@codacy/tools-opengrep-1 0.21.0 → 0.23.0

package/README.md

@@ -156,7 +156,7 @@ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh |
 - **Config file search**: `.semgrep.yaml`, `.opengrep.yaml`, `.semgrep.yml`, `.opengrep.yml` (in that order).
 - **Opengrep errors**: Parse errors (syntax errors, partial parsing) from Opengrep's JSON `errors` array are converted to structured `AnalysisError` objects with `filePath`. Stderr (scan status table) is logged at debug level only.
 - **Rule ID format**: Semgrep-rules use `{dir}.{filename}.{ruleId}` (dots), GitLab rules use `{dir}_{filename}` (underscores), Codacy custom rules keep their original IDs.
-- **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.16.4`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
+- **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.26.0`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
 - **Argv-size chunking (no directory walk)**: The adapter always passes Opengrep an **explicit file list** — the runner's already git-ignored, exclude-filtered target set — so Opengrep never walks the repository tree itself. `chunkFilesByArgvBudget()` splits that list into the **fewest, largest** chunks that each fit `ARGV_BYTE_BUDGET` (200 KB, well under `ARG_MAX`), and each chunk is scanned in its own `opengrep scan` invocation; findings and errors are merged across chunks. Chunk by **size, not count**: every invocation re-compiles `rules.yaml`, so fewer/larger chunks amortize that fixed cost. The earlier directory/“root” fallback was removed because on huge repos (a single tracked file at the repo root collapsed the minimal-cover dirs to `.`) it made Opengrep walk the entire tree — re-scanning excluded/generated/vendored files and timing out at the runner's 10-minute limit.
 - **File-size cap**: invocations pass `--max-target-bytes 1000000` (~1 MB). This restores Opengrep's default size cap — the adapter previously passed `0`, which **disables** the cap, so giant generated/minified bundles were scanned and dominated runtime. The cap applies to explicitly-listed files (verified on v1.16.4). Note: `--exclude-minified-files` is **not** used — that flag is rejected by the bundled binary unless `--experimental` (a different engine) is also passed, so we rely on the size cap instead. (The runner also enforces a tighter 150 KB per-file limit centrally before files reach the adapter, so this `--max-target-bytes` is now a secondary defense.)
 - **Partial results on timeout**: the per-chunk loop checks `ctx.signal` (the runner's timeout abort) between chunks and passes it to `spawnTool`, so an in-flight scan is killed promptly. On abort the adapter keeps the findings from completed chunks and adds a single `Timeout` error (→ `status: "partial"`) rather than losing everything. This is why chunking matters beyond ARG_MAX: it's the granularity at which a long scan can be stopped with results preserved.

package/dist/index.js

@@ -1109,7 +1109,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Error",
     title: "Avoid hard-coded passwords",
-    enabled: true,
+    enabled: false,
     languages: ["Shell"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1156,7 +1156,7 @@ var patterns_default = [
     category: "BestPractice",
     severityLevel: "Warning",
     title: "Avoid hardcoded strftime format strings",
-    enabled: true,
+    enabled: false,
     languages: ["CPP"],
     parameters: [],
     tags: [
@@ -1190,7 +1190,7 @@ var patterns_default = [
     category: "BestPractice",
     severityLevel: "Warning",
     title: "Avoid misleading exception class names",
-    enabled: true,
+    enabled: false,
     languages: ["CSharp"],
     parameters: []
   },
@@ -1199,7 +1199,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Error",
     title: "Avoid Hardcoded Passwords",
-    enabled: true,
+    enabled: false,
     languages: ["CSharp"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1238,7 +1238,7 @@ var patterns_default = [
     category: "ErrorProne",
     severityLevel: "Warning",
     title: "Avoid Empty Strings",
-    enabled: true,
+    enabled: false,
     languages: ["PLSQL"],
     parameters: []
   },
@@ -1247,7 +1247,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Error",
     title: "Avoid Hardcoded Passwords",
-    enabled: true,
+    enabled: false,
     languages: ["PLSQL"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1257,7 +1257,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Error",
     title: "Avoid Resource Injection",
-    enabled: true,
+    enabled: false,
     languages: ["PLSQL"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1267,7 +1267,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Detect Invisible Unicode Characters",
-    enabled: true,
+    enabled: false,
     languages: ["YAML", "JSON"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1376,7 +1376,7 @@ var patterns_default = [
     category: "BestPractice",
     severityLevel: "Warning",
     title: "Avoid hardcoded date format",
-    enabled: true,
+    enabled: false,
     languages: ["Java"],
     parameters: [],
     tags: [
@@ -1394,7 +1394,7 @@ var patterns_default = [
     category: "Compatibility",
     severityLevel: "Warning",
     title: "Avoid hardcoded decimal format patterns",
-    enabled: true,
+    enabled: false,
     languages: ["Java"],
     parameters: [],
     tags: [
@@ -1538,7 +1538,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Hardcoded Passwords",
-    enabled: true,
+    enabled: false,
     languages: ["Javascript", "TypeScript"],
     parameters: [],
     tags: ["security"]
@@ -1557,7 +1557,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Error",
     title: "Avoid Hard-Coded Passwords",
-    enabled: true,
+    enabled: false,
     languages: ["Java"],
     parameters: []
   },
@@ -1710,7 +1710,7 @@ var patterns_default = [
     category: "Compatibility",
     severityLevel: "High",
     title: "Avoid using IngressClass wired to Ingress NGINX controller",
-    enabled: true,
+    enabled: false,
     languages: ["YAML"],
     parameters: [],
     tags: ["plt:kubernetes", "ai-safety", "ai-risk", "ai", "tool:helm"]
@@ -1720,7 +1720,7 @@ var patterns_default = [
     category: "Compatibility",
     severityLevel: "Warning",
     title: "Avoid use of Ingress NGINX (ingress class nginx)",
-    enabled: true,
+    enabled: false,
     languages: ["YAML"],
     parameters: [],
     tags: ["plt:kubernetes", "ai-safety", "ai-risk", "ai", "tool:helm"]
@@ -1730,7 +1730,7 @@ var patterns_default = [
     category: "BestPractice",
     severityLevel: "Warning",
     title: "Flag usage of ingress-nginx workload labels",
-    enabled: true,
+    enabled: false,
     languages: ["YAML"],
     parameters: [],
     tags: ["plt:kubernetes", "ai-safety", "ai-risk", "ai", "tool:helm"]
@@ -1776,7 +1776,7 @@ var patterns_default = [
     category: "BestPractice",
     severityLevel: "Warning",
     title: "Avoid hardcoded strftime format strings",
-    enabled: true,
+    enabled: false,
     languages: ["Python"],
     parameters: [],
     tags: [
@@ -1794,7 +1794,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Require OpenAI SDK usage with Guardrails",
-    enabled: true,
+    enabled: false,
     languages: ["Python"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1804,7 +1804,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid OpenAI client usage without Guardrails",
-    enabled: true,
+    enabled: false,
     languages: ["Python"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -1814,7 +1814,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid direct OpenAI SDK calls (use Guardrails client)",
-    enabled: true,
+    enabled: false,
     languages: ["Python"],
     parameters: [],
     tags: ["ai", "ai-risk", "ai-safety"]
@@ -30723,7 +30723,7 @@ var pattern_mappings_default = {
 var descriptor = {
   id: "Semgrep",
   displayName: "Opengrep",
-  preferredVersion: "1.16.4",
+  preferredVersion: "1.26.0",
   languages: [
     "Apex",
     "Bash",

package/dist/metadata.js

@@ -256,7 +256,7 @@ var pattern_mappings_default = {
 var descriptor = {
   id: "Semgrep",
   displayName: "Opengrep",
-  preferredVersion: "1.16.4",
+  preferredVersion: "1.26.0",
   languages: [
     "Apex",
     "Bash",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-opengrep-1",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Opengrep adapter — CLI-mode multi-language SAST scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   ],
   "dependencies": {
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.21.0"
+    "@codacy/tooling": "0.23.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",