@codacy/tools-trivy-0 0.4.0 → 0.6.0

package/dist/index.js

@@ -48,6 +48,28 @@ var patterns_default = [
     severityLevel: "Error",
     title: "Detect Malicious Packages",
     enabled: true,
+    languages: [
+      "Dart",
+      "XML",
+      "TypeScript",
+      "Python",
+      "Javascript",
+      "Elixir",
+      "PHP",
+      "C",
+      "CSharp",
+      "Swift",
+      "CPP",
+      "Scala",
+      "JSON",
+      "Rust",
+      "Ruby",
+      "Terraform",
+      "Go",
+      "Java",
+      "Dockerfile",
+      "YAML"
+    ],
     parameters: []
   },
   {
@@ -56,6 +78,28 @@ var patterns_default = [
     severityLevel: "Error",
     title: "Detect Secret Exposure",
     enabled: true,
+    languages: [
+      "Dart",
+      "XML",
+      "TypeScript",
+      "Python",
+      "Javascript",
+      "Elixir",
+      "PHP",
+      "C",
+      "CSharp",
+      "Swift",
+      "CPP",
+      "Scala",
+      "JSON",
+      "Rust",
+      "Ruby",
+      "Terraform",
+      "Go",
+      "Java",
+      "Dockerfile",
+      "YAML"
+    ],
     parameters: []
   },
   {
@@ -64,6 +108,28 @@ var patterns_default = [
     severityLevel: "Error",
     title: "Detect Insecure Dependencies (Critical Severity)",
     enabled: true,
+    languages: [
+      "Dart",
+      "XML",
+      "TypeScript",
+      "Python",
+      "Javascript",
+      "Elixir",
+      "PHP",
+      "C",
+      "CSharp",
+      "Swift",
+      "CPP",
+      "Scala",
+      "JSON",
+      "Rust",
+      "Ruby",
+      "Terraform",
+      "Go",
+      "Java",
+      "Dockerfile",
+      "YAML"
+    ],
     parameters: []
   },
   {
@@ -72,6 +138,28 @@ var patterns_default = [
     severityLevel: "High",
     title: "Detect Insecure Dependencies (High Severity)",
     enabled: true,
+    languages: [
+      "Dart",
+      "XML",
+      "TypeScript",
+      "Python",
+      "Javascript",
+      "Elixir",
+      "PHP",
+      "C",
+      "CSharp",
+      "Swift",
+      "CPP",
+      "Scala",
+      "JSON",
+      "Rust",
+      "Ruby",
+      "Terraform",
+      "Go",
+      "Java",
+      "Dockerfile",
+      "YAML"
+    ],
     parameters: []
   },
   {
@@ -80,6 +168,28 @@ var patterns_default = [
     severityLevel: "Warning",
     title: "Detect Insecure Dependencies (Medium Severity)",
     enabled: true,
+    languages: [
+      "Dart",
+      "XML",
+      "TypeScript",
+      "Python",
+      "Javascript",
+      "Elixir",
+      "PHP",
+      "C",
+      "CSharp",
+      "Swift",
+      "CPP",
+      "Scala",
+      "JSON",
+      "Rust",
+      "Ruby",
+      "Terraform",
+      "Go",
+      "Java",
+      "Dockerfile",
+      "YAML"
+    ],
     parameters: []
   },
   {
@@ -88,23 +198,59 @@ var patterns_default = [
     severityLevel: "Info",
     title: "Detect Insecure Dependencies (Minor Severity)",
     enabled: true,
+    languages: [
+      "Dart",
+      "XML",
+      "TypeScript",
+      "Python",
+      "Javascript",
+      "Elixir",
+      "PHP",
+      "C",
+      "CSharp",
+      "Swift",
+      "CPP",
+      "Scala",
+      "JSON",
+      "Rust",
+      "Ruby",
+      "Terraform",
+      "Go",
+      "Java",
+      "Dockerfile",
+      "YAML"
+    ],
     parameters: []
   }
 ];
 
+// src/metadata.ts
+var descriptor = {
+  id: "Trivy",
+  displayName: "Trivy",
+  preferredVersion: "0.69.3",
+  languages: [
+    "Python",
+    "JavaScript",
+    "TypeScript",
+    "Go",
+    "Java",
+    "Ruby",
+    "Rust",
+    "PHP",
+    "C#",
+    "Dart",
+    "Elixir",
+    "Swift"
+  ],
+  filePatterns: ["*"],
+  supportedOS: ["linux", "darwin"],
+  supportedArch: ["x64", "arm64"],
+  supportedRunners: ["local", "container"]
+};
+
 // src/adapter.ts
 var TOOL_ID = "Trivy";
-function getLineContent(lines, lineNumber) {
-  return lines[lineNumber - 1] ?? "";
-}
-async function readFileLines(filePath) {
-  try {
-    const content = await import_promises.default.readFile(filePath, "utf-8");
-    return content.split("\n");
-  } catch {
-    return [];
-  }
-}
 var PATTERN_META = new Map(
   patterns_default.map((p) => [
     p.id,
@@ -197,26 +343,6 @@ async function resolveBinaryPath(ctx) {
   if (version) return codacyBin;
   return BINARY;
 }
-function buildResult(startedAt, completedAt, issues, errors, filesAnalyzed) {
-  const durationMs = completedAt.getTime() - startedAt.getTime();
-  return {
-    metadata: {
-      startedAt: startedAt.toISOString(),
-      completedAt: completedAt.toISOString(),
-      durationMs
-    },
-    issues,
-    errors,
-    summary: {
-      toolId: TOOL_ID,
-      status: errors.some((e) => e.level === "error") ? "partial" : "success",
-      issueCount: issues.length,
-      errorCount: errors.length,
-      durationMs,
-      filesAnalyzed
-    }
-  };
-}
 async function ensureCacheDir(globalDir) {
   const cacheDir = import_path.default.join(globalDir, "cache", "trivy");
   await import_promises.default.mkdir(cacheDir, { recursive: true });
@@ -277,7 +403,7 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
     const relPath = result.Target;
     if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
     if (!linesCache.has(relPath)) {
-      linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
+      linesCache.set(relPath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, relPath)));
     }
     const lines = linesCache.get(relPath);
     const pkgLineByID = /* @__PURE__ */ new Map();
@@ -306,7 +432,7 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
         line,
         column: 1,
         message: `Insecure dependency ${vuln.PkgName}@${vuln.InstalledVersion} (${vuln.VulnerabilityID}${title}). ${fix}`,
-        lineContent: getLineContent(lines, line),
+        lineContent: (0, import_tooling.getLineContent)(lines, line),
         category: meta.category,
         severity: meta.severity
       });
@@ -329,7 +455,7 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
     const relPath = result.Target;
     if (targetFilesSet.size > 0 && !targetFilesSet.has(relPath)) continue;
     if (!linesCache.has(relPath)) {
-      linesCache.set(relPath, await readFileLines(import_path.default.join(repositoryRoot, relPath)));
+      linesCache.set(relPath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, relPath)));
     }
     const lines = linesCache.get(relPath);
     for (const secret of result.Secrets) {
@@ -341,7 +467,7 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
         column: 1,
         endLine: secret.EndLine,
         message: `Possible hardcoded secret: ${secret.Title} (${secret.Category})`,
-        lineContent: getLineContent(lines, secret.StartLine),
+        lineContent: (0, import_tooling.getLineContent)(lines, secret.StartLine),
         multilineContent: (0, import_tooling.getMultilineContent)(lines, secret.StartLine, secret.EndLine),
         category: meta.category,
         severity: meta.severity
@@ -426,7 +552,7 @@ async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, r
     const malVulns = maliciousByPkg.get(queryKey);
     if (!malVulns) continue;
     if (!linesCache.has(pkg.filePath)) {
-      linesCache.set(pkg.filePath, await readFileLines(import_path.default.join(repositoryRoot, pkg.filePath)));
+      linesCache.set(pkg.filePath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, pkg.filePath)));
     }
     const lines = linesCache.get(pkg.filePath);
     for (const vuln of malVulns) {
@@ -438,7 +564,7 @@ async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, r
         line: pkg.line,
         column: 1,
         message: `Malicious package detected: ${pkg.name}@${pkg.version} (${vuln.id}).${summary}`,
-        lineContent: getLineContent(lines, pkg.line),
+        lineContent: (0, import_tooling.getLineContent)(lines, pkg.line),
         category: meta.category,
         severity: meta.severity
       });
@@ -448,29 +574,9 @@ async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, r
   return { issues, errors };
 }
 var adapter = {
-  id: TOOL_ID,
-  displayName: "Trivy",
-  preferredVersion: "0.69.3",
+  ...descriptor,
   compatibleVersions: ">=0.50.0",
   website: "https://trivy.dev/",
-  languages: [
-    "Python",
-    "JavaScript",
-    "TypeScript",
-    "Go",
-    "Java",
-    "Ruby",
-    "Rust",
-    "PHP",
-    "C#",
-    "Dart",
-    "Elixir",
-    "Swift"
-  ],
-  filePatterns: ["*"],
-  supportedOS: ["linux", "darwin"],
-  supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"],
   prerequisites: [],
   /**
    * Checks whether the `trivy` binary is present and runnable.
@@ -607,13 +713,7 @@ var adapter = {
     const issues = [];
     const errors = [];
     if (ctx.targetFiles.length === 0) {
-      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
-    }
-    if (!(codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile) && codacyConfig.patterns.length === 0) {
-      ctx.logger.info("Skipping analysis: no local config and no patterns enabled", {
-        toolId: TOOL_ID
-      });
-      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
     }
     const binary = await resolveBinaryPath(ctx);
     let cacheDir;
@@ -627,7 +727,7 @@ var adapter = {
         message: `Failed to create cache directory: ${err instanceof Error ? err.message : String(err)}`,
         level: "error"
       });
-      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
     }
     const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
     const targetFilesSet = new Set(ctx.targetFiles);
@@ -727,7 +827,14 @@ var adapter = {
         level: "error"
       });
     }
-    const result = buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+    const result = (0, import_tooling.buildResult)(
+      TOOL_ID,
+      startedAt,
+      /* @__PURE__ */ new Date(),
+      issues,
+      errors,
+      ctx.targetFiles.length
+    );
     ctx.logger.info("Analysis complete", {
       toolId: TOOL_ID,
       issueCount: result.summary.issueCount,

package/dist/metadata.d.ts

@@ -0,0 +1,13 @@
+import { AdapterDescriptor } from '@codacy/tooling';
+
+/**
+ * Lightweight adapter descriptor for lazy loading.
+ *
+ * This module contains only plain-data metadata fields and has zero heavy
+ * imports (no patterns.json, no runtime utilities). The CLI imports this
+ * at startup for adapter registration without loading the full adapter module.
+ */
+
+declare const descriptor: AdapterDescriptor;
+
+export { descriptor };

package/dist/metadata.js

@@ -0,0 +1,52 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/metadata.ts
+var metadata_exports = {};
+__export(metadata_exports, {
+  descriptor: () => descriptor
+});
+module.exports = __toCommonJS(metadata_exports);
+var descriptor = {
+  id: "Trivy",
+  displayName: "Trivy",
+  preferredVersion: "0.69.3",
+  languages: [
+    "Python",
+    "JavaScript",
+    "TypeScript",
+    "Go",
+    "Java",
+    "Ruby",
+    "Rust",
+    "PHP",
+    "C#",
+    "Dart",
+    "Elixir",
+    "Swift"
+  ],
+  filePatterns: ["*"],
+  supportedOS: ["linux", "darwin"],
+  supportedArch: ["x64", "arm64"],
+  supportedRunners: ["local", "container"]
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  descriptor
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-trivy-0",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Trivy adapter — CLI-mode security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.4.0"
+    "@codacy/tooling": "0.6.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",
@@ -21,8 +21,18 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./metadata": {
+      "types": "./dist/metadata.d.ts",
+      "default": "./dist/metadata.js"
+    }
+  },
   "scripts": {
-    "build": "tsup src/index.ts --format cjs --dts --clean",
+    "build": "tsup src/index.ts src/metadata.ts --format cjs --dts --clean",
     "test": "vitest run",
     "lint": "eslint src/",
     "clean": "rm -rf dist",