@codacy/verity-cli 0.34.3 → 0.35.0-experimental.16e0448

package/data/skills/verity-setup/patterns-reference.yaml

@@ -306,334 +306,8 @@ owasp_mapping:
     description: "Server-side request forgery"
 
 # =============================================================================
-# 6. Tool Recommendations by Language
-#    Adapter IDs match @codacy/analysis-cli (from CODACY-ANALYSIS-CLI.md)
+# 6. Static analysis
+#    Trivy only, configured and run by Verity itself (.verity/static-analysis.json).
+#    The per-language tool matrices, analysis modes and curated pattern ids that
+#    used to live here were removed with the other tools (spec/INIT-ONBOARDING-PLAN.md DC7).
 # =============================================================================
-
-tool_recommendations:
-  typescript:
-    lightweight: [Trivy]
-    balanced: [ESLint9, Semgrep, Trivy]
-    thorough: [ESLint9, Semgrep, Trivy, Lizard]
-
-  javascript:
-    lightweight: [Trivy]
-    balanced: [ESLint9, Semgrep, Trivy]
-    thorough: [ESLint9, Semgrep, Trivy, Lizard]
-
-  python:
-    lightweight: [Trivy]
-    balanced: [Ruff, Semgrep, Trivy]
-    thorough: [Ruff, Semgrep, Bandit, Trivy, Lizard]
-
-  go:
-    lightweight: [Trivy]
-    balanced: [Semgrep, Trivy]
-    thorough: [Semgrep, Trivy, Lizard]
-
-  java:
-    lightweight: [Trivy]
-    balanced: [PMD7, Semgrep, Trivy]
-    thorough: [PMD7, Checkstyle, Semgrep, Trivy, Lizard]
-
-  kotlin:
-    lightweight: [Trivy]
-    balanced: [detekt, Semgrep, Trivy]
-    thorough: [detekt, Semgrep, Trivy]
-
-  ruby:
-    lightweight: [Trivy]
-    balanced: [Semgrep, Trivy]
-    thorough: [Semgrep, Trivy, Lizard]
-
-  rust:
-    lightweight: [Trivy]
-    balanced: [Semgrep, Trivy]
-    thorough: [Semgrep, Trivy]
-
-  c:
-    lightweight: [Trivy]
-    balanced: [cppcheck, Semgrep, Trivy]
-    thorough: [cppcheck, flawfinder, Semgrep, Trivy, Lizard]
-
-  cpp:
-    lightweight: [Trivy]
-    balanced: [cppcheck, Semgrep, Trivy]
-    thorough: [cppcheck, flawfinder, Semgrep, Trivy, Lizard]
-
-  shell:
-    lightweight: []
-    balanced: [shellcheck]
-    thorough: [shellcheck]
-
-  dockerfile:
-    lightweight: [Trivy]
-    balanced: [Hadolint, Trivy]
-    thorough: [Hadolint, Trivy]
-
-# =============================================================================
-# 7. Analysis Modes
-# =============================================================================
-
-analysis_modes:
-  lightweight:
-    description: "Critical security only. Fastest (~3s)."
-    tools: "Trivy only"
-    patterns: "Critical security patterns"
-
-  balanced:
-    description: "Security + key quality. Good balance (~8s)."
-    tools: "Trivy + 1-2 language-specific tools"
-    patterns: "Curated high-signal patterns only (see curated_patterns below)"
-
-  thorough:
-    description: "All tools, all rules. Most comprehensive (~15s)."
-    tools: "All applicable tools"
-    patterns: "Curated patterns + tool defaults for secondary tools"
-
-# =============================================================================
-# 8. Curated Patterns Per Tool
-#    IMPORTANT: patterns: [] means ALL defaults (thousands of rules, massive
-#    token consumption and slow runs). Always use these curated lists instead.
-#
-#    PATTERN ID FORMAT — get this wrong and the tool fails SILENTLY.
-#    Every ID is `<toolId>_<ruleId>`, with `/` replaced by `_`:
-#        no-eval                            → ESLint9_no-eval
-#        @typescript-eslint/no-explicit-any  → ESLint9_@typescript-eslint_no-explicit-any
-#        F401                               → Ruff_F401
-#        SC2086                             → shellcheck_SC2086
-#    An unrecognised ID is not an error. The adapter builds `enabledPatterns` from
-#    the config, matches nothing, and reports 0 issues — identical to clean code.
-#    Perversely, `patterns: []` (size 0) means "all defaults" and DOES work, so a
-#    wrong list is strictly worse than no list.
-#
-#    ALWAYS run `node validate-patterns.mjs` after writing codacy.config.json.
-#    Never hand-author an ID; derive it from the installed adapter metadata.
-# =============================================================================
-
-curated_patterns:
-
-  # --- ESLint9 (2900+ available → ~25 high-signal) ---
-  ESLint9:
-    description: "Security + error-prone + TypeScript strictness. Skips style/formatting."
-    patterns:
-      # Security (MUST have)
-      - patternId: "ESLint9_no-eval"
-      - patternId: "ESLint9_no-implied-eval"
-      - patternId: "ESLint9_no-new-func"
-      - patternId: "ESLint9_no-script-url"
-      # Error-prone (high value)
-      - patternId: "ESLint9_no-unused-vars"
-      - patternId: "ESLint9_no-undef"
-      - patternId: "ESLint9_no-unreachable"
-      - patternId: "ESLint9_no-constant-condition"
-      - patternId: "ESLint9_no-dupe-keys"
-      - patternId: "ESLint9_no-duplicate-case"
-      - patternId: "ESLint9_no-fallthrough"
-      - patternId: "ESLint9_no-self-assign"
-      - patternId: "ESLint9_no-self-compare"
-      - patternId: "ESLint9_use-isnan"
-      - patternId: "ESLint9_valid-typeof"
-      - patternId: "ESLint9_no-loss-of-precision"
-      - patternId: "ESLint9_no-unsafe-optional-chaining"
-      # TypeScript (if applicable)
-      - patternId: "ESLint9_@typescript-eslint_no-explicit-any"
-      - patternId: "ESLint9_@typescript-eslint_no-unused-vars"
-      - patternId: "ESLint9_@typescript-eslint_no-unsafe-assignment"
-      - patternId: "ESLint9_@typescript-eslint_no-unsafe-call"
-      - patternId: "ESLint9_@typescript-eslint_no-unsafe-return"
-      # Best practice
-      - patternId: "ESLint9_eqeqeq"
-      - patternId: "ESLint9_no-var"
-      - patternId: "ESLint9_prefer-const"
-
-  # --- Semgrep / Opengrep (2523 available) — PATTERN LIST NOT YET DERIVED ---
-  #
-  # DO NOT emit a Semgrep block into codacy.config.json until the IDs below are
-  # derived and `validate-patterns.mjs` passes. The 17 IDs previously listed here
-  # were invented and matched nothing, so Semgrep silently reported zero findings.
-  #
-  # Real IDs repeat the trailing segment and carry the tool prefix, e.g.
-  #   Semgrep_javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret
-  #   Semgrep_generic.secrets.security.detected-artifactory-token.detected-artifactory-token
-  # Derive them from the installed adapter, never by hand:
-  #   node -e "const fs=require('fs');const d=process.env.CODACY_TOOLS_DIR+'/tools-opengrep-1/dist';\
-  #     let b='';for(const f of fs.readdirSync(d))if(f.endsWith('.js'))b+=fs.readFileSync(d+'/'+f,'utf8');\
-  #     console.log([...new Set(b.match(/Semgrep_[A-Za-z0-9_.-]+/g))].sort().join('\n'))"
-  #
-  # Also note Semgrep needs the Opengrep binary, which `--install-dependencies`
-  # does NOT fetch:  curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
-  #
-  # Categories to cover when curating (counts of real candidates in parentheses):
-  #   SQL injection, JS/TS (8) · XSS / unsafe HTML (15) · generic secrets (49)
-  #   hardcoded JWT secret (4) · Python deserialization / pickle (6)
-  #   NOTE: no rule matches "command-injection" for JavaScript — the old entry was fiction.
-  Semgrep:
-    description: "Security-only: injection, XSS, secrets, auth. No style rules."
-    status: unverified   # omit from generated config until derived + validated
-    patterns: []         # intentionally empty — see note above, do NOT copy into config
-
-  # --- Trivy — DERIVED, NOT HAND-MAINTAINED ---
-  #
-  # Trivy's catalogue is a fixed set of 6 umbrella patterns, so the config block is
-  # GENERATED from adapter metadata rather than copied from here. The list below is
-  # a cached snapshot for reading convenience only; the generator must emit it:
-  #
-  #   node validate-patterns.mjs --emit Trivy \
-  #     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
-  #
-  # If this snapshot ever disagrees with `--list Trivy`, the adapter wins — the
-  # snapshot is stale and should be regenerated. Severity is fixed per pattern, so
-  # severity filtering IS pattern selection. There is NO misconfig/config or license
-  # pattern; the old `trivy_config`/`trivy_license` entries were fiction.
-  Trivy:
-    description: "Dependency vulnerabilities, secrets, malicious packages. 6 patterns total."
-    source: derived
-    # NO pattern list is stored here ON PURPOSE. There is exactly one source of truth
-    # — the installed adapter — so there is nothing here to copy, mistype, or let go
-    # stale. Run `--list Trivy` to see all six, `--emit Trivy '<regex>'` to generate
-    # the config block.
-    #
-    # Selecting by severity IS selecting patterns (severity is fixed per pattern):
-    #   lightweight  '^Trivy_(secret|vulnerability_critical)$'
-    #   balanced     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high))$'
-    #   thorough     '^Trivy_(secret|malicious_packages|vulnerability_(critical|high|medium))$'
-    patterns: derive   # sentinel: not a list — see above. Never emit this value.
-
-  # --- Ruff (773 available → ~20 high-signal) ---
-  Ruff:
-    description: "Python errors + security. Skips style/formatting (use formatter instead)."
-    patterns:
-      # Pyflakes — error-prone
-      - patternId: "Ruff_F401_unused-import"    # unused import
-      - patternId: "Ruff_F811_redefined-while-unused"    # redefined unused name
-      - patternId: "Ruff_F841_unused-variable"    # unused variable
-      - patternId: "Ruff_F821_undefined-name"    # undefined name
-      # Bugbear — likely bugs
-      - patternId: "Ruff_B006_mutable-argument-default"    # mutable default argument
-      - patternId: "Ruff_B007_unused-loop-control-variable"    # unused loop variable
-      - patternId: "Ruff_B018_useless-expression"    # useless expression
-      # Security
-      - patternId: "Ruff_S101_assert"    # assert used (not for prod)
-      - patternId: "Ruff_S102_exec-builtin"    # exec used
-      - patternId: "Ruff_S103_bad-file-permissions"    # bad file permissions
-      - patternId: "Ruff_S104_hardcoded-bind-all-interfaces"    # hardcoded bind all interfaces
-      - patternId: "Ruff_S105_hardcoded-password-string"    # hardcoded password string
-      - patternId: "Ruff_S106_hardcoded-password-func-arg"    # hardcoded password argument
-      - patternId: "Ruff_S107_hardcoded-password-default"    # hardcoded password default
-      - patternId: "Ruff_S108_hardcoded-temp-file"    # hardcoded temp file
-      - patternId: "Ruff_S110_try-except-pass"    # try-except-pass
-      - patternId: "Ruff_S301_suspicious-pickle-usage"    # pickle usage
-      - patternId: "Ruff_S608_hardcoded-sql-expression"    # SQL injection via string formatting
-      # Type annotations (if desired)
-      - patternId: "Ruff_ANN001_missing-type-function-argument"  # missing type annotation for function argument
-      - patternId: "Ruff_ANN201_missing-return-type-undocumented-public-function"  # missing return type annotation
-
-  # --- ShellCheck (491 available → ~15 high-signal) ---
-  shellcheck:
-    description: "Quoting, globbing, and error-prone shell patterns."
-    patterns:
-      - patternId: "shellcheck_SC2086"   # double quote to prevent globbing/splitting
-      - patternId: "shellcheck_SC2046"   # quote to prevent word splitting
-      - patternId: "shellcheck_SC2006"   # use $() instead of backticks
-      - patternId: "shellcheck_SC2034"   # variable unused
-      - patternId: "shellcheck_SC2064"   # use single quotes for trap
-      - patternId: "shellcheck_SC2155"   # declare and assign separately
-      - patternId: "shellcheck_SC2164"   # use cd ... || exit
-      - patternId: "shellcheck_SC2181"   # check exit code directly
-      - patternId: "shellcheck_SC2162"   # read without -r
-      - patternId: "shellcheck_SC2002"   # useless cat
-      - patternId: "shellcheck_SC2004"   # unnecessary $ in arithmetic
-      - patternId: "shellcheck_SC2116"   # useless echo
-      - patternId: "shellcheck_SC2148"   # missing shebang
-      - patternId: "shellcheck_SC2229"   # command not found (typo)
-
-  # --- Bandit (78 available → ~10 high-signal) ---
-  Bandit:
-    description: "Python security only."
-    patterns:
-      - patternId: "Bandit_B101"    # assert used
-      - patternId: "Bandit_B102"    # exec used
-      - patternId: "Bandit_B103"    # set_bad_file_permissions
-      - patternId: "Bandit_B104"    # hardcoded_bind_all_interfaces
-      - patternId: "Bandit_B105"    # hardcoded_password_string
-      - patternId: "Bandit_B301"    # pickle usage
-      - patternId: "Bandit_B303"    # insecure hash (md5/sha1)
-      - patternId: "Bandit_B608"    # SQL injection
-      - patternId: "Bandit_B602"    # subprocess with shell=True
-      - patternId: "Bandit_B501"    # request with verify=False
-
-  # --- PMD7 — ⚠ LIST NOT DERIVED. THE TOOL IS DISABLED UNTIL IT IS. ---
-  #
-  # Audited 2026-09-07 against the installed adapter: all 12 ids below matched
-  # nothing. They are bare rule names, and the adapter's are category-qualified:
-  #     UnusedLocalVariable  →  PMD7_category_java_bestpractices_UnusedLocalVariable
-  #
-  # ⚠ THE LIST IS EMPTY ON PURPOSE, AND EMPTYING IT IS WHAT DISABLES THE TOOL.
-  # `patterns: []` in the CATALOGUE means "no derived ids", which makes the CLI
-  # drop PMD7 (selectTools) — the same treatment Semgrep gets. Leaving the bare
-  # names here was worse than useless: on a machine with no adapter there is no
-  # intersection to filter them, so they were written into codacy.config.json and
-  # PMD7 ran with nothing enabled, reporting zero issues. That is the VRT-105
-  # failure, produced by the very list that documents it.
-  #
-  # They cannot be resolved mechanically: the suffix is AMBIGUOUS across
-  # languages — `UnusedLocalVariable` exists as both
-  # `PMD7_category_apex_bestpractices_…` and `PMD7_category_java_…` — so picking
-  # one would enable a rule that can never fire. Deriving them needs a human to
-  # choose the category per rule:
-  #     node validate-patterns.mjs --list PMD7 '_category_java_'
-  #
-  # The curation to restore, once the categories are chosen:
-  #     UnusedLocalVariable
-  #     UnusedPrivateField
-  #     UnusedPrivateMethod
-  #     EmptyCatchBlock
-  #     AvoidReassigningParameters
-  #     CloseResource
-  #     CompareObjectsWithEquals
-  #     EqualsNull
-  #     MissingBreakInSwitch
-  #     NullAssignment
-  #     ReturnEmptyCollectionRatherThanNull
-  #     SimplifiedTernary
-  PMD7:
-    description: "Java quality + error-prone. NOT DERIVED — see above."
-    patterns: []
-
-  # --- detekt — ⚠ UNVERIFIED: no detekt adapter was installed when the other
-  #     lists were audited (2026-09-07), so these ids have never been checked
-  #     against one. The CLI drops any id the adapter does not define, so a wrong
-  #     one costs the rule rather than the tool — but the list is not evidence.
-  # --- detekt (296 available → ~10 high-signal) ---
-  detekt:
-    description: "Kotlin error-prone + complexity."
-    patterns:
-      - patternId: "EmptyCatchBlock"
-      - patternId: "SwallowedException"
-      - patternId: "UnusedPrivateMember"
-      - patternId: "MagicNumber"
-      - patternId: "ComplexMethod"
-      - patternId: "LongMethod"
-      - patternId: "TooManyFunctions"
-      - patternId: "ReturnCount"
-      - patternId: "ThrowsCount"
-      - patternId: "MaxLineLength"
-
-  # --- Lizard (12 available → all, already minimal) ---
-  Lizard:
-    description: "Complexity metrics only. Already minimal."
-    patterns: []  # All 12 patterns — they are all complexity metrics
-
-  # --- Hadolint (99 available → ~8 high-signal) ---
-  Hadolint:
-    description: "Dockerfile best practices."
-    patterns:
-      - patternId: "Hadolint_DL3006"   # always tag the version of an image
-      - patternId: "Hadolint_DL3007"   # using latest is error-prone
-      - patternId: "Hadolint_DL3008"   # pin versions in apt-get
-      - patternId: "Hadolint_DL3009"   # delete apt-get lists
-      - patternId: "Hadolint_DL3018"   # pin versions in apk add
-      - patternId: "Hadolint_DL3025"   # use JSON for CMD
-      - patternId: "Hadolint_DL3028"   # pin versions in gem install
-      - patternId: "Hadolint_DL4006"   # set SHELL option -o pipefail

package/data/skills/verity-setup/standard-template.yaml

@@ -119,7 +119,6 @@ custom_patterns: []
 # Process constraints
 process_constraints:
   self_healing_limit: 2    # Max fix-recheck iterations (research: degradation after 2)
-  analysis_mode: balanced  # lightweight | balanced | thorough
 
   # Knowledge system (KNOWLEDGE-SYSTEM-PRD §4, §8, §9)
   compound_enabled: true                    # master switch: graph + extractor + feedback suppressions
@@ -142,12 +141,6 @@ process_constraints:
     - .next
     - coverage
 
-# Tool configuration (populated during synthesis based on detected languages)
+# Static analysis is Trivy only, configured and run by Verity itself
+# (.verity/static-analysis.json). Synthesis sets: Trivy: { enabled: true }
 tool_configuration: {}
-# Example:
-#   eslint:
-#     enabled: true
-#     config_file: ".verity/tools/eslint.config.mjs"
-#   semgrep:
-#     enabled: true
-#     rulesets: ["p/security-audit", "p/typescript"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/verity-cli",
-  "version": "0.34.3",
+  "version": "0.35.0-experimental.16e0448",
   "description": "CLI for Verity quality gate service",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://verity.md",
@@ -42,15 +42,8 @@
     "web-tree-sitter": "0.27.0"
   },
   "dependencies": {
+    "@codacy/analysis-cli": "0.25.0",
     "commander": "^12",
     "yaml": "^2"
-  },
-  "peerDependencies": {
-    "@codacy/analysis-cli": ">=1.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@codacy/analysis-cli": {
-      "optional": true
-    }
   }
 }