@codacy/tools-opengrep-1 0.24.0 → 0.25.0

package/README.md

@@ -127,8 +127,9 @@ codacy-analysis analyze . --tool opengrep --install-dependencies
 ```
 
 `install()` downloads the matching statically-linked binary from GitHub releases
-(no archive to unpack) and `chmod +x`es it. The platform/arch/libc → asset
-mapping mirrors opengrep's official `install.sh`:
+(no archive to unpack) and `chmod +x`es it (not on Windows). The
+platform/arch/libc → asset mapping mirrors opengrep's official `install.sh` and
+`install.ps1`:
 
 | Platform                  | Asset                        |
 | ------------------------- | ---------------------------- |
@@ -138,11 +139,15 @@ mapping mirrors opengrep's official `install.sh`:
 | Linux arm64 (glibc)       | `opengrep_manylinux_aarch64` |
 | Linux x64 (musl/Alpine)   | `opengrep_musllinux_x86`     |
 | Linux arm64 (musl/Alpine) | `opengrep_musllinux_aarch64` |
+| Windows x64               | `opengrep_windows_x86.exe`   |
+| Windows arm64 (emulated)  | `opengrep_windows_x86.exe`   |
 
 To install manually instead:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
+# Windows (PowerShell)
+irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex
 ```
 
 ## Notes for maintainers
@@ -180,11 +185,11 @@ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh |
 
 - **Tool ID is `Semgrep`** for legacy compatibility with the Codacy platform. The `displayName` is set to `Opengrep` for CLI display. Never change the tool ID without coordinating with the Codacy platform team.
 - **Config materialization**: When Codacy patterns are specified, the adapter loads `src/rules.yaml`, filters to enabled rules, and writes a filtered config to `.codacy/generated/opengrep-rules.yaml`.
-- **check_id prefix stripping**: Opengrep prepends a path-based namespace to check_ids derived from the config file path relative to cwd. The adapter computes and strips this prefix (e.g. `codacy.generated.`) plus any `tmp.` legacy prefix.
+- **check_id is the bare rule ID**: every invocation passes `--no-rewrite-rule-ids`. Without it Opengrep prefixes `check_id` with the config file's directory relative to cwd (`.codacy/generated/x.yaml` → `codacy.generated.`), and the adapter used to reproduce that path math to strip the prefix again — never verified on Windows, where a mismatch would silently drop every finding at the enabled-pattern check. With the flag the rule ID maps to a pattern ID directly on every OS.
 - **Config file search**: `.semgrep.yaml`, `.opengrep.yaml`, `.semgrep.yml`, `.opengrep.yml` (in that order).
 - **Opengrep errors**: Parse errors (syntax errors, partial parsing) from Opengrep's JSON `errors` array are converted to structured `AnalysisError` objects with `filePath`. Stderr (scan status table) is logged at debug level only.
 - **Rule ID format**: Semgrep-rules use `{dir}.{filename}.{ruleId}` (dots), GitLab rules use `{dir}_{filename}` (underscores), Codacy custom rules keep their original IDs.
-- **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.26.0`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
+- **Install / binary download**: `install()` downloads the bare per-platform binary from `https://github.com/opengrep/opengrep/releases/download/v{version}/{asset}` and `chmod +x`es it into `~/.codacy/tools/`. The release tag carries a `v` prefix (`v1.26.0`) even though `preferredVersion` does not. On Linux the libc flavour is detected with an `ldd /bin/sh` probe (`musl` → musllinux, else manylinux); detection failures fall back to glibc/manylinux. On Windows the binary is saved as `opengrep.exe`; upstream builds only x64, which `install.ps1` also installs on ARM64 (emulated), so we do the same. **From opengrep 2.0.0 the Windows asset becomes `opengrep_windows_x86.zip`** (exe + DLLs) — bumping `preferredVersion` past 2.0 needs an extraction step. The argv chunk budget drops to `MAX_ARGV_BYTES` (30,000) on Windows, whose command line is capped at 32,767 characters. Unlike install.sh, the Codacy-managed install does **not** verify the cosign `.cert`/`.sig` signatures — if signature verification becomes a requirement, fetch those sibling assets and validate before chmod.
 - **Argv-size chunking (no directory walk)**: The adapter always passes Opengrep an **explicit file list** — the runner's already git-ignored, exclude-filtered target set — so Opengrep never walks the repository tree itself. `chunkFilesByArgvBudget()` splits that list into the **fewest, largest** chunks that each fit `ARGV_BYTE_BUDGET` (200 KB, well under `ARG_MAX`), and each chunk is scanned in its own `opengrep scan` invocation; findings and errors are merged across chunks. Chunk by **size, not count**: every invocation re-compiles `rules.yaml`, so fewer/larger chunks amortize that fixed cost. The earlier directory/“root” fallback was removed because on huge repos (a single tracked file at the repo root collapsed the minimal-cover dirs to `.`) it made Opengrep walk the entire tree — re-scanning excluded/generated/vendored files and timing out at the runner's 10-minute limit.
 - **File-size cap**: invocations pass `--max-target-bytes 1000000` (~1 MB). This restores Opengrep's default size cap — the adapter previously passed `0`, which **disables** the cap, so giant generated/minified bundles were scanned and dominated runtime. The cap applies to explicitly-listed files (verified on v1.16.4). Note: `--exclude-minified-files` is **not** used — that flag is rejected by the bundled binary unless `--experimental` (a different engine) is also passed, so we rely on the size cap instead. (The runner also enforces a tighter 150 KB per-file limit centrally before files reach the adapter, so this `--max-target-bytes` is now a secondary defense.)
 - **Partial results on timeout**: the per-chunk loop checks `ctx.signal` (the runner's timeout abort) between chunks and passes it to `spawnTool`, so an in-flight scan is killed promptly. On abort the adapter keeps the findings from completed chunks and adds a single `Timeout` error (→ `status: "partial"`) rather than losing everything. This is why chunking matters beyond ARG_MAX: it's the granularity at which a long scan can be stopped with results preserved.

package/dist/index.js

@@ -30858,7 +30858,7 @@ var descriptor = {
     "**/Vagrantfile",
     "**/config.ru"
   ],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default
@@ -30903,6 +30903,10 @@ function opengrepAssetName(osName, arch, muslLibc) {
     if (arch === "arm64") return `opengrep_${flavour}_aarch64`;
     return null;
   }
+  if (osName === "win32") {
+    if (arch === "x64" || arch === "arm64") return "opengrep_windows_x86.exe";
+    return null;
+  }
   return null;
 }
 async function isMuslLibc() {
@@ -30928,32 +30932,18 @@ async function getVersionFromBinary(binaryPath) {
   }
 }
 async function resolveBinaryPath(ctx) {
-  const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
+  const codacyBin = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
   const version = await getVersionFromBinary(codacyBin);
   if (version) return codacyBin;
   return BINARY;
 }
-function computeConfigPrefix(configPath, cwd) {
-  const relPath = import_path.default.relative(cwd, configPath);
-  const dir = import_path.default.dirname(relPath);
-  if (dir === ".") return "";
-  const components = dir.split(import_path.default.sep).map((c) => c.replace(/^\.+/, ""));
-  return components.filter(Boolean).join(".") + ".";
-}
-function stripCheckIdPrefix(checkId, configPrefix) {
-  let stripped = checkId.startsWith("tmp.") ? checkId.slice(4) : checkId;
-  if (configPrefix && stripped.startsWith(configPrefix)) {
-    stripped = stripped.slice(configPrefix.length);
-  }
-  return stripped;
-}
 function firstSentence(message) {
   const oneLine = message.replace(/\n/g, " ");
   const match = /(^.*?[a-z]{2,}[.!?])\s+\W*[A-Z]/.exec(oneLine);
   if (match) return match[1];
   return oneLine.length > 500 ? oneLine.slice(0, 500) : oneLine;
 }
-var ARGV_BYTE_BUDGET = 200 * 1024;
+var ARGV_BYTE_BUDGET = import_tooling.IS_WINDOWS ? import_tooling.MAX_ARGV_BYTES : 200 * 1024;
 function chunkFilesByArgvBudget(files) {
   const chunks = [];
   let current = [];
@@ -31073,7 +31063,7 @@ var adapter = {
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
-    const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
+    const codacyBin = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
     const codacyVersion = await getVersionFromBinary(codacyBin);
     if (codacyVersion) {
       ctx.logger.debug("Found opengrep in codacy install dir", {
@@ -31103,21 +31093,22 @@ var adapter = {
     return {
       available: false,
       reason: "opengrep binary not found in PATH or Codacy install directory",
-      installHint: "codacy-analysis analyze . --install-dependencies  # auto-install into ~/.codacy\ncurl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash  # manual"
+      installHint: "codacy-analysis analyze . --install-dependencies  # auto-install into ~/.codacy\n" + (import_tooling.IS_WINDOWS ? "irm https://raw.githubusercontent.com/opengrep/opengrep/main/install.ps1 | iex  # manual (PowerShell)" : "curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash  # manual")
     };
   },
   /**
    * Downloads the opengrep binary from GitHub releases into `ctx.toolInstallDir`.
    *
    * Opengrep distributes a single statically-linked executable per platform
-   * (no archive), so install is just a download + `chmod +x`. The
-   * platform/arch/libc → asset mapping mirrors opengrep's official install.sh
-   * (see {@link opengrepAssetName}). The binary lands at
-   * `ctx.toolInstallDir/opengrep`, which `checkAvailability` probes first — so
-   * the runner's post-install re-check picks up the managed install.
+   * (no archive), so install is just a download + `chmod +x` (no chmod on
+   * Windows). The platform/arch/libc → asset mapping mirrors opengrep's
+   * official install.sh / install.ps1 (see {@link opengrepAssetName}). The
+   * binary lands at `ctx.toolInstallDir/opengrep` (`opengrep.exe` on Windows),
+   * which `checkAvailability` probes first — so the runner's post-install
+   * re-check picks up the managed install.
    *
    * Returns an `UnsupportedPlatform` error for targets opengrep has no binary
-   * for (e.g. Windows), and a `DownloadError` if the fetch fails.
+   * for, and a `DownloadError` if the fetch fails.
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
@@ -31132,17 +31123,17 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "toolInstall",
           kind: "UnsupportedPlatform",
-          message: `Unsupported platform: ${platformKey}. Opengrep provides binaries for darwin-x64, darwin-arm64, linux-x64, and linux-arm64.`,
+          message: `Unsupported platform: ${platformKey}. Opengrep provides binaries for darwin-x64, darwin-arm64, linux-x64, linux-arm64, and win32-x64 (also used on win32-arm64).`,
           level: "error"
         }
       };
     }
     const url = `https://github.com/opengrep/opengrep/releases/download/v${version}/${assetName}`;
-    const destPath = import_path.default.join(ctx.toolInstallDir, BINARY);
+    const destPath = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
     try {
       ctx.logger.info(`Downloading Opengrep v${version} for ${platformKey}...`);
       await (0, import_tooling.downloadFile)(url, destPath, ctx.logger);
-      await import_promises.default.chmod(destPath, 493);
+      if (!import_tooling.IS_WINDOWS) await import_promises.default.chmod(destPath, 493);
       ctx.logger.info(`Installed opengrep v${version} to ${destPath}`);
       return { success: true, installedPath: destPath, installedVersion: version };
     } catch (err) {
@@ -31190,8 +31181,9 @@ var adapter = {
    *    the enabled rules and write a generated config.
    * 3. If no patterns and no local config, use the full bundled rules.yaml.
    *
-   * The `tmp.` prefix that opengrep adds to check IDs when using inline
-   * configs is stripped before building pattern IDs.
+   * Every invocation passes `--no-rewrite-rule-ids`, so `check_id` is the rule
+   * ID exactly as written in the config and maps to a pattern ID directly (see
+   * the note on `baseArgs`).
    *
    * Exit codes:
    * - 0: success (findings may or may not exist)
@@ -31264,6 +31256,7 @@ var adapter = {
       "--json",
       "--config",
       configFile,
+      "--no-rewrite-rule-ids",
       "--timeout",
       "5",
       "--timeout-threshold",
@@ -31332,7 +31325,6 @@ var adapter = {
         }
       }
       const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
-      const configPrefix = configFile ? computeConfigPrefix(configFile, ctx.repositoryRoot) : "";
       const findingsByFile = /* @__PURE__ */ new Map();
       for (const finding of allFindings) {
         if (finding.extra.is_ignored) continue;
@@ -31350,7 +31342,7 @@ var adapter = {
         const lines = await (0, import_tooling.readFileLines)(absoluteFilePath);
         const relPath = import_path.default.relative(ctx.repositoryRoot, absoluteFilePath);
         for (const finding of fileFindings) {
-          const ruleId = stripCheckIdPrefix(finding.check_id, configPrefix);
+          const ruleId = finding.check_id;
           const patternId = `${TOOL_ID}_${ruleId}`;
           if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) {
             continue;

package/dist/metadata.js

@@ -391,7 +391,7 @@ var descriptor = {
     "**/Vagrantfile",
     "**/config.ru"
   ],
-  supportedOS: ["linux", "darwin"],
+  supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
   supportedRunners: ["local", "container"],
   frameworkMappings: pattern_mappings_default

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-opengrep-1",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Opengrep adapter — CLI-mode multi-language SAST scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   ],
   "dependencies": {
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.24.0"
+    "@codacy/tooling": "0.25.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",