@codacy/tools-trivy-0 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Codacy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,71 @@
+# @codacy/tools-trivy-0
+
+## Table of Contents
+- [Overview](#overview)
+- [Umbrella patterns](#umbrella-patterns)
+- [Updating patterns](#updating-patterns)
+- [Updating the Trivy version](#updating-the-trivy-version)
+- [Development](#development)
+- [Notes for maintainers](#notes-for-maintainers)
+
+---
+
+## Overview
+
+Security scanner using the [Trivy](https://trivy.dev/) binary. Scans for vulnerabilities in dependencies and hardcoded secrets. Uses the CLI execution strategy with two separate scan modes (vulnerability + secret).
+
+| Property | Value |
+|----------|-------|
+| Tool ID | `Trivy` |
+| Codacy UUID | `2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb` |
+| Strategy | CLI |
+| Languages | Multi-language (scans dependency manifests) |
+| Binary | `trivy` |
+| File patterns | `*` (auto-detects dependency manifests) |
+| Pattern count | 6 (umbrella patterns) |
+
+## Umbrella patterns
+
+Trivy uses umbrella patterns rather than individual CVE patterns:
+
+| Pattern ID | Severity | Description |
+|------------|----------|-------------|
+| `Trivy_vulnerability_critical` | Error | Critical vulnerabilities |
+| `Trivy_vulnerability_high` | High | High-severity vulnerabilities |
+| `Trivy_vulnerability_medium` | Warning | Medium-severity vulnerabilities |
+| `Trivy_vulnerability_minor` | Info | Low-severity vulnerabilities |
+| `Trivy_secret` | Error | Hardcoded secrets |
+| `Trivy_malicious_packages` | Error | Malicious packages (reserved) |
+
+## Updating patterns
+
+```bash
+# Re-fetch pattern metadata from the Codacy API
+pnpm prefetch
+
+# Commit the result
+git add src/patterns.json
+```
+
+## Updating the Trivy version
+
+1. Update `preferredVersion` in `src/adapter.ts`
+2. Update the download URL template if the release format changed
+3. Run `pnpm test` to verify compatibility
+
+## Development
+
+```bash
+pnpm build    # Build with tsup
+pnpm test     # Run tests (requires trivy in PATH or auto-install)
+```
+
+## Notes for maintainers
+
+- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln`) and one for secrets (`--scanners secret`). Which scans run depends on which umbrella patterns are enabled.
+- The vulnerability database is downloaded lazily on first run to `--cache-dir ~/.codacy/cache/trivy/`. Internet access is required on first use.
+- Trivy scans **whole directories**, not individual files. Results are filtered to `ctx.targetFiles` after scanning.
+- The binary is downloaded from GitHub releases as a `.tar.gz` archive.
+- Vulnerability severity (CRITICAL/HIGH/MEDIUM/LOW) maps to the corresponding umbrella pattern.
+- Message format: `Insecure dependency {pkg}@{version} ({CVE}: {title}). Update to {fixedVersion}.`
+- Config file: checks for `trivy.yaml` in the repo root.

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import * as _codacy_tooling from '@codacy/tooling';
+
+declare const _default: Readonly<_codacy_tooling.ToolAdapter>;
+
+export { _default as default };

package/dist/index.js

@@ -0,0 +1,484 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  default: () => index_default
+});
+module.exports = __toCommonJS(index_exports);
+var import_tooling2 = require("@codacy/tooling");
+
+// src/adapter.ts
+var import_tooling = require("@codacy/tooling");
+var import_path = __toESM(require("path"));
+var import_promises = __toESM(require("fs/promises"));
+
+// src/patterns.json
+var patterns_default = [
+  {
+    id: "Trivy_malicious_packages",
+    category: "Security",
+    severityLevel: "Error",
+    title: "Detect Malicious Packages",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Trivy_secret",
+    category: "Security",
+    severityLevel: "Error",
+    title: "Detect Secret Exposure",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Trivy_vulnerability_critical",
+    category: "Security",
+    severityLevel: "Error",
+    title: "Detect Insecure Dependencies (Critical Severity)",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Trivy_vulnerability_high",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect Insecure Dependencies (High Severity)",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Trivy_vulnerability_medium",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect Insecure Dependencies (Medium Severity)",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Trivy_vulnerability_minor",
+    category: "Security",
+    severityLevel: "Info",
+    title: "Detect Insecure Dependencies (Minor Severity)",
+    enabled: true,
+    parameters: []
+  }
+];
+
+// src/adapter.ts
+var TOOL_ID = "Trivy";
+function getLineContent(lines, lineNumber) {
+  return lines[lineNumber - 1] ?? "";
+}
+async function readFileLines(filePath) {
+  try {
+    const content = await import_promises.default.readFile(filePath, "utf-8");
+    return content.split("\n");
+  } catch {
+    return [];
+  }
+}
+var PATTERN_META = new Map(
+  patterns_default.map((p) => [
+    p.id,
+    {
+      category: p.category,
+      severity: p.severityLevel ?? "Info"
+    }
+  ])
+);
+var VULN_SEVERITY_TO_PATTERN = {
+  CRITICAL: "Trivy_vulnerability_critical",
+  HIGH: "Trivy_vulnerability_high",
+  MEDIUM: "Trivy_vulnerability_medium",
+  LOW: "Trivy_vulnerability_minor"
+};
+var PATTERN_TO_SEVERITY = {
+  Trivy_vulnerability_critical: "CRITICAL",
+  Trivy_vulnerability_high: "HIGH",
+  Trivy_vulnerability_medium: "MEDIUM",
+  Trivy_vulnerability_minor: "LOW"
+};
+var BINARY = "trivy";
+var PLATFORM_MAP = {
+  "darwin-arm64": "macOS-ARM64",
+  "darwin-x64": "macOS-64bit",
+  "linux-x64": "Linux-64bit",
+  "linux-arm64": "Linux-ARM64"
+};
+async function getVersionFromBinary(binaryPath) {
+  try {
+    const { stdout, exitCode } = await (0, import_tooling.spawnTool)(binaryPath, ["--version"], {
+      cwd: process.cwd()
+    });
+    if (exitCode !== 0) return null;
+    const match = stdout.match(/Version:\s*(\S+)/);
+    return match ? match[1] : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveBinaryPath(ctx) {
+  const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
+  const version = await getVersionFromBinary(codacyBin);
+  if (version) return codacyBin;
+  return BINARY;
+}
+function buildResult(startedAt, completedAt, issues, errors, filesAnalyzed) {
+  const durationMs = completedAt.getTime() - startedAt.getTime();
+  return {
+    metadata: {
+      startedAt: startedAt.toISOString(),
+      completedAt: completedAt.toISOString(),
+      durationMs
+    },
+    issues,
+    errors,
+    summary: {
+      toolId: TOOL_ID,
+      status: errors.some((e) => e.level === "error") ? "partial" : "success",
+      issueCount: issues.length,
+      errorCount: errors.length,
+      durationMs,
+      filesAnalyzed
+    }
+  };
+}
+async function ensureCacheDir(globalDir) {
+  const cacheDir = import_path.default.join(globalDir, "cache", "trivy");
+  await import_promises.default.mkdir(cacheDir, { recursive: true });
+  return cacheDir;
+}
+async function runTrivyScan(binary, args, cwd, errors) {
+  const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, { cwd });
+  if (exitCode !== 0) {
+    errors.push({
+      toolId: TOOL_ID,
+      phase: "toolInvoke",
+      kind: "NonZeroExit",
+      message: `trivy exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+      level: "error"
+    });
+    return null;
+  }
+  if (!stdout.trim()) {
+    return { Results: [] };
+  }
+  try {
+    return JSON.parse(stdout);
+  } catch (err) {
+    errors.push({
+      toolId: TOOL_ID,
+      phase: "outputParse",
+      kind: "MalformedOutput",
+      message: `Failed to parse trivy JSON output: ${err instanceof Error ? err.message : String(err)}`,
+      level: "error"
+    });
+    return null;
+  }
+}
+async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, repositoryRoot) {
+  const issues = [];
+  if (!output.Results) return issues;
+  const linesCache = /* @__PURE__ */ new Map();
+  for (const result of output.Results) {
+    if (!result.Vulnerabilities) continue;
+    const relPath = result.Target;
+    if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
+    if (!linesCache.has(relPath)) {
+      linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
+    }
+    const lines = linesCache.get(relPath);
+    for (const vuln of result.Vulnerabilities) {
+      const patternId = VULN_SEVERITY_TO_PATTERN[vuln.Severity];
+      if (!patternId) continue;
+      if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) continue;
+      const meta = PATTERN_META.get(patternId) ?? { category: "Security", severity: "Info" };
+      const title = vuln.Title ? `: ${vuln.Title}` : "";
+      const fix = vuln.FixedVersion ? `Update to ${vuln.FixedVersion}.` : "No fix available.";
+      issues.push({
+        filePath: relPath,
+        patternId,
+        toolId: TOOL_ID,
+        line: 1,
+        column: 1,
+        message: `Insecure dependency ${vuln.PkgName}@${vuln.InstalledVersion} (${vuln.VulnerabilityID}${title}). ${fix}`,
+        lineContent: getLineContent(lines, 1),
+        category: meta.category,
+        severity: meta.severity
+      });
+    }
+  }
+  return issues;
+}
+async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryRoot) {
+  const issues = [];
+  if (!output.Results) return issues;
+  const patternId = "Trivy_secret";
+  if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) return issues;
+  const meta = PATTERN_META.get(patternId) ?? { category: "Security", severity: "Error" };
+  const linesCache = /* @__PURE__ */ new Map();
+  for (const result of output.Results) {
+    if (!result.Secrets) continue;
+    const relPath = result.Target;
+    if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
+    if (!linesCache.has(relPath)) {
+      linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
+    }
+    const lines = linesCache.get(relPath);
+    for (const secret of result.Secrets) {
+      issues.push({
+        filePath: relPath,
+        patternId,
+        toolId: TOOL_ID,
+        line: secret.StartLine,
+        column: 1,
+        endLine: secret.EndLine,
+        message: `Possible hardcoded secret: ${secret.Title} (${secret.Category})`,
+        lineContent: getLineContent(lines, secret.StartLine),
+        multilineContent: (0, import_tooling.getMultilineContent)(lines, secret.StartLine, secret.EndLine),
+        category: meta.category,
+        severity: meta.severity
+      });
+    }
+  }
+  return issues;
+}
+var adapter = {
+  id: TOOL_ID,
+  displayName: "Trivy",
+  preferredVersion: "0.69.3",
+  compatibleVersions: ">=0.50.0",
+  website: "https://trivy.dev/",
+  languages: ["Python", "JavaScript", "TypeScript", "Go", "Java", "Ruby", "Rust", "PHP", "C#", "Dart", "Elixir", "Swift"],
+  filePatterns: ["*"],
+  supportedOS: ["linux", "darwin"],
+  supportedArch: ["x64", "arm64"],
+  supportedRunners: ["local", "container"],
+  prerequisites: [],
+  /**
+   * Checks whether the `trivy` binary is present and runnable.
+   *
+   * Checks in order:
+   * 1. Codacy-managed path (`ctx.toolInstallDir/trivy`) → installation: "codacy"
+   * 2. Global PATH (`trivy`) → installation: "global"
+   *
+   * Parses the version from the output line `Version: X.Y.Z`. Returns
+   * `available: false` (rather than throwing) if the binary is not found or
+   * returns a non-zero exit code.
+   */
+  async checkAvailability(ctx) {
+    ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
+    const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
+    const codacyVersion = await getVersionFromBinary(codacyBin);
+    if (codacyVersion) {
+      ctx.logger.debug("Found trivy in codacy install dir", { toolId: TOOL_ID, version: codacyVersion });
+      return { available: true, version: codacyVersion, path: codacyBin, installation: "codacy" };
+    }
+    const globalVersion = await getVersionFromBinary(BINARY);
+    if (globalVersion) {
+      ctx.logger.debug("Found trivy on global PATH", { toolId: TOOL_ID, version: globalVersion });
+      return { available: true, version: globalVersion, installation: "global" };
+    }
+    ctx.logger.debug("trivy not found", { toolId: TOOL_ID });
+    return {
+      available: false,
+      reason: "trivy binary not found in PATH or Codacy install directory",
+      installHint: "brew install trivy  # macOS\ncodacy-analysis analyze . --install-dependencies  # auto-install"
+    };
+  },
+  /**
+   * Downloads trivy from GitHub releases and extracts it to ctx.toolInstallDir.
+   *
+   * Detects the current platform/arch and downloads the appropriate tar.gz archive.
+   * Sets executable permission after extraction.
+   */
+  async install(ctx) {
+    ctx.logger.info("Starting install", { toolId: TOOL_ID });
+    const platformKey = `${ctx.platform.os}-${ctx.platform.arch}`;
+    const platformSuffix = PLATFORM_MAP[platformKey];
+    if (!platformSuffix) {
+      return {
+        success: false,
+        error: {
+          toolId: TOOL_ID,
+          phase: "toolInstall",
+          kind: "UnsupportedPlatform",
+          message: `Unsupported platform: ${platformKey}. Supported: ${Object.keys(PLATFORM_MAP).join(", ")}`,
+          level: "error"
+        }
+      };
+    }
+    const version = adapter.preferredVersion;
+    const url = `https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_${platformSuffix}.tar.gz`;
+    const destPath = import_path.default.join(ctx.toolInstallDir, BINARY);
+    try {
+      ctx.logger.info(`Downloading trivy v${version} for ${platformKey}...`);
+      await (0, import_tooling.downloadAndExtract)(url, ctx.toolInstallDir, void 0, ctx.logger);
+      await import_promises.default.chmod(destPath, 493);
+      ctx.logger.info(`Installed trivy v${version} to ${destPath}`);
+      return { success: true, installedPath: destPath, installedVersion: version };
+    } catch (err) {
+      return {
+        success: false,
+        error: {
+          toolId: TOOL_ID,
+          phase: "toolInstall",
+          kind: "DownloadError",
+          message: `Failed to download trivy: ${err instanceof Error ? err.message : String(err)}`,
+          level: "error"
+        }
+      };
+    }
+  },
+  /**
+   * Checks for `trivy.yaml` in the repository root.
+   *
+   * Trivy can be configured via a `trivy.yaml` file. This method reports
+   * whether the file exists so the runner can surface it to the user.
+   */
+  async checkLocalConfigurationFile(ctx) {
+    ctx.logger.debug("Checking for local config", { toolId: TOOL_ID });
+    const configPath = import_path.default.join(ctx.repositoryRoot, "trivy.yaml");
+    try {
+      await import_promises.default.access(configPath);
+      ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: configPath });
+      return { found: true, path: configPath };
+    } catch {
+      return { found: false };
+    }
+  },
+  /**
+   * Runs Trivy scans against the repository and converts the JSON output into
+   * Codacy Issue objects.
+   *
+   * Trivy scans entire directories (not individual files), so the adapter runs
+   * against `ctx.repositoryRoot` and then filters results to `ctx.targetFiles`.
+   *
+   * Two scan modes are supported based on enabled patterns:
+   * - **Vulnerability scan**: runs when any `vulnerability_*` pattern is enabled.
+   *   Uses `trivy filesystem --scanners vuln` with severity filtering.
+   * - **Secret scan**: runs when the `secret` pattern is enabled.
+   *   Uses `trivy filesystem --scanners secret`.
+   *
+   * Config resolution:
+   * - If `useLocalConfigurationFile` is true and `localConfigurationFile` is
+   *   set, passes `--config <path>` to trivy.
+   * - Otherwise, trivy uses its built-in defaults.
+   *
+   * Exit codes:
+   * - 0: success (default behavior — trivy always exits 0 unless there is an error)
+   * - Non-zero: genuine error
+   *
+   * Never throws — all errors are captured in the returned `errors` array.
+   */
+  async analyze(ctx, codacyConfig) {
+    const startMs = Date.now();
+    ctx.logger.info("Starting analysis", { toolId: TOOL_ID, fileCount: ctx.targetFiles.length });
+    const startedAt = /* @__PURE__ */ new Date();
+    const issues = [];
+    const errors = [];
+    if (ctx.targetFiles.length === 0) {
+      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
+    }
+    const binary = await resolveBinaryPath(ctx);
+    let cacheDir;
+    try {
+      cacheDir = await ensureCacheDir(ctx.globalDir);
+    } catch (err) {
+      errors.push({
+        toolId: TOOL_ID,
+        phase: "toolInvoke",
+        kind: "FilesystemError",
+        message: `Failed to create cache directory: ${err instanceof Error ? err.message : String(err)}`,
+        level: "error"
+      });
+      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+    }
+    const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
+    const targetFilesSet = new Set(ctx.targetFiles);
+    const vulnPatternIds = Object.values(VULN_SEVERITY_TO_PATTERN);
+    const runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some((id) => enabledPatterns.has(id));
+    const runSecretScan = enabledPatterns.size === 0 || enabledPatterns.has("Trivy_secret");
+    const baseArgs = ["filesystem", "--format", "json", "--cache-dir", cacheDir];
+    if (codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile) {
+      baseArgs.push("--config", codacyConfig.localConfigurationFile);
+    }
+    try {
+      if (runVulnScan) {
+        const vulnArgs = [...baseArgs, "--scanners", "vuln", "--pkg-types", "library"];
+        const severities = [];
+        if (enabledPatterns.size === 0) {
+          severities.push("CRITICAL", "HIGH", "MEDIUM", "LOW");
+        } else {
+          for (const [patternId, severity] of Object.entries(PATTERN_TO_SEVERITY)) {
+            if (enabledPatterns.has(patternId)) {
+              severities.push(severity);
+            }
+          }
+        }
+        if (severities.length > 0) {
+          vulnArgs.push("--severity", severities.join(","));
+        }
+        vulnArgs.push(ctx.repositoryRoot);
+        const vulnOutput = await runTrivyScan(binary, vulnArgs, ctx.repositoryRoot, errors);
+        if (vulnOutput) {
+          issues.push(...await parseVulnerabilities(vulnOutput, enabledPatterns, targetFilesSet, ctx.repositoryRoot));
+        }
+      }
+      if (runSecretScan) {
+        const secretArgs = [...baseArgs, "--scanners", "secret", ctx.repositoryRoot];
+        const secretOutput = await runTrivyScan(binary, secretArgs, ctx.repositoryRoot, errors);
+        if (secretOutput) {
+          issues.push(...await parseSecrets(secretOutput, enabledPatterns, targetFilesSet, ctx.repositoryRoot));
+        }
+      }
+    } catch (err) {
+      errors.push({
+        toolId: TOOL_ID,
+        phase: "toolInvoke",
+        kind: "InvocationError",
+        message: `Failed to run trivy: ${err instanceof Error ? err.message : String(err)}`,
+        level: "error"
+      });
+    }
+    const result = buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+    ctx.logger.info("Analysis complete", {
+      toolId: TOOL_ID,
+      issueCount: result.summary.issueCount,
+      errorCount: result.summary.errorCount,
+      durationMs: Date.now() - startMs
+    });
+    return result;
+  }
+};
+
+// src/index.ts
+var index_default = (0, import_tooling2.defineToolAdapter)(adapter);

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@codacy/tools-trivy-0",
+  "version": "0.1.0",
+  "description": "Trivy adapter — CLI-mode security scanner",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@codacy/tooling": "0.1.0"
+  },
+  "license": "MIT",
+  "author": "Codacy <support@codacy.com> (https://www.codacy.com)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/codacy/analysis-cli.git",
+    "directory": "packages/tools/trivy-0"
+  },
+  "homepage": "https://github.com/codacy/analysis-cli",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs --dts --clean",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "clean": "rm -rf dist",
+    "prefetch": "node ../scripts/fetch-patterns.mjs 2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb src/patterns.json"
+  }
+}