@codacy/verity-cli 0.29.2 → 0.29.4-experimental.9a4e14c

package/data/skills/verity-setup/SKILL.md

@@ -221,7 +221,43 @@ it from the installed adapter. Then **always validate** (next section).
    about signal rather than a complete enumeration. Copy the pattern list for each
    tool selected for this mode. `--list <toolId> <regex>` will confirm any single ID
    or let you derive additions.
-3. For tools with an **existing local config** (e.g., `eslint.config.js`): use `localConfigurationFile` to point to it. When `localConfigurationFile` is set, the tool uses its native config and the `patterns` array is ignored — but you still MUST include at least one pattern in the array (the CLI crashes without it). Use a single placeholder: `[{ "patternId": "ESLint9_no-eval" }]` for ESLint, etc.
+> ⚠ **Semgrep ids carry a doubled suffix.** The rule name appears twice — once as
+> the path segment and once as the rule id:
+> `Semgrep_javascript.browser.security.raw-html-concat.raw-html-concat`. Deriving
+> them with `--list Semgrep '<regex>'` gives the correct form; constructing them by
+> hand from the rule name does not.
+
+3. ⚠ **NEVER point `localConfigurationFile` at the project's own config** (VRT-108).
+   Doing so hands the tool the project's rule set, and Verity's `patterns` array
+   degrades to a **filter over rules someone else enabled** — it can no longer turn
+   a rule ON. A project that disables a rule makes it permanently unreachable by
+   the gate, silently. Measured: a repo whose `eslint.config.js` sets
+   `"@typescript-eslint/no-unused-vars": "off"` and omits `no-eval`/`eqeqeq`/`no-var`
+   had all four listed in its Verity config and **only** `no-explicit-any` could fire.
+
+   Setting the path is not even sufficient on its own. `useLocalConfigurationFile`
+   **defaults to true**, and the adapter auto-discovers `./eslint.config.js` and
+   overrides your value unless the flag is explicitly `false`:
+
+   ```js
+   // @codacy/analysis-cli — defaults to true unless EXPLICITLY false
+   if (!existing || existing.useLocalConfigurationFile !== false) {
+     config.useLocalConfigurationFile = true;
+   }
+   // patterns become the ENABLED set only when the flag is false
+   if (!codacyToolConfig.useLocalConfigurationFile && codacyToolConfig.patterns.length === …)
+   ```
+
+   So for ESLint9 always emit **both**:
+
+   - `"useLocalConfigurationFile": false` — makes `patterns` the enabled rule set
+   - `"localConfigurationFile": "./.codacy/tools-configs/eslint.config.mjs"` — a
+     **Verity-owned** config, written by this skill, so the gate does not inherit
+     the project's lint policy
+
+   The project's own `eslint.config.js` is left untouched and keeps serving
+   `npm run lint`. The two are deliberately independent: a team may reasonably turn
+   a rule off for their editor and still want the gate to enforce it.
 4. For tools **without** a local config: populate the full curated pattern list from `patterns-reference.yaml`
 5. **Validate** (next section). This is not optional — it is the only thing that
    catches a stale or mistyped ID, and the failure mode is silent.
@@ -245,7 +281,8 @@ Delete `.codacy/codacy.config.json` and write a new one. This example is for Typ
   "tools": [
     {
       "toolId": "ESLint9",
-      "localConfigurationFile": "./eslint.config.js",
+      "localConfigurationFile": "./.codacy/tools-configs/eslint.config.mjs",
+      "useLocalConfigurationFile": false,
       "patterns": [
         { "patternId": "ESLint9_no-eval" },
         { "patternId": "ESLint9_no-implied-eval" },
@@ -295,6 +332,58 @@ Delete `.codacy/codacy.config.json` and write a new one. This example is for Typ
 }
 ```
 
+### Also write the Verity-owned ESLint config
+
+Because `useLocalConfigurationFile` is `false`, the adapter builds ESLint's rule set
+from the `patterns` array — but ESLint still needs a config for parser, globals and
+ignores. Write `.codacy/tools-configs/eslint.config.mjs`, adapted to the project's
+frameworks and ignore paths:
+
+```js
+// Verity-owned ESLint config for the quality gate.
+//
+// Deliberately SEPARATE from the project's ./eslint.config.js. Pointing the gate at
+// the project config makes Verity's pattern list a FILTER over rules the project
+// enabled, so any rule the project disables becomes unreachable (VRT-108).
+//
+// Keep the rules here in sync with the ESLint9 patterns in codacy.config.json.
+import js from "@eslint/js";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["dist/**", "build/**", "node_modules/**", "coverage/**", ".codacy/**"] },
+  {
+    extends: [js.configs.recommended, ...tseslint.configs.recommended],
+    files: ["**/*.{ts,tsx,js,jsx}"],
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: "module",
+      globals: { ...globals.browser, ...globals.node },
+    },
+    rules: {
+      // Mirror the ESLint9 patterns in codacy.config.json.
+      "no-eval": "error",
+      "no-implied-eval": "error",
+      "no-new-func": "error",
+      "no-script-url": "error",
+      eqeqeq: ["error", "smart"],
+      "no-var": "error",
+      "@typescript-eslint/no-explicit-any": "warn",
+      "@typescript-eslint/no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
+    },
+  },
+);
+```
+
+⚠ **Do not enable type-checked rules** (`no-unsafe-assignment`, `no-unsafe-call`,
+`no-unsafe-return`). They require `parserOptions.projectService`, which makes a
+per-turn gate far too slow on a large repo. Cover those through AI review in the
+Standard instead.
+
+⚠ **Generated files belong in `ignores`** — `src/integrations/supabase/types.ts` and
+similar. They are not the agent's work and will otherwise dominate the findings.
+
 ### Validate the config — REQUIRED, do not skip
 
 Immediately after writing `.codacy/codacy.config.json`, run the validator that ships

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.29.2",
+  "version": "0.29.4-experimental.9a4e14c",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",