks and adds a single `Timeout` error (→ `status: "partial"`) rather than losing everything. This is why chunking matters beyond ARG_MAX: it's the granularity at which a long scan can be stopped with results preserved.

package/dist/index.js

@@ -30414,6 +30414,17 @@ var PATTERN_META = new Map(
     }
   ])
 );
+var MAX_SNIPPET_PREVIEW = 60;
+var MAX_ERROR_MESSAGE = 200;
+function summarizeErrorMessage(message) {
+  const collapsed = message.replace(/`[\s\S]*?`/g, (snippet) => {
+    const inner = snippet.slice(1, -1).replace(/\s+/g, " ").trim();
+    const preview = inner.length > MAX_SNIPPET_PREVIEW ? `${inner.slice(0, MAX_SNIPPET_PREVIEW)}\u2026` : inner;
+    return `\`${preview}\``;
+  });
+  const oneLine = collapsed.replace(/\s+/g, " ").trim();
+  return oneLine.length > MAX_ERROR_MESSAGE ? `${oneLine.slice(0, MAX_ERROR_MESSAGE)}\u2026` : oneLine;
+}
 function ruleMetadata(ruleId) {
   const patternId = `${TOOL_ID}_${ruleId}`;
   return PATTERN_META.get(patternId) ?? { category: "Security", severity: "Info" };
@@ -30480,46 +30491,75 @@ function truncate(str, maxLen) {
   return str.slice(0, maxLen - 3) + "...";
 }
 var ARGV_BYTE_BUDGET = 200 * 1024;
-function minimalCoverDirs(files) {
-  const dirs = /* @__PURE__ */ new Set();
-  for (const f of files) {
-    const d = import_path.default.dirname(f);
-    dirs.add(d === "" ? "." : d);
-  }
-  const sorted = [...dirs].sort((a, b) => {
-    if (a === ".") return -1;
-    if (b === ".") return 1;
-    return a.split(import_path.default.sep).length - b.split(import_path.default.sep).length;
-  });
-  const kept = [];
-  for (const d of sorted) {
-    const covered = kept.some((k) => {
-      if (k === d) return true;
-      if (k === ".") return true;
-      return d.startsWith(k + import_path.default.sep);
-    });
-    if (!covered) kept.push(d);
+function chunkFilesByArgvBudget(files) {
+  const chunks = [];
+  let current = [];
+  let currentBytes = 0;
+  for (const file of files) {
+    const cost = Buffer.byteLength(file) + 1;
+    if (current.length > 0 && currentBytes + cost > ARGV_BYTE_BUDGET) {
+      chunks.push(current);
+      current = [];
+      currentBytes = 0;
+    }
+    current.push(file);
+    currentBytes += cost;
   }
-  return kept;
+  if (current.length > 0) chunks.push(current);
+  return chunks;
 }
-function argvBytes(paths) {
-  let total = 0;
-  for (const p of paths) total += Buffer.byteLength(p) + 1;
-  return total;
-}
-function chooseScanTargets(validatedAbsoluteFiles, repositoryRoot) {
-  if (argvBytes(validatedAbsoluteFiles) <= ARGV_BYTE_BUDGET) {
-    return { targets: validatedAbsoluteFiles, strategy: "files" };
-  }
-  const relFiles = validatedAbsoluteFiles.map((f) => import_path.default.relative(repositoryRoot, f));
-  const dirs = minimalCoverDirs(relFiles);
-  if (dirs.length > 0 && !(dirs.length === 1 && dirs[0] === ".")) {
-    const absoluteDirs = dirs.map((d) => import_path.default.resolve(repositoryRoot, d));
-    if (argvBytes(absoluteDirs) <= ARGV_BYTE_BUDGET) {
-      return { targets: absoluteDirs, strategy: "dirs" };
+async function scanChunk(binary, args, ctx, errors) {
+  try {
+    const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
+      cwd: ctx.repositoryRoot,
+      logger: ctx.logger,
+      // Killed promptly if the runner's timeout aborts mid-scan (see the loop
+      // in analyze() which then returns the chunks completed so far).
+      signal: ctx.signal
+    });
+    if (stderr.trim()) {
+      ctx.logger.debug(`opengrep stderr:
+${stderr.trim()}`);
     }
+    if (!stdout.trim()) {
+      if (exitCode >= 2) {
+        errors.push({
+          toolId: TOOL_ID,
+          phase: "toolInvoke",
+          kind: "NonZeroExit",
+          message: `opengrep exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+          level: "error"
+        });
+      }
+      return { results: [], errors: [] };
+    }
+    let output;
+    try {
+      output = JSON.parse(stdout);
+    } catch (err) {
+      errors.push({
+        toolId: TOOL_ID,
+        phase: "outputParse",
+        kind: "MalformedOutput",
+        message: `Failed to parse opengrep JSON output: ${err instanceof Error ? err.message : String(err)}`,
+        level: "error"
+      });
+      return { results: [], errors: [] };
+    }
+    return { results: output.results ?? [], errors: output.errors ?? [] };
+  } catch (err) {
+    if (ctx.signal?.aborted) {
+      return { results: [], errors: [] };
+    }
+    errors.push({
+      toolId: TOOL_ID,
+      phase: "toolInvoke",
+      kind: "InvocationError",
+      message: `Failed to run opengrep: ${err instanceof Error ? err.message : String(err)}`,
+      level: "error"
+    });
+    return { results: [], errors: [] };
   }
-  return { targets: [repositoryRoot], strategy: "root" };
 }
 async function materializeConfig(ctx, enabledPatterns) {
   let rulesContent;
@@ -30750,17 +30790,13 @@ var adapter = {
     if (targetPathSet.size === 0) {
       return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
     }
-    const { targets: scanTargets, strategy: scanStrategy } = chooseScanTargets(
-      validatedAbsoluteFiles,
-      ctx.repositoryRoot
-    );
-    ctx.logger.debug("Opengrep scan targets chosen", {
+    const fileChunks = chunkFilesByArgvBudget(validatedAbsoluteFiles);
+    ctx.logger.debug("Opengrep scan chunks computed", {
       toolId: TOOL_ID,
-      strategy: scanStrategy,
-      targetCount: scanTargets.length,
+      chunkCount: fileChunks.length,
       fileCount: ctx.targetFiles.length
     });
-    const args = [
+    const baseArgs = [
       "scan",
       "--json",
       "--config",
@@ -30770,44 +30806,40 @@ var adapter = {
       "--timeout-threshold",
       "50",
       "--max-target-bytes",
-      "0",
+      "1000000",
       "--max-memory",
       "5000",
-      "--disable-version-check",
-      ...scanTargets
+      "--disable-version-check"
     ];
     try {
-      const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
-        cwd: ctx.repositoryRoot,
-        logger: ctx.logger
-      });
-      if (!stdout.trim()) {
-        if (exitCode >= 2) {
-          errors.push({
-            toolId: TOOL_ID,
-            phase: "toolInvoke",
-            kind: "NonZeroExit",
-            message: `opengrep exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
-            level: "error"
-          });
-        }
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      const allFindings = [];
+      const allOgErrors = [];
+      let scannedCount = 0;
+      for (const chunk of fileChunks) {
+        if (ctx.signal?.aborted) break;
+        const chunkOutput = await scanChunk(binary, [...baseArgs, ...chunk], ctx, errors);
+        allFindings.push(...chunkOutput.results);
+        allOgErrors.push(...chunkOutput.errors);
+        if (ctx.signal?.aborted) break;
+        scannedCount += chunk.length;
+        ctx.onProgress?.(`Scanning files ${scannedCount}/${validatedAbsoluteFiles.length}`);
       }
-      let output;
-      try {
-        output = JSON.parse(stdout);
-      } catch (err) {
+      if (ctx.signal?.aborted) {
         errors.push({
           toolId: TOOL_ID,
-          phase: "outputParse",
-          kind: "MalformedOutput",
-          message: `Failed to parse opengrep JSON output: ${err instanceof Error ? err.message : String(err)}`,
+          phase: "toolInvoke",
+          kind: "Timeout",
+          message: `opengrep timed out; returning partial results for ${scannedCount}/${validatedAbsoluteFiles.length} files`,
           level: "error"
         });
-        return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+        ctx.logger.warn("opengrep timed out; returning partial results", {
+          toolId: TOOL_ID,
+          scannedFiles: scannedCount,
+          totalFiles: validatedAbsoluteFiles.length
+        });
       }
-      if (output.errors && output.errors.length > 0) {
-        for (const ogError of output.errors) {
+      if (allOgErrors.length > 0) {
+        for (const ogError of allOgErrors) {
           if (ogError.path) {
             const absError = import_path.default.isAbsolute(ogError.path) ? ogError.path : import_path.default.resolve(ctx.repositoryRoot, ogError.path);
             const relError = import_path.default.relative(ctx.repositoryRoot, absError);
@@ -30820,6 +30852,7 @@ var adapter = {
           if (ogError.path && message.includes(ogError.path)) {
             message = message.replace(new RegExp(`at line \\S+:\\d+:\\n\\s*`), "");
           }
+          message = summarizeErrorMessage(message);
           const level = ogError.level === "error" ? "error" : "warning";
           const filePath = ogError.path ? import_path.default.isAbsolute(ogError.path) ? import_path.default.relative(ctx.repositoryRoot, ogError.path) : ogError.path : void 0;
           errors.push({
@@ -30835,7 +30868,7 @@ var adapter = {
       const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
       const configPrefix = configFile ? computeConfigPrefix(configFile, ctx.repositoryRoot) : "";
       const findingsByFile = /* @__PURE__ */ new Map();
-      for (const finding of output.results) {
+      for (const finding of allFindings) {
         if (finding.extra.is_ignored) continue;
         const absFinding = import_path.default.isAbsolute(finding.path) ? finding.path : import_path.default.resolve(ctx.repositoryRoot, finding.path);
         const relFinding = import_path.default.relative(ctx.repositoryRoot, absFinding);
@@ -30877,10 +30910,6 @@ var adapter = {
           issues.push(issue);
         }
       }
-      if (stderr.trim()) {
-        ctx.logger.debug(`opengrep stderr:
-${stderr.trim()}`);
-      }
     } catch (err) {
       errors.push({
         toolId: TOOL_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-opengrep-1",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Opengrep adapter — CLI-mode multi-language SAST scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   ],
   "dependencies": {
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.11.0"
+    "@codacy/tooling": "0.12.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",