@codacy/tools-trivy-0 0.1.0 → 0.2.0

package/dist/index.js

@@ -216,21 +216,33 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
       linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
     }
     const lines = linesCache.get(relPath);
+    const pkgLineByID = /* @__PURE__ */ new Map();
+    if (result.Packages) {
+      for (const pkg of result.Packages) {
+        if (pkg.Locations && pkg.Locations.length > 0 && pkg.Locations[0].StartLine > 0) {
+          pkgLineByID.set(pkg.ID, pkg.Locations[0].StartLine);
+        }
+      }
+    }
     for (const vuln of result.Vulnerabilities) {
       const patternId = VULN_SEVERITY_TO_PATTERN[vuln.Severity];
       if (!patternId) continue;
       if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) continue;
-      const meta = PATTERN_META.get(patternId) ?? { category: "Security", severity: "Info" };
+      const meta = PATTERN_META.get(patternId) ?? {
+        category: "Security",
+        severity: "Info"
+      };
       const title = vuln.Title ? `: ${vuln.Title}` : "";
       const fix = vuln.FixedVersion ? `Update to ${vuln.FixedVersion}.` : "No fix available.";
+      const line = vuln.PkgID && pkgLineByID.get(vuln.PkgID) || 1;
       issues.push({
         filePath: relPath,
         patternId,
         toolId: TOOL_ID,
-        line: 1,
+        line,
         column: 1,
         message: `Insecure dependency ${vuln.PkgName}@${vuln.InstalledVersion} (${vuln.VulnerabilityID}${title}). ${fix}`,
-        lineContent: getLineContent(lines, 1),
+        lineContent: getLineContent(lines, line),
         category: meta.category,
         severity: meta.severity
       });
@@ -243,7 +255,10 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
   if (!output.Results) return issues;
   const patternId = "Trivy_secret";
   if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) return issues;
-  const meta = PATTERN_META.get(patternId) ?? { category: "Security", severity: "Error" };
+  const meta = PATTERN_META.get(patternId) ?? {
+    category: "Security",
+    severity: "Error"
+  };
   const linesCache = /* @__PURE__ */ new Map();
   for (const result of output.Results) {
     if (!result.Secrets) continue;
@@ -277,7 +292,20 @@ var adapter = {
   preferredVersion: "0.69.3",
   compatibleVersions: ">=0.50.0",
   website: "https://trivy.dev/",
-  languages: ["Python", "JavaScript", "TypeScript", "Go", "Java", "Ruby", "Rust", "PHP", "C#", "Dart", "Elixir", "Swift"],
+  languages: [
+    "Python",
+    "JavaScript",
+    "TypeScript",
+    "Go",
+    "Java",
+    "Ruby",
+    "Rust",
+    "PHP",
+    "C#",
+    "Dart",
+    "Elixir",
+    "Swift"
+  ],
   filePatterns: ["*"],
   supportedOS: ["linux", "darwin"],
   supportedArch: ["x64", "arm64"],
@@ -299,13 +327,25 @@ var adapter = {
     const codacyBin = import_path.default.join(ctx.toolInstallDir, BINARY);
     const codacyVersion = await getVersionFromBinary(codacyBin);
     if (codacyVersion) {
-      ctx.logger.debug("Found trivy in codacy install dir", { toolId: TOOL_ID, version: codacyVersion });
-      return { available: true, version: codacyVersion, path: codacyBin, installation: "codacy" };
+      ctx.logger.debug("Found trivy in codacy install dir", {
+        toolId: TOOL_ID,
+        version: codacyVersion
+      });
+      return {
+        available: true,
+        version: codacyVersion,
+        path: codacyBin,
+        installation: "codacy"
+      };
     }
     const globalVersion = await getVersionFromBinary(BINARY);
     if (globalVersion) {
       ctx.logger.debug("Found trivy on global PATH", { toolId: TOOL_ID, version: globalVersion });
-      return { available: true, version: globalVersion, installation: "global" };
+      return {
+        available: true,
+        version: globalVersion,
+        installation: "global"
+      };
     }
     ctx.logger.debug("trivy not found", { toolId: TOOL_ID });
     return {
@@ -433,7 +473,14 @@ var adapter = {
     }
     try {
       if (runVulnScan) {
-        const vulnArgs = [...baseArgs, "--scanners", "vuln", "--pkg-types", "library"];
+        const vulnArgs = [
+          ...baseArgs,
+          "--scanners",
+          "vuln",
+          "--pkg-types",
+          "library",
+          "--list-all-pkgs"
+        ];
         const severities = [];
         if (enabledPatterns.size === 0) {
           severities.push("CRITICAL", "HIGH", "MEDIUM", "LOW");
@@ -450,14 +497,28 @@ var adapter = {
         vulnArgs.push(ctx.repositoryRoot);
         const vulnOutput = await runTrivyScan(binary, vulnArgs, ctx.repositoryRoot, errors);
         if (vulnOutput) {
-          issues.push(...await parseVulnerabilities(vulnOutput, enabledPatterns, targetFilesSet, ctx.repositoryRoot));
+          issues.push(
+            ...await parseVulnerabilities(
+              vulnOutput,
+              enabledPatterns,
+              targetFilesSet,
+              ctx.repositoryRoot
+            )
+          );
         }
       }
       if (runSecretScan) {
         const secretArgs = [...baseArgs, "--scanners", "secret", ctx.repositoryRoot];
         const secretOutput = await runTrivyScan(binary, secretArgs, ctx.repositoryRoot, errors);
         if (secretOutput) {
-          issues.push(...await parseSecrets(secretOutput, enabledPatterns, targetFilesSet, ctx.repositoryRoot));
+          issues.push(
+            ...await parseSecrets(
+              secretOutput,
+              enabledPatterns,
+              targetFilesSet,
+              ctx.repositoryRoot
+            )
+          );
         }
       }
     } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-trivy-0",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Trivy adapter — CLI-mode security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.1.0"
+    "@codacy/tooling": "0.2.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",