@codacy/tools-trivy-0 0.3.0 → 0.5.0

package/README.md

@@ -1,8 +1,11 @@
 # @codacy/tools-trivy-0
 
 ## Table of Contents
+
 - [Overview](#overview)
 - [Umbrella patterns](#umbrella-patterns)
+- [DB update management](#db-update-management)
+- [Malicious package detection](#malicious-package-detection)
 - [Updating patterns](#updating-patterns)
 - [Updating the Trivy version](#updating-the-trivy-version)
 - [Development](#development)
@@ -14,28 +17,52 @@
 
 Security scanner using the [Trivy](https://trivy.dev/) binary. Scans for vulnerabilities in dependencies and hardcoded secrets. Uses the CLI execution strategy with two separate scan modes (vulnerability + secret).
 
-| Property | Value |
-|----------|-------|
-| Tool ID | `Trivy` |
-| Codacy UUID | `2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb` |
-| Strategy | CLI |
-| Languages | Multi-language (scans dependency manifests) |
-| Binary | `trivy` |
-| File patterns | `*` (auto-detects dependency manifests) |
-| Pattern count | 6 (umbrella patterns) |
+| Property      | Value                                       |
+| ------------- | ------------------------------------------- |
+| Tool ID       | `Trivy`                                     |
+| Codacy UUID   | `2fd7fbe0-33f9-4ab3-ab73-e9b62404e2cb`      |
+| Strategy      | CLI                                         |
+| Languages     | Multi-language (scans dependency manifests) |
+| Binary        | `trivy`                                     |
+| File patterns | `*` (auto-detects dependency manifests)     |
+| Pattern count | 6 (umbrella patterns)                       |
 
 ## Umbrella patterns
 
 Trivy uses umbrella patterns rather than individual CVE patterns:
 
-| Pattern ID | Severity | Description |
-|------------|----------|-------------|
-| `Trivy_vulnerability_critical` | Error | Critical vulnerabilities |
-| `Trivy_vulnerability_high` | High | High-severity vulnerabilities |
-| `Trivy_vulnerability_medium` | Warning | Medium-severity vulnerabilities |
-| `Trivy_vulnerability_minor` | Info | Low-severity vulnerabilities |
-| `Trivy_secret` | Error | Hardcoded secrets |
-| `Trivy_malicious_packages` | Error | Malicious packages (reserved) |
+| Pattern ID                     | Severity | Description                          |
+| ------------------------------ | -------- | ------------------------------------ |
+| `Trivy_vulnerability_critical` | Error    | Critical vulnerabilities             |
+| `Trivy_vulnerability_high`     | High     | High-severity vulnerabilities        |
+| `Trivy_vulnerability_medium`   | Warning  | Medium-severity vulnerabilities      |
+| `Trivy_vulnerability_minor`    | Info     | Low-severity vulnerabilities         |
+| `Trivy_secret`                 | Error    | Hardcoded secrets                    |
+| `Trivy_malicious_packages`     | Error    | Malicious packages (via OSV.dev API) |
+
+## DB update management
+
+The adapter reads Trivy's `metadata.json` (at `{cacheDir}/db/metadata.json`) to
+determine if the vulnerability database is still fresh. The `NextUpdate` field
+tells us when Trivy expects the next DB update.
+
+| Scenario                       | Behavior                                                           |
+| ------------------------------ | ------------------------------------------------------------------ |
+| DB fresh (`now < NextUpdate`)  | `--skip-db-update --skip-java-db-update` passed — no network check |
+| DB stale (`now >= NextUpdate`) | Trivy checks for updates normally                                  |
+| First run (no metadata)        | Trivy downloads the DB (~40MB)                                     |
+| Container mode                 | Always skips DB updates (DBs are pre-baked)                        |
+
+## Malicious package detection
+
+Detects known malicious packages by querying the [OSV.dev batch API](https://api.osv.dev/v1/querybatch).
+This piggybacks on the vulnerability scan output — the package list from `--list-all-pkgs`
+is extracted and cross-referenced against the OpenSSF malicious packages index (`MAL-*` IDs).
+
+- Covers 14 ecosystems: npm, PyPI, Go, RubyGems, crates.io, NuGet, Maven, Packagist, Pub, Hex, ConanCenter, CocoaPods, SwiftURL, conda
+- Uses a 10-second timeout per API call
+- On API failure (network error, timeout), logs a warning and skips — never blocks the core scan
+- Message format: `Malicious package detected: {name}@{version} ({MAL-ID}). {summary}`
 
 ## Updating patterns
 
@@ -62,10 +89,11 @@ pnpm test     # Run tests (requires trivy in PATH or auto-install)
 
 ## Notes for maintainers
 
-- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln`) and one for secrets (`--scanners secret`). Which scans run depends on which umbrella patterns are enabled.
-- The vulnerability database is downloaded lazily on first run to `--cache-dir ~/.codacy/cache/trivy/`. Internet access is required on first use.
+- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln`) and one for secrets (`--scanners secret`). Malicious package detection piggybacks on the vuln scan output (no extra invocation). Which scans run depends on which umbrella patterns are enabled.
+- The vulnerability database is downloaded lazily on first run to `--cache-dir ~/.codacy/cache/trivy/`. Internet access is required on first use. DB staleness is managed via `metadata.json` → `NextUpdate`.
 - Trivy scans **whole directories**, not individual files. Results are filtered to `ctx.targetFiles` after scanning.
 - The binary is downloaded from GitHub releases as a `.tar.gz` archive.
 - Vulnerability severity (CRITICAL/HIGH/MEDIUM/LOW) maps to the corresponding umbrella pattern.
 - Message format: `Insecure dependency {pkg}@{version} ({CVE}: {title}). Update to {fixedVersion}.`
+- Malicious package detection uses the OSV.dev batch API. On failure, it degrades gracefully (warning only).
 - Config file: checks for `trivy.yaml` in the repo root.

package/dist/index.js

@@ -92,19 +92,33 @@ var patterns_default = [
   }
 ];
 
+// src/metadata.ts
+var descriptor = {
+  id: "Trivy",
+  displayName: "Trivy",
+  preferredVersion: "0.69.3",
+  languages: [
+    "Python",
+    "JavaScript",
+    "TypeScript",
+    "Go",
+    "Java",
+    "Ruby",
+    "Rust",
+    "PHP",
+    "C#",
+    "Dart",
+    "Elixir",
+    "Swift"
+  ],
+  filePatterns: ["*"],
+  supportedOS: ["linux", "darwin"],
+  supportedArch: ["x64", "arm64"],
+  supportedRunners: ["local", "container"]
+};
+
 // src/adapter.ts
 var TOOL_ID = "Trivy";
-function getLineContent(lines, lineNumber) {
-  return lines[lineNumber - 1] ?? "";
-}
-async function readFileLines(filePath) {
-  try {
-    const content = await import_promises.default.readFile(filePath, "utf-8");
-    return content.split("\n");
-  } catch {
-    return [];
-  }
-}
 var PATTERN_META = new Map(
   patterns_default.map((p) => [
     p.id,
@@ -126,6 +140,52 @@ var PATTERN_TO_SEVERITY = {
   Trivy_vulnerability_medium: "MEDIUM",
   Trivy_vulnerability_minor: "LOW"
 };
+var TRIVY_TYPE_TO_OSV_ECOSYSTEM = {
+  npm: "npm",
+  pip: "PyPI",
+  pipenv: "PyPI",
+  poetry: "PyPI",
+  conda: "conda",
+  gomod: "Go",
+  gem: "RubyGems",
+  bundler: "RubyGems",
+  cargo: "crates.io",
+  nuget: "NuGet",
+  pom: "Maven",
+  gradle: "Maven",
+  composer: "Packagist",
+  pub: "Pub",
+  hex: "Hex",
+  conan: "ConanCenter",
+  cocoapods: "CocoaPods",
+  swift: "SwiftURL"
+};
+var OSV_BATCH_SIZE = 1e3;
+var OSV_TIMEOUT_MS = 1e4;
+async function queryOsvBatch(queries) {
+  const allResults = [];
+  for (let i = 0; i < queries.length; i += OSV_BATCH_SIZE) {
+    const batch = queries.slice(i, i + OSV_BATCH_SIZE);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), OSV_TIMEOUT_MS);
+    try {
+      const response = await fetch("https://api.osv.dev/v1/querybatch", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ queries: batch }),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        throw new Error(`OSV API returned HTTP ${response.status}: ${response.statusText}`);
+      }
+      const data = await response.json();
+      allResults.push(...data.results ?? []);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return { results: allResults };
+}
 var BINARY = "trivy";
 var PLATFORM_MAP = {
   "darwin-arm64": "macOS-ARM64",
@@ -151,31 +211,29 @@ async function resolveBinaryPath(ctx) {
   if (version) return codacyBin;
   return BINARY;
 }
-function buildResult(startedAt, completedAt, issues, errors, filesAnalyzed) {
-  const durationMs = completedAt.getTime() - startedAt.getTime();
-  return {
-    metadata: {
-      startedAt: startedAt.toISOString(),
-      completedAt: completedAt.toISOString(),
-      durationMs
-    },
-    issues,
-    errors,
-    summary: {
-      toolId: TOOL_ID,
-      status: errors.some((e) => e.level === "error") ? "partial" : "success",
-      issueCount: issues.length,
-      errorCount: errors.length,
-      durationMs,
-      filesAnalyzed
-    }
-  };
-}
 async function ensureCacheDir(globalDir) {
   const cacheDir = import_path.default.join(globalDir, "cache", "trivy");
   await import_promises.default.mkdir(cacheDir, { recursive: true });
   return cacheDir;
 }
+async function checkDbFreshness(cacheDir) {
+  const metadataPath = import_path.default.join(cacheDir, "db", "metadata.json");
+  try {
+    const raw = await import_promises.default.readFile(metadataPath, "utf-8");
+    const meta = JSON.parse(raw);
+    if (!meta.NextUpdate) {
+      return { fresh: false, error: "metadata.json missing NextUpdate field" };
+    }
+    const nextUpdateMs = Date.parse(meta.NextUpdate);
+    if (Number.isNaN(nextUpdateMs)) {
+      return { fresh: false, error: `Invalid NextUpdate timestamp: ${meta.NextUpdate}` };
+    }
+    return Date.now() < nextUpdateMs ? { fresh: true, nextUpdate: meta.NextUpdate } : { fresh: false, nextUpdate: meta.NextUpdate };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { fresh: false, error: message };
+  }
+}
 async function runTrivyScan(binary, args, cwd, errors) {
   const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, { cwd });
   if (exitCode !== 0) {
@@ -213,7 +271,7 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
     const relPath = result.Target;
     if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
     if (!linesCache.has(relPath)) {
-      linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
+      linesCache.set(relPath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, relPath)));
     }
     const lines = linesCache.get(relPath);
     const pkgLineByID = /* @__PURE__ */ new Map();
@@ -242,7 +300,7 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
         line,
         column: 1,
         message: `Insecure dependency ${vuln.PkgName}@${vuln.InstalledVersion} (${vuln.VulnerabilityID}${title}). ${fix}`,
-        lineContent: getLineContent(lines, line),
+        lineContent: (0, import_tooling.getLineContent)(lines, line),
         category: meta.category,
         severity: meta.severity
       });
@@ -265,7 +323,7 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
     const relPath = result.Target;
     if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
     if (!linesCache.has(relPath)) {
-      linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
+      linesCache.set(relPath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, relPath)));
     }
     const lines = linesCache.get(relPath);
     for (const secret of result.Secrets) {
@@ -277,7 +335,7 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
         column: 1,
         endLine: secret.EndLine,
         message: `Possible hardcoded secret: ${secret.Title} (${secret.Category})`,
-        lineContent: getLineContent(lines, secret.StartLine),
+        lineContent: (0, import_tooling.getLineContent)(lines, secret.StartLine),
         multilineContent: (0, import_tooling.getMultilineContent)(lines, secret.StartLine, secret.EndLine),
         category: meta.category,
         severity: meta.severity
@@ -286,30 +344,107 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
   }
   return issues;
 }
+async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, repositoryRoot, logger) {
+  const issues = [];
+  const errors = [];
+  const patternId = "Trivy_malicious_packages";
+  if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) {
+    return { issues, errors };
+  }
+  if (!output.Results) return { issues, errors };
+  const meta = PATTERN_META.get(patternId) ?? {
+    category: "Security",
+    severity: "Error"
+  };
+  const packages = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const result of output.Results) {
+    if (!result.Packages || !result.Type) continue;
+    const ecosystem = TRIVY_TYPE_TO_OSV_ECOSYSTEM[result.Type];
+    if (!ecosystem) continue;
+    const relPath = result.Target;
+    if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
+    for (const pkg of result.Packages) {
+      const key = `${ecosystem}:${pkg.Name}:${pkg.Version}:${relPath}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const line = pkg.Locations && pkg.Locations.length > 0 && pkg.Locations[0].StartLine > 0 ? pkg.Locations[0].StartLine : 1;
+      packages.push({ ecosystem, name: pkg.Name, version: pkg.Version, filePath: relPath, line });
+    }
+  }
+  if (packages.length === 0) return { issues, errors };
+  const queryMap = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    const queryKey = `${pkg.ecosystem}:${pkg.name}:${pkg.version}`;
+    if (!queryMap.has(queryKey)) {
+      queryMap.set(queryKey, {
+        package: { name: pkg.name, ecosystem: pkg.ecosystem },
+        version: pkg.version
+      });
+    }
+  }
+  const queries = Array.from(queryMap.values());
+  let osvResponse;
+  try {
+    logger.debug("Querying OSV.dev for malicious packages", { packageCount: queries.length });
+    osvResponse = await queryOsvBatch(queries);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logger.warn(`Malicious package check skipped: ${message}`);
+    errors.push({
+      toolId: TOOL_ID,
+      phase: "toolInvoke",
+      kind: "NetworkError",
+      message: `OSV.dev API call failed: ${message}. Malicious package detection skipped.`,
+      level: "warning"
+    });
+    return { issues, errors };
+  }
+  const maliciousByPkg = /* @__PURE__ */ new Map();
+  const queryList = Array.from(queryMap.keys());
+  for (let i = 0; i < osvResponse.results.length; i++) {
+    const result = osvResponse.results[i];
+    if (!result.vulns) continue;
+    const malVulns = result.vulns.filter((v) => v.id.startsWith("MAL-"));
+    if (malVulns.length > 0 && i < queryList.length) {
+      maliciousByPkg.set(queryList[i], malVulns);
+    }
+  }
+  if (maliciousByPkg.size === 0) {
+    logger.debug("No malicious packages detected");
+    return { issues, errors };
+  }
+  const linesCache = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    const queryKey = `${pkg.ecosystem}:${pkg.name}:${pkg.version}`;
+    const malVulns = maliciousByPkg.get(queryKey);
+    if (!malVulns) continue;
+    if (!linesCache.has(pkg.filePath)) {
+      linesCache.set(pkg.filePath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, pkg.filePath)));
+    }
+    const lines = linesCache.get(pkg.filePath);
+    for (const vuln of malVulns) {
+      const summary = vuln.summary ? ` ${vuln.summary}` : "";
+      issues.push({
+        filePath: pkg.filePath,
+        patternId,
+        toolId: TOOL_ID,
+        line: pkg.line,
+        column: 1,
+        message: `Malicious package detected: ${pkg.name}@${pkg.version} (${vuln.id}).${summary}`,
+        lineContent: (0, import_tooling.getLineContent)(lines, pkg.line),
+        category: meta.category,
+        severity: meta.severity
+      });
+    }
+  }
+  logger.info("Malicious package check complete", { issuesFound: issues.length });
+  return { issues, errors };
+}
 var adapter = {
-  id: TOOL_ID,
-  displayName: "Trivy",
-  preferredVersion: "0.69.3",
+  ...descriptor,
   compatibleVersions: ">=0.50.0",
   website: "https://trivy.dev/",
-  languages: [
-    "Python",
-    "JavaScript",
-    "TypeScript",
-    "Go",
-    "Java",
-    "Ruby",
-    "Rust",
-    "PHP",
-    "C#",
-    "Dart",
-    "Elixir",
-    "Swift"
-  ],
-  filePatterns: ["*"],
-  supportedOS: ["linux", "darwin"],
-  supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"],
   prerequisites: [],
   /**
    * Checks whether the `trivy` binary is present and runnable.
@@ -446,13 +581,7 @@ var adapter = {
     const issues = [];
     const errors = [];
     if (ctx.targetFiles.length === 0) {
-      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
-    }
-    if (!(codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile) && codacyConfig.patterns.length === 0) {
-      ctx.logger.info("Skipping analysis: no local config and no patterns enabled", {
-        toolId: TOOL_ID
-      });
-      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
     }
     const binary = await resolveBinaryPath(ctx);
     let cacheDir;
@@ -466,14 +595,33 @@ var adapter = {
         message: `Failed to create cache directory: ${err instanceof Error ? err.message : String(err)}`,
         level: "error"
       });
-      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
     }
     const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
     const targetFilesSet = new Set(ctx.targetFiles);
     const vulnPatternIds = Object.values(VULN_SEVERITY_TO_PATTERN);
-    const runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some((id) => enabledPatterns.has(id));
+    const runMaliciousScan = enabledPatterns.size === 0 || enabledPatterns.has("Trivy_malicious_packages");
+    const runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some((id) => enabledPatterns.has(id)) || runMaliciousScan;
     const runSecretScan = enabledPatterns.size === 0 || enabledPatterns.has("Trivy_secret");
     const baseArgs = ["filesystem", "--format", "json", "--cache-dir", cacheDir];
+    if (runVulnScan) {
+      if (ctx.runner === "container") {
+        baseArgs.push("--skip-db-update", "--skip-java-db-update");
+        ctx.logger.debug("Container mode: skipping DB updates");
+      } else {
+        const dbStatus = await checkDbFreshness(cacheDir);
+        if (dbStatus.fresh) {
+          baseArgs.push("--skip-db-update", "--skip-java-db-update");
+          ctx.logger.debug("Trivy DB is fresh, skipping update check", {
+            nextUpdate: dbStatus.nextUpdate
+          });
+        } else {
+          ctx.logger.info(
+            dbStatus.error?.includes("ENOENT") ? "Trivy vulnerability database not found. Downloading (~40MB)..." : "Trivy DB update due, checking for new data..."
+          );
+        }
+      }
+    }
     if (codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile) {
       baseArgs.push("--config", codacyConfig.localConfigurationFile);
     }
@@ -511,6 +659,17 @@ var adapter = {
               ctx.repositoryRoot
             )
           );
+          if (runMaliciousScan && ctx.runner !== "container") {
+            const malResult = await parseMaliciousPackages(
+              vulnOutput,
+              enabledPatterns,
+              targetFilesSet,
+              ctx.repositoryRoot,
+              ctx.logger
+            );
+            issues.push(...malResult.issues);
+            errors.push(...malResult.errors);
+          }
         }
       }
       if (runSecretScan) {
@@ -536,7 +695,14 @@ var adapter = {
         level: "error"
       });
     }
-    const result = buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+    const result = (0, import_tooling.buildResult)(
+      TOOL_ID,
+      startedAt,
+      /* @__PURE__ */ new Date(),
+      issues,
+      errors,
+      ctx.targetFiles.length
+    );
     ctx.logger.info("Analysis complete", {
       toolId: TOOL_ID,
       issueCount: result.summary.issueCount,

package/dist/metadata.d.ts

@@ -0,0 +1,13 @@
+import { AdapterDescriptor } from '@codacy/tooling';
+
+/**
+ * Lightweight adapter descriptor for lazy loading.
+ *
+ * This module contains only plain-data metadata fields and has zero heavy
+ * imports (no patterns.json, no runtime utilities). The CLI imports this
+ * at startup for adapter registration without loading the full adapter module.
+ */
+
+declare const descriptor: AdapterDescriptor;
+
+export { descriptor };

package/dist/metadata.js

@@ -0,0 +1,52 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/metadata.ts
+var metadata_exports = {};
+__export(metadata_exports, {
+  descriptor: () => descriptor
+});
+module.exports = __toCommonJS(metadata_exports);
+var descriptor = {
+  id: "Trivy",
+  displayName: "Trivy",
+  preferredVersion: "0.69.3",
+  languages: [
+    "Python",
+    "JavaScript",
+    "TypeScript",
+    "Go",
+    "Java",
+    "Ruby",
+    "Rust",
+    "PHP",
+    "C#",
+    "Dart",
+    "Elixir",
+    "Swift"
+  ],
+  filePatterns: ["*"],
+  supportedOS: ["linux", "darwin"],
+  supportedArch: ["x64", "arm64"],
+  supportedRunners: ["local", "container"]
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  descriptor
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-trivy-0",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Trivy adapter — CLI-mode security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.3.0"
+    "@codacy/tooling": "0.5.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",
@@ -21,8 +21,18 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./metadata": {
+      "types": "./dist/metadata.d.ts",
+      "default": "./dist/metadata.js"
+    }
+  },
   "scripts": {
-    "build": "tsup src/index.ts --format cjs --dts --clean",
+    "build": "tsup src/index.ts src/metadata.ts --format cjs --dts --clean",
     "test": "vitest run",
     "lint": "eslint src/",
     "clean": "rm -rf dist",