@codacy/verity-cli 0.31.3 → 0.32.0-experimental.5e53cb9

package/data/skills/verity-setup/SKILL.md

@@ -18,7 +18,18 @@ So: **do not re-ask what init asked, and do not re-write what init wrote.** Wiri
 hooks or a `.gitignore` block here is how the two flows drifted apart before — the
 skill reconciled hooks init had just installed, silently removing them.
 
-**What is yours** — everything a program cannot decide:
+⚠ **`verity init` NOW DERIVES THE STANDARD BY ITSELF**, so in most projects there
+is nothing here left to do — the languages, the tool selection, the curated
+pattern ids and `VERITY.md` are all lookups over this same catalogue, and the CLI
+does them in about two seconds (`verity standard synthesize`). Step 1 will tell
+you when that has already happened.
+
+**You are here for the part a lookup cannot produce:** project-specific patterns —
+"every route under `api/` uses the auth middleware", "RLS policies on all Supabase
+tables". `custom_patterns` is left EMPTY by the CLI precisely so a model can
+propose them from evidence rather than have them invented from a dependency list.
+
+**What is yours when there is no Standard at all** (Step 1 says so, or `--force`):
 1. Read the codebase and understand it (Step 2).
 2. Synthesize `.verity/standard.yaml` from what you found (Step 4).
 3. Write `.codacy/codacy.config.json` with curated, validated pattern ids (Step 5).
@@ -53,6 +64,18 @@ answers, the hook wiring, and a `next` list. Branch on it:
   to launch a second Claude Code session on top of this one.
 - **`blocked` is true** → a required prerequisite is missing. Show the
   `prerequisites[].remedy` lines and stop; nothing below can work.
+- **`artifacts.standard` is true and `phases.setup.done` is true** → the
+  project already has a Standard, derived or adopted. Your job is the part the CLI
+  leaves empty: propose 2–5 `custom_patterns` from the codebase, show them, and on
+  the user's agreement add them to `.verity/standard.yaml` and run
+  `verity standard push`. Do NOT rewrite the rest of the Standard — `standard push`
+  auto-versions, so a full re-synthesis lands as the version everybody is then
+  held to.
+- **`artifacts.standard` is true but `artifacts.analysisConfig` is false** → the
+  CLI derives this case too: `verity standard synthesize --config-only` rewrites
+  the config from the Standard already in place. Prefer that over doing it by hand.
+  ⚠ Do NOT suggest `--force` here — it REPLACES the Standard, and the team already
+  agreed that one. If you do it by hand, **Step 5 only**, then `verity config push`.
 - **`artifacts.verityMd` is true and the user did not pass `--force`** → already
   configured. Say "Already configured. Run `/verity-setup --force` to
   reconfigure." and stop.

package/data/skills/verity-setup/patterns-reference.yaml

@@ -505,29 +505,29 @@ curated_patterns:
     description: "Python errors + security. Skips style/formatting (use formatter instead)."
     patterns:
       # Pyflakes — error-prone
-      - patternId: "Ruff_F401"    # unused import
-      - patternId: "Ruff_F811"    # redefined unused name
-      - patternId: "Ruff_F841"    # unused variable
-      - patternId: "Ruff_F821"    # undefined name
+      - patternId: "Ruff_F401_unused-import"    # unused import
+      - patternId: "Ruff_F811_redefined-while-unused"    # redefined unused name
+      - patternId: "Ruff_F841_unused-variable"    # unused variable
+      - patternId: "Ruff_F821_undefined-name"    # undefined name
       # Bugbear — likely bugs
-      - patternId: "Ruff_B006"    # mutable default argument
-      - patternId: "Ruff_B007"    # unused loop variable
-      - patternId: "Ruff_B018"    # useless expression
+      - patternId: "Ruff_B006_mutable-argument-default"    # mutable default argument
+      - patternId: "Ruff_B007_unused-loop-control-variable"    # unused loop variable
+      - patternId: "Ruff_B018_useless-expression"    # useless expression
       # Security
-      - patternId: "Ruff_S101"    # assert used (not for prod)
-      - patternId: "Ruff_S102"    # exec used
-      - patternId: "Ruff_S103"    # bad file permissions
-      - patternId: "Ruff_S104"    # hardcoded bind all interfaces
-      - patternId: "Ruff_S105"    # hardcoded password string
-      - patternId: "Ruff_S106"    # hardcoded password argument
-      - patternId: "Ruff_S107"    # hardcoded password default
-      - patternId: "Ruff_S108"    # hardcoded temp file
-      - patternId: "Ruff_S110"    # try-except-pass
-      - patternId: "Ruff_S301"    # pickle usage
-      - patternId: "Ruff_S608"    # SQL injection via string formatting
+      - patternId: "Ruff_S101_assert"    # assert used (not for prod)
+      - patternId: "Ruff_S102_exec-builtin"    # exec used
+      - patternId: "Ruff_S103_bad-file-permissions"    # bad file permissions
+      - patternId: "Ruff_S104_hardcoded-bind-all-interfaces"    # hardcoded bind all interfaces
+      - patternId: "Ruff_S105_hardcoded-password-string"    # hardcoded password string
+      - patternId: "Ruff_S106_hardcoded-password-func-arg"    # hardcoded password argument
+      - patternId: "Ruff_S107_hardcoded-password-default"    # hardcoded password default
+      - patternId: "Ruff_S108_hardcoded-temp-file"    # hardcoded temp file
+      - patternId: "Ruff_S110_try-except-pass"    # try-except-pass
+      - patternId: "Ruff_S301_suspicious-pickle-usage"    # pickle usage
+      - patternId: "Ruff_S608_hardcoded-sql-expression"    # SQL injection via string formatting
       # Type annotations (if desired)
-      - patternId: "Ruff_ANN001"  # missing type annotation for function argument
-      - patternId: "Ruff_ANN201"  # missing return type annotation
+      - patternId: "Ruff_ANN001_missing-type-function-argument"  # missing type annotation for function argument
+      - patternId: "Ruff_ANN201_missing-return-type-undocumented-public-function"  # missing return type annotation
 
   # --- ShellCheck (491 available → ~15 high-signal) ---
   shellcheck:
@@ -552,34 +552,59 @@ curated_patterns:
   Bandit:
     description: "Python security only."
     patterns:
-      - patternId: "B101"    # assert used
-      - patternId: "B102"    # exec used
-      - patternId: "B103"    # set_bad_file_permissions
-      - patternId: "B104"    # hardcoded_bind_all_interfaces
-      - patternId: "B105"    # hardcoded_password_string
-      - patternId: "B301"    # pickle usage
-      - patternId: "B303"    # insecure hash (md5/sha1)
-      - patternId: "B608"    # SQL injection
-      - patternId: "B602"    # subprocess with shell=True
-      - patternId: "B501"    # request with verify=False
-
-  # --- PMD7 (424 available → ~12 high-signal) ---
+      - patternId: "Bandit_B101"    # assert used
+      - patternId: "Bandit_B102"    # exec used
+      - patternId: "Bandit_B103"    # set_bad_file_permissions
+      - patternId: "Bandit_B104"    # hardcoded_bind_all_interfaces
+      - patternId: "Bandit_B105"    # hardcoded_password_string
+      - patternId: "Bandit_B301"    # pickle usage
+      - patternId: "Bandit_B303"    # insecure hash (md5/sha1)
+      - patternId: "Bandit_B608"    # SQL injection
+      - patternId: "Bandit_B602"    # subprocess with shell=True
+      - patternId: "Bandit_B501"    # request with verify=False
+
+  # --- PMD7 — ⚠ LIST NOT DERIVED. THE TOOL IS DISABLED UNTIL IT IS. ---
+  #
+  # Audited 2026-09-07 against the installed adapter: all 12 ids below matched
+  # nothing. They are bare rule names, and the adapter's are category-qualified:
+  #     UnusedLocalVariable  →  PMD7_category_java_bestpractices_UnusedLocalVariable
+  #
+  # ⚠ THE LIST IS EMPTY ON PURPOSE, AND EMPTYING IT IS WHAT DISABLES THE TOOL.
+  # `patterns: []` in the CATALOGUE means "no derived ids", which makes the CLI
+  # drop PMD7 (selectTools) — the same treatment Semgrep gets. Leaving the bare
+  # names here was worse than useless: on a machine with no adapter there is no
+  # intersection to filter them, so they were written into codacy.config.json and
+  # PMD7 ran with nothing enabled, reporting zero issues. That is the VRT-105
+  # failure, produced by the very list that documents it.
+  #
+  # They cannot be resolved mechanically: the suffix is AMBIGUOUS across
+  # languages — `UnusedLocalVariable` exists as both
+  # `PMD7_category_apex_bestpractices_…` and `PMD7_category_java_…` — so picking
+  # one would enable a rule that can never fire. Deriving them needs a human to
+  # choose the category per rule:
+  #     node validate-patterns.mjs --list PMD7 '_category_java_'
+  #
+  # The curation to restore, once the categories are chosen:
+  #     UnusedLocalVariable
+  #     UnusedPrivateField
+  #     UnusedPrivateMethod
+  #     EmptyCatchBlock
+  #     AvoidReassigningParameters
+  #     CloseResource
+  #     CompareObjectsWithEquals
+  #     EqualsNull
+  #     MissingBreakInSwitch
+  #     NullAssignment
+  #     ReturnEmptyCollectionRatherThanNull
+  #     SimplifiedTernary
   PMD7:
-    description: "Java error-prone + security. No style rules."
-    patterns:
-      - patternId: "UnusedLocalVariable"
-      - patternId: "UnusedPrivateField"
-      - patternId: "UnusedPrivateMethod"
-      - patternId: "EmptyCatchBlock"
-      - patternId: "AvoidReassigningParameters"
-      - patternId: "CloseResource"
-      - patternId: "CompareObjectsWithEquals"
-      - patternId: "EqualsNull"
-      - patternId: "MissingBreakInSwitch"
-      - patternId: "NullAssignment"
-      - patternId: "ReturnEmptyCollectionRatherThanNull"
-      - patternId: "SimplifiedTernary"
+    description: "Java quality + error-prone. NOT DERIVED — see above."
+    patterns: []
 
+  # --- detekt — ⚠ UNVERIFIED: no detekt adapter was installed when the other
+  #     lists were audited (2026-09-07), so these ids have never been checked
+  #     against one. The CLI drops any id the adapter does not define, so a wrong
+  #     one costs the rule rather than the tool — but the list is not evidence.
   # --- detekt (296 available → ~10 high-signal) ---
   detekt:
     description: "Kotlin error-prone + complexity."
@@ -604,11 +629,11 @@ curated_patterns:
   Hadolint:
     description: "Dockerfile best practices."
     patterns:
-      - patternId: "DL3006"   # always tag the version of an image
-      - patternId: "DL3007"   # using latest is error-prone
-      - patternId: "DL3008"   # pin versions in apt-get
-      - patternId: "DL3009"   # delete apt-get lists
-      - patternId: "DL3018"   # pin versions in apk add
-      - patternId: "DL3025"   # use JSON for CMD
-      - patternId: "DL3028"   # pin versions in gem install
-      - patternId: "DL4006"   # set SHELL option -o pipefail
+      - patternId: "Hadolint_DL3006"   # always tag the version of an image
+      - patternId: "Hadolint_DL3007"   # using latest is error-prone
+      - patternId: "Hadolint_DL3008"   # pin versions in apt-get
+      - patternId: "Hadolint_DL3009"   # delete apt-get lists
+      - patternId: "Hadolint_DL3018"   # pin versions in apk add
+      - patternId: "Hadolint_DL3025"   # use JSON for CMD
+      - patternId: "Hadolint_DL3028"   # pin versions in gem install
+      - patternId: "Hadolint_DL4006"   # set SHELL option -o pipefail

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.31.3",
+  "version": "0.32.0-experimental.5e53cb9",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",