@codacy/tools-opengrep-1 0.23.1 → 0.25.0

package/README.md

@@ -24,20 +24,47 @@ Multi-language SAST (Static Application Security Testing) scanner using the [Ope
 | Strategy         | CLI                                                                |
 | Languages        | 30+ (Python, JavaScript, TypeScript, Java, Go, Ruby, C, C++, etc.) |
 | Binary           | `opengrep`                                                         |
-| File patterns    | `*` (auto-detects by language)                                     |
+| File patterns    | ~70 extensions derived from the languages above, plus `Dockerfile` |
 | Pattern count    | ~2500                                                              |
 | Extra dependency | `yaml` (for YAML rule config parsing/generation)                   |
 
 ## Rule bundling
 
-Opengrep uses YAML rule files for detection. The adapter bundles ~2200 rules into `src/rules.yaml`, sourced from:
+Opengrep uses YAML rule files for detection. The adapter bundles ~2500 rules into `src/rules.yaml`, sourced from:
 
-1. **semgrep/semgrep-rules** — community rules (pinned at commit `4ccd3b9`)
-2. **GitLab SAST rules** — MIT-licensed rules from `gitlab.com/gitlab-org/security-products/sast-rules`
-3. **Codacy custom rules** — from `codacy/codacy-opengrep` wrapper repo
+1. **opengrep/opengrep-rules** — the registry rules, pinned at the same commit as the Codacy image
+2. **GitLab SAST rules** — MIT-licensed, from `gitlab.com/gitlab-org/security-products/sast-rules`
+3. **Codacy custom rules** — `docs/codacy-rules*.yaml` in `codacy/codacy-opengrep`
 
 The bundled `src/rules.yaml` is **committed to the repository** for consistency and reproducibility.
 
+### Keeping it in step with the Codacy image
+
+All three sources, their pinned commits and their file filters are mirrored from
+`codacy/codacy-opengrep`'s `internal/docgen/parsing.go`. Keep them that way: the image is the
+reference implementation, and `scripts/fetch-rules.mjs` says which upstream function each piece
+came from.
+
+Three mistakes in that mirroring cost **296 of 2534 patterns (12%)**, every one of them silent —
+the pattern stays in `patterns.json`, `init --auto` enables it, the config claims it is active, and
+it simply never fires:
+
+- **Rule ids were derived from the file path.** GitLab ids are written in the file and must be
+  taken verbatim. Path derivation looks right for the top-level tree (`java/crypto/rule-X.yml`
+  really does hold `java_crypto_rule-X`) and is wrong for the licence-tiered one, where
+  `rules/lgpl-cc/properties/spring/accesscontrol/rule-Y.yml` holds `properties_spring_rule-Y`. The
+  sharpest case is `rule-JwtDecodeWithoutVerify.yml`, whose id uses an underscore where the
+  filename uses a hyphen. 265 of 588 GitLab rules were lost this way.
+- **The registry source was upstream `semgrep/semgrep-rules`**, not Opengrep's fork. The two share
+  most ids, so the output looks plausible while individual rules go missing.
+- **YAML was read and rewritten line by line.** That corrupted multi-line flow scalars — the
+  generated file stopped parsing, and opengrep then reported _zero findings for the entire run_
+  rather than an error — and it skipped every `tests/` directory, where some shipped rules live.
+
+`test/rules-coverage.test.ts` is the guard: it fails if any catalogued pattern has no rule, and if
+the generated file does not parse. Run `pnpm fetch-rules` when it does; the script prints the
+orphaned ids.
+
 ## Updating patterns
 
 ```bash
@@ -57,7 +84,8 @@ Pattern IDs follow the format `Semgrep_python.lang.security.audit.exec-detected.
 pnpm fetch-rules
 
 # This clones the rule repos, extracts matching rules, and writes src/rules.yaml
-# Only rules whose IDs match src/patterns.json are included
+# Only rules whose IDs match src/patterns.json are included — and the script now
+# warns loudly about the reverse, a catalogued pattern with no rule to run.
 
 # Commit the result
 git add src/rules.yaml
@@ -99,8 +127,9 @@ codacy-analysis analyze . --tool opengrep --install-dependencies
 ```
 
 `install()` downloads the matching statically-linked binary from GitHub releases
-(no archive to unpack) and `chmod +x`es it. The platform/arch/libc → asset
-mapping mirrors opengrep's official `install.sh`:
+(no archive to unpack) and `chmod +x`es it (not on Windows). The
+platform/arch/libc → asset mapping mirrors opengrep's official `install.sh` and
+`install.ps1`:
 
 | Platform                  | Asset                        |
 | ------------------------- | ---------------------------- |
@@ -110,11 +139,15 @@ mapping mirrors opengrep's official `install.sh`:
 | Linux arm64 (glibc)       | `opengrep_manylinux_aarch64` |
 | Linux x64 (musl/Alpine)   | `opengrep_musllinux_x86`     |
 | Linux arm64 (musl/Alpine) | `opengrep_musllinux_aarch64` |
+| Windows x64               | `opengrep_windows_x86.exe`   |
+| Windows arm64 (emulated)  | `opengrep_windows_x86.exe`   |
 
 To install manually instead:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
+# Windows (PowerShell)
+irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex
 ```
 
 ## Notes for maintainers
@@ -152,11 +185,11 @@ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh |
 
 - **Tool ID is `Semgrep`** for legacy compatibility with the Codacy platform. The `displayName` is set to `Opengrep` for CLI display. Never change the tool ID without coordinating with the Codacy platform team.
 - **Config materialization**: When Codacy patterns are specified, the adapter loads `src/rules.yaml`, filters to enabled rules, and writes a filtered config to `.codacy/generated/opengrep-rules.yaml`.
-- **check_id prefix stripping**: Opengrep prepends a path-based namespace to check_ids derived from the config file path relative to cwd. The adapter computes and strips this prefix (e.g. `codacy.generated.`) plus any `tmp.` legacy prefix.
+- **check_id is the bare rule ID**: every invocation passes `--no-rewrite-rule-ids`. Without it Opengrep prefixes `check_id` with the config file's directory relative to cwd (`.codacy/generated/x.yaml` → `codacy.generated.`), and the adapter used to reproduce that path math to strip the prefix again — never verified on Windows, where a mismatch would silently drop every finding at the enabled-pattern check. With the flag the rule ID maps to a pattern ID directly on every OS.
 - **Config file search**: `.semgrep.yaml`, `.opengrep.yaml`, `.semgrep.yml`, `.opengrep.yml` (in that order).
 - **Opengrep errors**: Parse errors (syntax errors, partial parsing) from Opengrep's JSON `errors` array are converted to structured `AnalysisError` objects with `filePath`. Stderr (scan status table) is logged at debug level only.
 - **Rule ID format**: Semgrep-rules use `{dir}.{filename}.{ruleId}` (dots), GitLab rules use `{dir}_{filename}` (underscores), Codacy custom rules keep their original IDs.
-- **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.26.0`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
+- **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.26.0`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. On Windows the binary is saved as `opengrep.exe`; upstream builds only x64, which `install.ps1` also installs on ARM64 (emulated), so we do the same. **From opengrep 2.0.0 the Windows asset becomes `opengrep_windows_x86.zip`** (exe + DLLs) — bumping `preferredVersion` past 2.0 needs an extraction step. The argv chunk budget drops to `MAX_ARGV_BYTES` (30,000) on Windows, whose command line is capped at 32,767 characters. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
 - **Argv-size chunking (no directory walk)**: The adapter always passes Opengrep an **explicit file list** — the runner's already git-ignored, exclude-filtered target set — so Opengrep never walks the repository tree itself. `chunkFilesByArgvBudget()` splits that list into the **fewest, largest** chunks that each fit `ARGV_BYTE_BUDGET` (200 KB, well under `ARG_MAX`), and each chunk is scanned in its own `opengrep scan` invocation; findings and errors are merged across chunks. Chunk by **size, not count**: every invocation re-compiles `rules.yaml`, so fewer/larger chunks amortize that fixed cost. The earlier directory/“root” fallback was removed because on huge repos (a single tracked file at the repo root collapsed the minimal-cover dirs to `.`) it made Opengrep walk the entire tree — re-scanning excluded/generated/vendored files and timing out at the runner's 10-minute limit.
 - **File-size cap**: invocations pass `--max-target-bytes 1000000` (~1 MB). This restores Opengrep's default size cap — the adapter previously passed `0`, which **disables** the cap, so giant generated/minified bundles were scanned and dominated runtime. The cap applies to explicitly-listed files (verified on v1.16.4). Note: `--exclude-minified-files` is **not** used — that flag is rejected by the bundled binary unless `--experimental` (a different engine) is also passed, so we rely on the size cap instead. (The runner also enforces a tighter 150 KB per-file limit centrally before files reach the adapter, so this `--max-target-bytes` is now a secondary defense.)
 - **Partial results on timeout**: the per-chunk loop checks `ctx.signal` (the runner's timeout abort) between chunks and passes it to `spawnTool`, so an in-flight scan is killed promptly. On abort the adapter keeps the findings from completed chunks and adds a single `Timeout` error (→ `status: "partial"`) rather than losing everything. This is why chunking matters beyond ARG_MAX: it's the granularity at which a long scan can be stopped with results preserved.

package/dist/index.js

@@ -30722,14 +30722,18 @@ var pattern_mappings_default = {
 // src/metadata.ts
 var descriptor = {
   id: "Semgrep",
+  shortName: "opengrep",
   displayName: "Opengrep",
   preferredVersion: "1.26.0",
+  // Canonical `KNOWN_LANGUAGES` names, which is what `init --auto` matches against
+  // (`init.ts:882`). The engine's own names differ and must be translated here:
+  // Bash/Shell and Vue/Javascript collapse onto one entry each, since `.sh` and
+  // `.vue` are already those languages. Guarded by `descriptor-languages.test.ts`.
   languages: [
     "Apex",
-    "Bash",
     "C",
-    "C++",
-    "C#",
+    "CPP",
+    "CSharp",
     "Clojure",
     "Dart",
     "Dockerfile",
@@ -30737,7 +30741,7 @@ var descriptor = {
     "Go",
     "HTML",
     "Java",
-    "JavaScript",
+    "Javascript",
     "JSON",
     "Kotlin",
     "Lua",
@@ -30750,13 +30754,111 @@ var descriptor = {
     "Swift",
     "Terraform",
     "TypeScript",
-    "Visual Basic",
-    "Vue",
+    "VisualBasic",
     "XML",
     "YAML"
   ],
-  filePatterns: ["*"],
-  supportedOS: ["linux", "darwin"],
+  // Derived from `languages` above, via `LANGUAGE_CONFIG`, plus the extensions
+  // sibling adapters already route for those same languages (`.cjs`, `.hh`,
+  // `.jsonc`, `.json5`, `.pyi`, `.dash`, `.ksh`) — `LANGUAGE_CONFIG` is a
+  // detection map and does not claim to be exhaustive per tool.
+  //
+  // This was `["*"]`, which `routeFilesToTool` short-circuits to "every file", so
+  // opengrep was handed the whole repository: on one 1774-file repo, 358 of them
+  // (20%) were png/jpg/font assets. Opengrep resolves a language by extension and
+  // skips what it cannot parse, so findings were never affected — but the paths
+  // still cost a realpath+stat each, inflated the reported file count, and ate the
+  // 200 KB argv budget, splitting one `opengrep scan` into two.
+  //
+  // Keep this a superset of `LANGUAGE_CONFIG`'s extensions for every declared
+  // language; `opengrep-1/test/file-patterns.test.ts` fails if a language gains one
+  // that is not routed here, because a missed extension is a silent coverage loss.
+  filePatterns: [
+    "**/*.bash",
+    "**/*.c",
+    "**/*.cc",
+    "**/*.cjs",
+    "**/*.clj",
+    "**/*.cljc",
+    "**/*.cljs",
+    "**/*.cls",
+    "**/*.cpp",
+    "**/*.cs",
+    "**/*.cxx",
+    "**/*.dart",
+    "**/*.dash",
+    "**/*.dockerfile",
+    "**/*.edn",
+    "**/*.env",
+    "**/*.ex",
+    "**/*.exs",
+    "**/*.gemspec",
+    "**/*.go",
+    "**/*.h",
+    "**/*.hh",
+    "**/*.hpp",
+    "**/*.htm",
+    "**/*.html",
+    "**/*.ino",
+    "**/*.java",
+    "**/*.jbuilder",
+    "**/*.js",
+    "**/*.jsm",
+    "**/*.json",
+    "**/*.json5",
+    "**/*.jsonc",
+    "**/*.jsx",
+    "**/*.ksh",
+    "**/*.kt",
+    "**/*.kts",
+    "**/*.lua",
+    "**/*.luau",
+    "**/*.mjs",
+    "**/*.opal",
+    "**/*.php",
+    "**/*.podspec",
+    "**/*.pom",
+    "**/*.py",
+    "**/*.pyi",
+    "**/*.rake",
+    "**/*.rb",
+    "**/*.rlib",
+    "**/*.rs",
+    "**/*.scala",
+    "**/*.sh",
+    "**/*.swift",
+    "**/*.tf",
+    "**/*.trigger",
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.vb",
+    "**/*.vue",
+    "**/*.wsdl",
+    "**/*.xhtml",
+    "**/*.xml",
+    "**/*.xsl",
+    "**/*.yaml",
+    "**/*.yml",
+    // Source files with no extension. `LANGUAGE_CONFIG.files` is a *detection*
+    // list — it is mostly lockfiles (`yarn.lock`, `go.sum`, `poetry.lock`), which
+    // identify a language without being source in it — so only the entries
+    // opengrep can actually parse are routed here: Dockerfiles, and Ruby's
+    // extensionless DSL files.
+    "**/Dockerfile",
+    "**/Dockerfile.*",
+    "**/Berksfile",
+    "**/Capfile",
+    "**/Cheffile",
+    "**/Fastfile",
+    "**/Gemfile",
+    "**/Guardfile",
+    "**/Podfile",
+    "**/Rakefile",
+    "**/Thorfile",
+    "**/Vagrantfile",
+    "**/config.ru"
+  ],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default
@@ -30801,6 +30903,10 @@ function opengrepAssetName(osName, arch, muslLibc) {
     if (arch === "arm64") return `opengrep_${flavour}_aarch64`;
     return null;
   }
+  if (osName === "win32") {
+    if (arch === "x64" || arch === "arm64") return "opengrep_windows_x86.exe";
+    return null;
+  }
   return null;
 }
 async function isMuslLibc() {
@@ -30826,30 +30932,18 @@ async function getVersionFromBinary(binaryPath) {
   }
 }
 async function resolveBinaryPath(ctx) {
-  const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
+  const codacyBin = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
   const version = await getVersionFromBinary(codacyBin);
   if (version) return codacyBin;
   return BINARY;
 }
-function computeConfigPrefix(configPath, cwd) {
-  const relPath = import_path.default.relative(cwd, configPath);
-  const dir = import_path.default.dirname(relPath);
-  if (dir === ".") return "";
-  const components = dir.split(import_path.default.sep).map((c) => c.replace(/^\.+/, ""));
-  return components.filter(Boolean).join(".") + ".";
-}
-function stripCheckIdPrefix(checkId, configPrefix) {
-  let stripped = checkId.startsWith("tmp.") ? checkId.slice(4) : checkId;
-  if (configPrefix && stripped.startsWith(configPrefix)) {
-    stripped = stripped.slice(configPrefix.length);
-  }
-  return stripped;
-}
-function truncate(str, maxLen) {
-  if (str.length <= maxLen) return str;
-  return str.slice(0, maxLen - 3) + "...";
+function firstSentence(message) {
+  const oneLine = message.replace(/\n/g, " ");
+  const match = /(^.*?[a-z]{2,}[.!?])\s+\W*[A-Z]/.exec(oneLine);
+  if (match) return match[1];
+  return oneLine.length > 500 ? oneLine.slice(0, 500) : oneLine;
 }
-var ARGV_BYTE_BUDGET = 200 * 1024;
+var ARGV_BYTE_BUDGET = import_tooling.IS_WINDOWS ? import_tooling.MAX_ARGV_BYTES : 200 * 1024;
 function chunkFilesByArgvBudget(files) {
   const chunks = [];
   let current = [];
@@ -30969,7 +31063,7 @@ var adapter = {
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
-    const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
+    const codacyBin = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
     const codacyVersion = await getVersionFromBinary(codacyBin);
     if (codacyVersion) {
       ctx.logger.debug("Found opengrep in codacy install dir", {
@@ -30999,21 +31093,22 @@ var adapter = {
     return {
       available: false,
       reason: "opengrep binary not found in PATH or Codacy install directory",
-      installHint: "codacy-analysis analyze . --install-dependencies  # auto-install into ~/.codacy\ncurl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash  # manual"
+      installHint: "codacy-analysis analyze . --install-dependencies  # auto-install into ~/.codacy\n" + (import_tooling.IS_WINDOWS ? "irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex  # manual (PowerShell)" : "curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash  # manual")
     };
   },
   /**
    * Downloads the opengrep binary from GitHub releases into `ctx.toolInstallDir`.
    *
    * Opengrep distributes a single statically-linked executable per platform
-   * (no archive), so install is just a download + `chmod +x`. The
-   * platform/arch/libc → asset mapping mirrors opengrep's official install.sh
-   * (see {@link opengrepAssetName}). The binary lands at
-   * `ctx.toolInstallDir/opengrep`, which `checkAvailability` probes first — so
-   * the runner's post-install re-check picks up the managed install.
+   * (no archive), so install is just a download + `chmod +x` (no chmod on
+   * Windows). The platform/arch/libc → asset mapping mirrors opengrep's
+   * official install.sh / install.ps1 (see {@link opengrepAssetName}). The
+   * binary lands at `ctx.toolInstallDir/opengrep` (`opengrep.exe` on Windows),
+   * which `checkAvailability` probes first — so the runner's post-install
+   * re-check picks up the managed install.
    *
    * Returns an `UnsupportedPlatform` error for targets opengrep has no binary
-   * for (e.g. Windows), and a `DownloadError` if the fetch fails.
+   * for, and a `DownloadError` if the fetch fails.
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
@@ -31028,17 +31123,17 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "toolInstall",
           kind: "UnsupportedPlatform",
-          message: `Unsupported platform: ${platformKey}. Opengrep provides binaries for darwin-x64, darwin-arm64, linux-x64, and linux-arm64.`,
+          message: `Unsupported platform: ${platformKey}. Opengrep provides binaries for darwin-x64, darwin-arm64, linux-x64, linux-arm64, and win32-x64 (also used on win32-arm64).`,
           level: "error"
         }
       };
     }
     const url = `https://github.com/opengrep/opengrep/releases/download/v${version}/${assetName}`;
-    const destPath = import_path.default.join(ctx.toolInstallDir, BINARY);
+    const destPath = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
     try {
       ctx.logger.info(`Downloading Opengrep v${version} for ${platformKey}...`);
       await (0, import_tooling.downloadFile)(url, destPath, ctx.logger);
-      await import_promises.default.chmod(destPath, 493);
+      if (!import_tooling.IS_WINDOWS) await import_promises.default.chmod(destPath, 493);
       ctx.logger.info(`Installed opengrep v${version} to ${destPath}`);
       return { success: true, installedPath: destPath, installedVersion: version };
     } catch (err) {
@@ -31086,8 +31181,9 @@ var adapter = {
    *    the enabled rules and write a generated config.
    * 3. If no patterns and no local config, use the full bundled rules.yaml.
    *
-   * The `tmp.` prefix that opengrep adds to check IDs when using inline
-   * configs is stripped before building pattern IDs.
+   * Every invocation passes `--no-rewrite-rule-ids`, so `check_id` is the rule
+   * ID exactly as written in the config and maps to a pattern ID directly (see
+   * the note on `baseArgs`).
    *
    * Exit codes:
    * - 0: success (findings may or may not exist)
@@ -31160,6 +31256,7 @@ var adapter = {
       "--json",
       "--config",
       configFile,
+      "--no-rewrite-rule-ids",
       "--timeout",
       "5",
       "--timeout-threshold",
@@ -31220,12 +31317,14 @@ var adapter = {
             kind: errorType,
             message,
             level,
-            filePath
+            filePath,
+            // Opengrep only reports a path on errors that stopped it scanning
+            // that file, so a path here means the file was not analysed.
+            ...filePath ? { fileNotAnalyzed: true } : {}
           });
         }
       }
       const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
-      const configPrefix = configFile ? computeConfigPrefix(configFile, ctx.repositoryRoot) : "";
       const findingsByFile = /* @__PURE__ */ new Map();
       for (const finding of allFindings) {
         if (finding.extra.is_ignored) continue;
@@ -31243,7 +31342,7 @@ var adapter = {
         const lines = await (0, import_tooling.readFileLines)(absoluteFilePath);
         const relPath = import_path.default.relative(ctx.repositoryRoot, absoluteFilePath);
         for (const finding of fileFindings) {
-          const ruleId = stripCheckIdPrefix(finding.check_id, configPrefix);
+          const ruleId = finding.check_id;
           const patternId = `${TOOL_ID}_${ruleId}`;
           if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) {
             continue;
@@ -31257,7 +31356,7 @@ var adapter = {
             column: finding.start.col,
             endLine: finding.end.line,
             endColumn: finding.end.col,
-            message: truncate(finding.extra.message, 250),
+            message: firstSentence(finding.extra.message ?? ""),
             lineContent: (0, import_tooling.getLineContent)(lines, finding.start.line),
             multilineContent: (0, import_tooling.getMultilineContent)(lines, finding.start.line, finding.end.line),
             category: meta.category,

package/dist/metadata.js

@@ -255,14 +255,18 @@ var pattern_mappings_default = {
 // src/metadata.ts
 var descriptor = {
   id: "Semgrep",
+  shortName: "opengrep",
   displayName: "Opengrep",
   preferredVersion: "1.26.0",
+  // Canonical `KNOWN_LANGUAGES` names, which is what `init --auto` matches against
+  // (`init.ts:882`). The engine's own names differ and must be translated here:
+  // Bash/Shell and Vue/Javascript collapse onto one entry each, since `.sh` and
+  // `.vue` are already those languages. Guarded by `descriptor-languages.test.ts`.
   languages: [
     "Apex",
-    "Bash",
     "C",
-    "C++",
-    "C#",
+    "CPP",
+    "CSharp",
     "Clojure",
     "Dart",
     "Dockerfile",
@@ -270,7 +274,7 @@ var descriptor = {
     "Go",
     "HTML",
     "Java",
-    "JavaScript",
+    "Javascript",
     "JSON",
     "Kotlin",
     "Lua",
@@ -283,13 +287,111 @@ var descriptor = {
     "Swift",
     "Terraform",
     "TypeScript",
-    "Visual Basic",
-    "Vue",
+    "VisualBasic",
     "XML",
     "YAML"
   ],
-  filePatterns: ["*"],
-  supportedOS: ["linux", "darwin"],
+  // Derived from `languages` above, via `LANGUAGE_CONFIG`, plus the extensions
+  // sibling adapters already route for those same languages (`.cjs`, `.hh`,
+  // `.jsonc`, `.json5`, `.pyi`, `.dash`, `.ksh`) — `LANGUAGE_CONFIG` is a
+  // detection map and does not claim to be exhaustive per tool.
+  //
+  // This was `["*"]`, which `routeFilesToTool` short-circuits to "every file", so
+  // opengrep was handed the whole repository: on one 1774-file repo, 358 of them
+  // (20%) were png/jpg/font assets. Opengrep resolves a language by extension and
+  // skips what it cannot parse, so findings were never affected — but the paths
+  // still cost a realpath+stat each, inflated the reported file count, and ate the
+  // 200 KB argv budget, splitting one `opengrep scan` into two.
+  //
+  // Keep this a superset of `LANGUAGE_CONFIG`'s extensions for every declared
+  // language; `opengrep-1/test/file-patterns.test.ts` fails if a language gains one
+  // that is not routed here, because a missed extension is a silent coverage loss.
+  filePatterns: [
+    "**/*.bash",
+    "**/*.c",
+    "**/*.cc",
+    "**/*.cjs",
+    "**/*.clj",
+    "**/*.cljc",
+    "**/*.cljs",
+    "**/*.cls",
+    "**/*.cpp",
+    "**/*.cs",
+    "**/*.cxx",
+    "**/*.dart",
+    "**/*.dash",
+    "**/*.dockerfile",
+    "**/*.edn",
+    "**/*.env",
+    "**/*.ex",
+    "**/*.exs",
+    "**/*.gemspec",
+    "**/*.go",
+    "**/*.h",
+    "**/*.hh",
+    "**/*.hpp",
+    "**/*.htm",
+    "**/*.html",
+    "**/*.ino",
+    "**/*.java",
+    "**/*.jbuilder",
+    "**/*.js",
+    "**/*.jsm",
+    "**/*.json",
+    "**/*.json5",
+    "**/*.jsonc",
+    "**/*.jsx",
+    "**/*.ksh",
+    "**/*.kt",
+    "**/*.kts",
+    "**/*.lua",
+    "**/*.luau",
+    "**/*.mjs",
+    "**/*.opal",
+    "**/*.php",
+    "**/*.podspec",
+    "**/*.pom",
+    "**/*.py",
+    "**/*.pyi",
+    "**/*.rake",
+    "**/*.rb",
+    "**/*.rlib",
+    "**/*.rs",
+    "**/*.scala",
+    "**/*.sh",
+    "**/*.swift",
+    "**/*.tf",
+    "**/*.trigger",
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.vb",
+    "**/*.vue",
+    "**/*.wsdl",
+    "**/*.xhtml",
+    "**/*.xml",
+    "**/*.xsl",
+    "**/*.yaml",
+    "**/*.yml",
+    // Source files with no extension. `LANGUAGE_CONFIG.files` is a *detection*
+    // list — it is mostly lockfiles (`yarn.lock`, `go.sum`, `poetry.lock`), which
+    // identify a language without being source in it — so only the entries
+    // opengrep can actually parse are routed here: Dockerfiles, and Ruby's
+    // extensionless DSL files.
+    "**/Dockerfile",
+    "**/Dockerfile.*",
+    "**/Berksfile",
+    "**/Capfile",
+    "**/Cheffile",
+    "**/Fastfile",
+    "**/Gemfile",
+    "**/Guardfile",
+    "**/Podfile",
+    "**/Rakefile",
+    "**/Thorfile",
+    "**/Vagrantfile",
+    "**/config.ru"
+  ],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-opengrep-1",
-  "version": "0.23.1",
+  "version": "0.25.0",
   "description": "Opengrep adapter — CLI-mode multi-language SAST scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   ],
   "dependencies": {
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.23.1"
+    "@codacy/tooling": "0.25.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",