@codacy/verity-cli 0.31.0 → 0.31.1-experimental.4cbb87c

package/data/skills/verity-setup/patterns-reference.yaml

@@ -505,29 +505,29 @@ curated_patterns:
     description: "Python errors + security. Skips style/formatting (use formatter instead)."
     patterns:
       # Pyflakes — error-prone
-      - patternId: "Ruff_F401"    # unused import
-      - patternId: "Ruff_F811"    # redefined unused name
-      - patternId: "Ruff_F841"    # unused variable
-      - patternId: "Ruff_F821"    # undefined name
+      - patternId: "Ruff_F401_unused-import"    # unused import
+      - patternId: "Ruff_F811_redefined-while-unused"    # redefined unused name
+      - patternId: "Ruff_F841_unused-variable"    # unused variable
+      - patternId: "Ruff_F821_undefined-name"    # undefined name
       # Bugbear — likely bugs
-      - patternId: "Ruff_B006"    # mutable default argument
-      - patternId: "Ruff_B007"    # unused loop variable
-      - patternId: "Ruff_B018"    # useless expression
+      - patternId: "Ruff_B006_mutable-argument-default"    # mutable default argument
+      - patternId: "Ruff_B007_unused-loop-control-variable"    # unused loop variable
+      - patternId: "Ruff_B018_useless-expression"    # useless expression
       # Security
-      - patternId: "Ruff_S101"    # assert used (not for prod)
-      - patternId: "Ruff_S102"    # exec used
-      - patternId: "Ruff_S103"    # bad file permissions
-      - patternId: "Ruff_S104"    # hardcoded bind all interfaces
-      - patternId: "Ruff_S105"    # hardcoded password string
-      - patternId: "Ruff_S106"    # hardcoded password argument
-      - patternId: "Ruff_S107"    # hardcoded password default
-      - patternId: "Ruff_S108"    # hardcoded temp file
-      - patternId: "Ruff_S110"    # try-except-pass
-      - patternId: "Ruff_S301"    # pickle usage
-      - patternId: "Ruff_S608"    # SQL injection via string formatting
+      - patternId: "Ruff_S101_assert"    # assert used (not for prod)
+      - patternId: "Ruff_S102_exec-builtin"    # exec used
+      - patternId: "Ruff_S103_bad-file-permissions"    # bad file permissions
+      - patternId: "Ruff_S104_hardcoded-bind-all-interfaces"    # hardcoded bind all interfaces
+      - patternId: "Ruff_S105_hardcoded-password-string"    # hardcoded password string
+      - patternId: "Ruff_S106_hardcoded-password-func-arg"    # hardcoded password argument
+      - patternId: "Ruff_S107_hardcoded-password-default"    # hardcoded password default
+      - patternId: "Ruff_S108_hardcoded-temp-file"    # hardcoded temp file
+      - patternId: "Ruff_S110_try-except-pass"    # try-except-pass
+      - patternId: "Ruff_S301_suspicious-pickle-usage"    # pickle usage
+      - patternId: "Ruff_S608_hardcoded-sql-expression"    # SQL injection via string formatting
       # Type annotations (if desired)
-      - patternId: "Ruff_ANN001"  # missing type annotation for function argument
-      - patternId: "Ruff_ANN201"  # missing return type annotation
+      - patternId: "Ruff_ANN001_missing-type-function-argument"  # missing type annotation for function argument
+      - patternId: "Ruff_ANN201_missing-return-type-undocumented-public-function"  # missing return type annotation
 
   # --- ShellCheck (491 available → ~15 high-signal) ---
   shellcheck:
@@ -552,34 +552,59 @@ curated_patterns:
   Bandit:
     description: "Python security only."
     patterns:
-      - patternId: "B101"    # assert used
-      - patternId: "B102"    # exec used
-      - patternId: "B103"    # set_bad_file_permissions
-      - patternId: "B104"    # hardcoded_bind_all_interfaces
-      - patternId: "B105"    # hardcoded_password_string
-      - patternId: "B301"    # pickle usage
-      - patternId: "B303"    # insecure hash (md5/sha1)
-      - patternId: "B608"    # SQL injection
-      - patternId: "B602"    # subprocess with shell=True
-      - patternId: "B501"    # request with verify=False
-
-  # --- PMD7 (424 available → ~12 high-signal) ---
+      - patternId: "Bandit_B101"    # assert used
+      - patternId: "Bandit_B102"    # exec used
+      - patternId: "Bandit_B103"    # set_bad_file_permissions
+      - patternId: "Bandit_B104"    # hardcoded_bind_all_interfaces
+      - patternId: "Bandit_B105"    # hardcoded_password_string
+      - patternId: "Bandit_B301"    # pickle usage
+      - patternId: "Bandit_B303"    # insecure hash (md5/sha1)
+      - patternId: "Bandit_B608"    # SQL injection
+      - patternId: "Bandit_B602"    # subprocess with shell=True
+      - patternId: "Bandit_B501"    # request with verify=False
+
+  # --- PMD7 — ⚠ LIST NOT DERIVED. THE TOOL IS DISABLED UNTIL IT IS. ---
+  #
+  # Audited 2026-09-07 against the installed adapter: all 12 ids below matched
+  # nothing. They are bare rule names, and the adapter's are category-qualified:
+  #     UnusedLocalVariable  →  PMD7_category_java_bestpractices_UnusedLocalVariable
+  #
+  # ⚠ THE LIST IS EMPTY ON PURPOSE, AND EMPTYING IT IS WHAT DISABLES THE TOOL.
+  # `patterns: []` in the CATALOGUE means "no derived ids", which makes the CLI
+  # drop PMD7 (selectTools) — the same treatment Semgrep gets. Leaving the bare
+  # names here was worse than useless: on a machine with no adapter there is no
+  # intersection to filter them, so they were written into codacy.config.json and
+  # PMD7 ran with nothing enabled, reporting zero issues. That is the VRT-105
+  # failure, produced by the very list that documents it.
+  #
+  # They cannot be resolved mechanically: the suffix is AMBIGUOUS across
+  # languages — `UnusedLocalVariable` exists as both
+  # `PMD7_category_apex_bestpractices_…` and `PMD7_category_java_…` — so picking
+  # one would enable a rule that can never fire. Deriving them needs a human to
+  # choose the category per rule:
+  #     node validate-patterns.mjs --list PMD7 '_category_java_'
+  #
+  # The curation to restore, once the categories are chosen:
+  #     UnusedLocalVariable
+  #     UnusedPrivateField
+  #     UnusedPrivateMethod
+  #     EmptyCatchBlock
+  #     AvoidReassigningParameters
+  #     CloseResource
+  #     CompareObjectsWithEquals
+  #     EqualsNull
+  #     MissingBreakInSwitch
+  #     NullAssignment
+  #     ReturnEmptyCollectionRatherThanNull
+  #     SimplifiedTernary
   PMD7:
-    description: "Java error-prone + security. No style rules."
-    patterns:
-      - patternId: "UnusedLocalVariable"
-      - patternId: "UnusedPrivateField"
-      - patternId: "UnusedPrivateMethod"
-      - patternId: "EmptyCatchBlock"
-      - patternId: "AvoidReassigningParameters"
-      - patternId: "CloseResource"
-      - patternId: "CompareObjectsWithEquals"
-      - patternId: "EqualsNull"
-      - patternId: "MissingBreakInSwitch"
-      - patternId: "NullAssignment"
-      - patternId: "ReturnEmptyCollectionRatherThanNull"
-      - patternId: "SimplifiedTernary"
+    description: "Java quality + error-prone. NOT DERIVED — see above."
+    patterns: []
 
+  # --- detekt — ⚠ UNVERIFIED: no detekt adapter was installed when the other
+  #     lists were audited (2026-09-07), so these ids have never been checked
+  #     against one. The CLI drops any id the adapter does not define, so a wrong
+  #     one costs the rule rather than the tool — but the list is not evidence.
   # --- detekt (296 available → ~10 high-signal) ---
   detekt:
     description: "Kotlin error-prone + complexity."
@@ -604,11 +629,11 @@ curated_patterns:
   Hadolint:
     description: "Dockerfile best practices."
     patterns:
-      - patternId: "DL3006"   # always tag the version of an image
-      - patternId: "DL3007"   # using latest is error-prone
-      - patternId: "DL3008"   # pin versions in apt-get
-      - patternId: "DL3009"   # delete apt-get lists
-      - patternId: "DL3018"   # pin versions in apk add
-      - patternId: "DL3025"   # use JSON for CMD
-      - patternId: "DL3028"   # pin versions in gem install
-      - patternId: "DL4006"   # set SHELL option -o pipefail
+      - patternId: "Hadolint_DL3006"   # always tag the version of an image
+      - patternId: "Hadolint_DL3007"   # using latest is error-prone
+      - patternId: "Hadolint_DL3008"   # pin versions in apt-get
+      - patternId: "Hadolint_DL3009"   # delete apt-get lists
+      - patternId: "Hadolint_DL3018"   # pin versions in apk add
+      - patternId: "Hadolint_DL3025"   # use JSON for CMD
+      - patternId: "Hadolint_DL3028"   # pin versions in gem install
+      - patternId: "Hadolint_DL4006"   # set SHELL option -o pipefail

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.31.0",
+  "version": "0.31.1-experimental.4cbb87c",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",