replace semgrep with opengrep by heliocodacy · Pull Request #195 · codacy/codacy-cli-v2

heliocodacy · 2026-03-11T10:05:37Z

No description provided.

codacy-production · 2026-03-11T10:06:55Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ -0.19% (target: -0.50%)	❌ 9.78% (target: 50.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`da0cd76`)	5948	1305	21.94%
Head commit (`03e501f`)	5990 (+42)	1303 (-2)	21.75% (-0.19%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#195)	92	9	9.78%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

codacy-production · 2026-03-11T10:11:55Z

Codacy's Analysis Summary

0 new issue (≤ 1 medium issue)
0 new security issue (≤ 0 issue)
12 complexity
-1 duplications
More details

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

Copilot

Pull request overview

This PR updates the CLI’s static-analysis integration to use Opengrep (a Semgrep-compatible fork) and adjusts plugin/tooling infrastructure to support downloading Opengrep as a standalone binary.

Changes:

Add a new opengrep tool plugin (download-based, bare-binary install) and wire the analyzer runner to execute Opengrep.
Update config generation and integration-test fixtures to use opengrep@1.16.2 in place of semgrep@1.78.0.
Extend tool download processing to support OS+arch-specific arch overrides and non-archive (“bare”) binaries; extend Codacy client requests to support project-token auth.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tools/semgrepRunner.go	Renames Semgrep runner to `RunOpengrep` and updates messages/config detection.
tools/semgrepConfigCreator.go	Renames Semgrep config helpers to Opengrep equivalents; uses Opengrep embedded rules.
tools/semgrepConfigCreator_test.go	Updates tests to use Opengrep embedded rules + renamed types/functions.
plugins/tools/opengrep/plugin.yaml	New Opengrep plugin definition (download-based).
plugins/tools/opengrep/embedded/opengrep.go	Exposes Opengrep rules by reusing Semgrep embedded rules.
plugins/tools/opengrep/test/src/test_file.py	Adds a Python fixture file intended to trigger Opengrep rules.
plugins/tools/opengrep/test/src/.codacy/tools-configs/semgrep.yml	Adds a Semgrep-format rules file for Opengrep tool tests.
plugins/tools/opengrep/test/src/.codacy/codacy.yaml	Adds Opengrep tool test config pinned to `opengrep@1.16.2`.
plugins/tool-utils.go	Adds OS+arch override support when mapping architectures for downloads.
plugins/shared.go	Extends `DownloadConfig` with `os_arch_mapping`.
plugins/tool-utils_test.go	Updates supported-tools test expectations to include `opengrep`.
config/tools-installer.go	Adds support for installing tools distributed as a bare binary (non-archive).
domain/tool.go	Renames tool UUID constant/metadata from Semgrep to Opengrep.
domain/initFlags.go	Adds `ProjectToken` to init flags struct.
codacy-client/client.go	Adds project-token support for GET requests and selects token type from flags.
codacy-client/client_test.go	Updates tests for new `getRequest` signature.
cmd/analyze.go	Switches tool execution wiring from semgrep to opengrep.
cmd/configsetup/tool_creators.go	Switches config creator registry from Semgrep to Opengrep.
cmd/configsetup/default_config.go	Allows remote config generation if project token is present.
cmd/init.go	Treats presence of `ProjectToken` as non-local mode.
cmd/upload.go	Updates SARIF tool-name mapping for Opengrep.
constants/tool_configs.go	Renames Semgrep config constant/key to Opengrep (still uses `semgrep.yaml`).
cmd/analyze_test.go	Updates tool config filename map expectations for Opengrep.
cmd/analyze_integration_test.go	Updates tool config filename map expectations for Opengrep.
plugins/tools/trivy/test/src/.codacy/tools-configs/languages-config.yaml	Replaces `semgrep` tool entry with `opengrep` in fixture config.
integration-tests/init-without-token/expected/tools-configs/languages-config.yaml	Replaces `semgrep` with `opengrep` in expected output.
integration-tests/init-without-token/expected/codacy.yaml	Updates expected default tool list to `opengrep@1.16.2`.
integration-tests/init-with-token/expected/tools-configs/languages-config.yaml	Replaces `semgrep` with `opengrep` in expected output.
integration-tests/init-with-token/expected/codacy.yaml	Updates expected tool list to `opengrep@1.16.2`.
integration-tests/config-discover/expected/tools-configs/languages-config.yaml	Replaces `semgrep` with `opengrep` in expected output.
integration-tests/config-discover/expected/codacy.yaml	Updates expected tool list to `opengrep@1.16.2`.
.codacy/codacy.yaml	Updates repo’s own Codacy config to use Opengrep (also removes Flutter runtime and dartanalyzer).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-11T10:13:15Z

.codacy/codacy.yaml

    - java@17.0.10
    - node@22.2.0
    - python@3.11.11


This PR is titled "replace semgrep with opengrep", but this file also removes the Flutter runtime from the repo’s Codacy configuration. If Flutter is still needed (e.g., for dartanalyzer or other checks), this change will alter CI/tool installation behavior and looks out of scope for the PR title—consider keeping it or moving it to a separate PR with justification.

Copilot · 2026-03-11T10:13:16Z

.codacy/codacy.yaml

 tools:
    - eslint@9.38.0
    - lizard@1.17.31
    - pmd@6.55.0
    - pylint@3.3.9


This PR is titled "replace semgrep with opengrep", but this file also removes dartanalyzer from the repo’s Codacy tool list. Unless the intent is to stop analyzing Dart/Flutter projects, this is a behavior change that looks out of scope—consider keeping dartanalyzer here or moving this change to a separate PR with rationale.

Copilot · 2026-03-11T10:13:16Z

cmd/analyze.go

 		binaryPath := tool.Binaries[tool.Runtime]
 		return tools.RunDartAnalyzer(workDirectory, tool.InstallDir, binaryPath, pathsToCheck, outputFile, outputFormat)
-	case "semgrep":
+	case "opengrep":


runToolByName no longer handles the "semgrep" tool name, but the repository still ships the plugins/tools/semgrep plugin and plugins.GetSupportedTools() will report it as supported. This means users with existing codacy.yaml configs that still reference semgrep will pass validation but fail at runtime with "unsupported tool". Consider keeping a case "semgrep" that routes to Opengrep (or otherwise adding an explicit alias/normalization so semgrep configs keep working).

Suggested change

case "opengrep":

case "opengrep", "semgrep":

Copilot · 2026-03-11T10:13:16Z

cmd/upload.go

+	"Opengrep":            "opengrep",
+	"Opengrep OSS":        "opengrep",
 	"Lizard":              "lizard",
 	"revive":              "revive",


sarifShortNameMap no longer includes a mapping for "Semgrep". If a SARIF file was generated by Semgrep (or by older CLI versions) the upload flow may fail to resolve the tool short name/patterns. Either keep the "Semgrep": "semgrep" entry for backward compatibility, or ensure Semgrep is fully removed/unsupported end-to-end (including supported tools and docs).

Suggested change

"revive": "revive",

"revive": "revive",

"Semgrep": "semgrep",

Copilot · 2026-03-11T10:13:17Z

cmd/init.go

 		}

-		cliLocalMode := len(initFlags.ApiToken) == 0
+		cliLocalMode := len(initFlags.ApiToken)+len(initFlags.ProjectToken) == 0


cliLocalMode now depends on initFlags.ProjectToken, but cmdutils.AddCloudFlags does not define a --project-token flag for init, so ProjectToken will always be empty and remote init via project token is effectively unreachable. Add a flag (or another input mechanism) that populates InitFlags.ProjectToken, and update the local/remote mode messaging accordingly.

Copilot · 2026-03-11T10:13:17Z

cmd/configsetup/default_config.go

 	}

-	if currentCliMode == "remote" && initFlags.ApiToken != "" {
+	if currentCliMode == "remote" && (initFlags.ApiToken != "" || initFlags.ProjectToken != "") {


Remote config generation now allows initFlags.ProjectToken, but there is currently no CLI flag wiring that sets InitFlags.ProjectToken for these commands (AddCloudFlags only binds api-token/provider/org/repo). As written, this branch will never be taken when users provide only a project token. Consider binding --project-token into InitFlags and ensuring remote mode works with either token type.

Copilot · 2026-03-11T10:13:17Z

config/tools-installer.go

+	var destPath string
+	for _, p := range toolInfo.Binaries {
+		destPath = p
+		break
+	}
+	if destPath == "" {
+		return fmt.Errorf("no binary destination defined for tool %s", toolInfo.Name)
+	}


installBareBinary selects the destination by taking the first value from toolInfo.Binaries, which is a map (iteration order is random). This can become nondeterministic/incorrect if a download-based tool ever defines multiple binaries. Consider selecting a specific key (e.g., tool name) or explicitly erroring unless exactly one binary path is defined.

Suggested change

var destPath string

for _, p := range toolInfo.Binaries {

destPath = p

break

}

if destPath == "" {

return fmt.Errorf("no binary destination defined for tool %s", toolInfo.Name)

}

if len(toolInfo.Binaries) == 0 {

return fmt.Errorf("no binary destination defined for tool %s", toolInfo.Name)

}

if len(toolInfo.Binaries) > 1 {

return fmt.Errorf("multiple binary destinations defined for tool %s; bare binary install supports exactly one", toolInfo.Name)

}

var destPath string

for _, p := range toolInfo.Binaries {

destPath = p

}

machadoit

There are some changes that I am not sure why they are mixed in this PR. Can we have separate PRs if there is a requirement for this changes to be in place or what is happening here?

machadoit · 2026-03-11T11:38:41Z

cmd/configsetup/default_config.go

 	}

-	if currentCliMode == "remote" && initFlags.ApiToken != "" {
+	if currentCliMode == "remote" && (initFlags.ApiToken != "" || initFlags.ProjectToken != "") {


Why is this a change on the scope of replacing the tool?

cmd/init.go

cmd/upload.go

codacy-client/client.go

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (1)

plugins/tool-utils_test.go:177

This test asserts semgrep is a supported tool. However, the CLI’s execution switch no longer supports semgrep (only opengrep), so the current state is inconsistent: semgrep is advertised as supported but cannot be run. Either drop semgrep from the supported tools expectation (and remove/stop embedding the semgrep plugin), or reintroduce semgrep support/aliasing in the CLI.

			name: "should return supported tools",
			expectedTools: []string{
				"eslint",
				"pmd",
				"pylint",
				"trivy",
				"dartanalyzer",
				"opengrep",
				"semgrep",
				"lizard",
				"codacy-enigma-cli",
				"revive",
			},

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

.codacy/codacy.yaml

Copilot · 2026-03-11T12:27:07Z

tools/semgrepRunner.go

 	if err := cmd.Run(); err != nil {
-		// Semgrep returns non-zero exit code when it finds issues, which is expected
+		// Opengrep returns non-zero exit code when it finds issues, which is expected
 		if _, ok := err.(*exec.ExitError); !ok {
-			return fmt.Errorf("failed to run semgrep: %w", err)
+			return fmt.Errorf("failed to run opengrep: %w", err)
 		}


cmd.Run() errors are only treated as fatal when they are not an *exec.ExitError. This means any non-zero exit code from opengrep (including genuine runtime/config failures) is silently ignored, even though the comment says only findings are expected. Consider checking the exit code (e.g., accept only the “findings” code, and treat other non-zero codes as errors) so opengrep execution failures don’t get swallowed.

Copilot · 2026-03-11T12:27:08Z

cmd/analyze.go

+	case "opengrep":
 		binaryPath := tool.Binaries[toolName]
-		return tools.RunSemgrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)
+		return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)


GetSupportedTools() will still report semgrep as supported because plugins/tools/semgrep/plugin.yaml is still embedded, but runToolByName no longer has a case "semgrep". This leads to a confusing flow where validateToolName("semgrep") succeeds and then execution fails with “unsupported tool: semgrep”. Either keep a semgrep case (possibly delegating to opengrep for backwards compatibility) or remove/stop embedding the semgrep plugin so it’s not advertised as supported.

Suggested change

return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)

return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)

case "semgrep":

// Backwards compatibility: delegate semgrep to opengrep if available,

// otherwise fall back to a semgrep binary if defined.

binaryPath, ok := tool.Binaries["opengrep"]

if !ok {

binaryPath = tool.Binaries["semgrep"]

}

return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)

Copilot · 2026-03-11T12:27:08Z

plugins/tools/opengrep/embedded/opengrep.go

+import semgrepEmbedded "codacy/cli-v2/plugins/tools/semgrep/embedded"
+
+// GetOpengrepRules returns the embedded Opengrep rules.
+// Opengrep is compatible with the semgrep rule format, so the same rules are used.
+func GetOpengrepRules() []byte {
+	return semgrepEmbedded.GetSemgrepRules()


plugins/tools/opengrep/embedded currently imports plugins/tools/semgrep/embedded and re-exports its rules. If the intent is to replace semgrep, this creates an unnecessary coupling (and makes removing the semgrep plugin/rules impossible later). Consider moving rules.yaml to a shared location (or embedding a copy under opengrep) so opengrep doesn’t depend on the semgrep package.

Suggested change

import semgrepEmbedded "codacy/cli-v2/plugins/tools/semgrep/embedded"

// GetOpengrepRules returns the embedded Opengrep rules.

// Opengrep is compatible with the semgrep rule format, so the same rules are used.

func GetOpengrepRules() []byte {

return semgrepEmbedded.GetSemgrepRules()

import "embed"

//go:embed rules.yaml

var opengrepRules []byte

// GetOpengrepRules returns the embedded Opengrep rules.

// Opengrep is compatible with the semgrep rule format, so the same rules are used.

func GetOpengrepRules() []byte {

return opengrepRules

Copilot · 2026-03-11T12:27:08Z

plugins/tools/opengrep/test/src/test_file.py

+def unsafe_command_execution():
+    """Function with unsafe command execution"""
+    user_input = "ls -la"
+    os.system(user_input)  # opengrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true


The inline expectation comment for os.system(...) references subprocess-shell-true, but the provided tool config includes a dedicated python.lang.security.audit.os-system.os-system rule for os.system(...) (and semgrep’s expected SARIF uses that ruleId). Update the comment to the correct rule id to avoid misleading test fixtures / SARIF snippets.

Suggested change

os.system(user_input) # opengrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true

os.system(user_input) # opengrep: python.lang.security.audit.os-system.os-system

Copilot · 2026-03-11T12:27:08Z

domain/initFlags.go

 	ApiToken     string
 	Provider     string
 	Organization string
 	Repository   string
+	ProjectToken string
 }


InitFlags now includes ProjectToken, but cmdutils.AddCloudFlags (used by init/analyze) only binds ApiToken, Provider, Organization, and Repository. As-is, initFlags.ProjectToken will always stay empty for those commands. Add a --project-token flag binding (or a dedicated flag helper) and ensure downstream code paths use it consistently.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

plugins/tool-utils_test.go:176

The supported-tools test still expects semgrep to be present, but the CLI execution path no longer supports running semgrep (no switch case in runToolByName). Please align this test with the actual supported/runnable tool set (either remove semgrep here if it’s being replaced, or restore semgrep handling in the CLI).

			expectedTools: []string{
				"eslint",
				"pmd",
				"pylint",
				"trivy",
				"dartanalyzer",
				"opengrep",
				"semgrep",
				"lizard",
				"codacy-enigma-cli",
				"revive",

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-11T12:40:51Z

plugins/tools/opengrep/test/src/.codacy/codacy.yaml

+tools:
+    - opengrep@1.16.2


There’s a new tool test fixture for opengrep, but there is no corresponding plugins/tools/opengrep/test/expected.sarif. The run-tool-tests.sh harness expects that file for each tool and will fail without it. Add an expected SARIF output for this fixture (or update the harness/CI configuration if opengrep tool tests aren’t meant to run yet).

Suggested change

tools:

- opengrep@1.16.2

tools: []

Copilot · 2026-03-11T12:40:51Z

cmd/configsetup/tool_creators.go

+	configData, err := tools.GetOpengrepConfig(patterns)
 	if err != nil {
-		return fmt.Errorf("failed to create Semgrep config: %v", err)
+		return fmt.Errorf("failed to create Opengrep config: %v", err)


This error wrap uses %v, which loses the underlying error for callers that want to unwrap/inspect it. Use %w when returning the error so it can be unwrapped (consistent with other error returns in this file).

Suggested change

return fmt.Errorf("failed to create Opengrep config: %v", err)

return fmt.Errorf("failed to create Opengrep config: %w", err)

Copilot

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-11T12:58:14Z

plugins/tools/opengrep/plugin.yaml

+name: opengrep
+description: Opengrep is an open-source static analysis tool and community fork of Semgrep for finding bugs and enforcing code standards.
+default_version: 1.16.2
+download:
+  url_template: "https://github.com/opengrep/opengrep/releases/download/v{{.Version}}/opengrep_{{.OS}}_{{.Arch}}{{.Extension}}"


The tool test harness (run-tool-tests.sh, invoked by integration-tests/test-tools.sh) expects every tool with plugins/tools/<tool>/test/src to also provide plugins/tools/<tool>/test/expected.sarif. The new plugins/tools/opengrep/test/ directory currently has no expected.sarif, so the opengrep tool tests will fail when the script tries to sort/compare the expected output. Add an expected.sarif fixture for opengrep (and ensure its driver name/version match opengrep output).

Copilot · 2026-03-11T12:58:15Z

tools/semgrepRunner.go

+// RunOpengrep executes Opengrep analysis on the specified directory
+func RunOpengrep(workDirectory string, binary string, files []string, outputFile string, outputFormat string) error {
 	cmdArgs := []string{"scan"}


This file is still named semgrepRunner.go but it now contains the Opengrep runner (RunOpengrep). Renaming the file to opengrepRunner.go (and similarly for other semgrep-* files that now implement Opengrep behavior) would keep the tools/ package consistent and make it easier to find the right implementation via filename search.

Copilot · 2026-03-11T12:58:15Z

tools/semgrepConfigCreator.go

+// opengrepRulesFile represents the structure of the rules.yaml file
+type opengrepRulesFile struct {
 	Rules []map[string]interface{} `yaml:"rules"`
 }



This file is still named semgrepConfigCreator.go, but it now defines Opengrep-specific types/functions (e.g., opengrepRulesFile, GetOpengrepConfig). Renaming the file to opengrepConfigCreator.go would reduce confusion and keep filenames aligned with their contents.

Copilot

Pull request overview

Copilot reviewed 31 out of 33 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

plugins/tools/opengrep/test/src/.codacy/codacy.yaml:4

opengrep is a download-based tool and does not require a Python runtime, but this test fixture config declares python@3.11.11. Removing the unnecessary runtime dependency will speed up cli-v2 install during tool tests and reduce the chance of runtime-install related failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-11T14:58:12Z

plugins/tools/opengrep/plugin.yaml

+name: opengrep
+description: Opengrep is an open-source static analysis tool and community fork of Semgrep for finding bugs and enforcing code standards.
+default_version: 1.16.2


The opengrep tool test fixture directory does not include an expected.sarif file. run-tool-tests.sh expects plugins/tools/<tool>/test/expected.sarif to exist and will fail for opengrep without it. Add the expected SARIF output for the opengrep test (or adjust the tool test setup so it doesn’t require this file).

Copilot · 2026-03-11T14:58:13Z

config/tools-installer.go

+	} else {
+		// Bare binary — copy directly to the binary destination path
+		logger.Debug("Installing bare binary", logrus.Fields{
+			"tool":         toolInfo.Name,
+			"version":      toolInfo.Version,
+			"downloadPath": downloadPath,
+		})
+		if err = installBareBinary(downloadPath, toolInfo); err != nil {
+			return fmt.Errorf("failed to install binary: %w", err)


In the bare-binary branch, the previously opened file handle is unused (and installBareBinary re-opens the same path). Consider only opening the downloaded file inside the archive-extraction branch, or change installBareBinary to accept an io.Reader/already-open *os.File to avoid redundant opens and simplify control flow.

Copilot · 2026-03-11T14:58:13Z

config/tools-installer.go

+	for _, p := range toolInfo.Binaries {
+		destPath = p
+		break
+	}


installBareBinary picks the destination by taking the first value from the toolInfo.Binaries map. Map iteration order is non-deterministic, so this can select the wrong destination if a tool ever declares multiple binaries. Consider selecting a specific key (e.g., toolInfo.Binaries[toolInfo.Name]) or explicitly erroring unless exactly one binary destination is defined.

Suggested change

for _, p := range toolInfo.Binaries {

destPath = p

break

}

// Prefer a binary whose key matches the tool name, if present.

if p, ok := toolInfo.Binaries[toolInfo.Name]; ok && p != "" {

destPath = p

} else {

// Fallback: if there is exactly one binary entry, use that.

switch len(toolInfo.Binaries) {

case 0:

// Handled below as "no binary destination defined".

case 1:

for _, p := range toolInfo.Binaries {

destPath = p

break

}

default:

return fmt.Errorf("multiple binary destinations defined for tool %s and none matches its name", toolInfo.Name)

}

}

Copilot

Pull request overview

Copilot reviewed 34 out of 36 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

plugins/tools/opengrep/test/src/.codacy/codacy.yaml:4

The tool-test harness (run-tool-tests.sh) expects an expected.sarif at plugins/tools/<tool>/test/expected.sarif. The new opengrep tool has a test/src directory but no test/expected.sarif, so tool tests will fail when they reach sort_sarif "$EXPECTED_SARIF" .... Add an expected.sarif for opengrep (or adjust the harness to skip tools without one).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-11T15:45:29Z

config/tools-installer.go

+	if err := os.MkdirAll(filepath.Dir(destPath), constants.DefaultDirPerms); err != nil {
+		return fmt.Errorf("failed to create binary directory: %w", err)
+	}


destPath comes from toolInfo.Binaries, which is built using path.Join (forward slashes). Using filepath.Dir(destPath)/os.Create(destPath) here can produce inconsistent results on Windows when paths contain mixed separators. Consider normalizing destPath with filepath.FromSlash/filepath.Clean (or constructing binary paths with filepath.Join consistently) before creating directories/files.

Copilot

Pull request overview

Copilot reviewed 35 out of 37 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-11T16:15:33Z

cmd/analyze.go

 var simpleToolAliases = map[string]string{
 	"lizard":  "Lizard",
-	"semgrep": "Semgrep",
+	"opengrep": "Opengrep",
 	"pylint":  "pylintpython3",
 	"trivy":   "Trivy",
 }


getToolName now has an explicit alias for Opengrep, but TestGetToolName doesn't include any cases for opengrep (or the SARIF driver variant like "opengrep oss"). Adding test cases here would help prevent regressions in SARIF upload/analyze flows that rely on this mapping.

Copilot · 2026-03-11T16:15:33Z

cmd/analyze.go

 var simpleToolAliases = map[string]string{
 	"lizard":  "Lizard",
-	"semgrep": "Semgrep",
+	"opengrep": "Opengrep",
 	"pylint":  "pylintpython3",


getToolName is called with strings.ToLower(run.Tool.Driver.Name) when processing SARIF uploads, but Opengrep's SARIF driver name is typically "Opengrep OSS". With the current alias map, "opengrep oss" won't be normalized to "Opengrep", so loadsToolAndPatterns won't find the tool and uploads can silently contain no issues. Consider normalizing SARIF tool names (e.g., strip a trailing " oss" / take the first token) or adding an explicit alias for "opengrep oss" -> "Opengrep".

Copilot · 2026-03-11T16:15:33Z

config/tools-installer.go

 	// Open the downloaded file
 	file, err := os.Open(downloadPath)
 	if err != nil {
 		return fmt.Errorf("failed to open downloaded file: %w", err)
 	}
 	defer file.Close()

 	// Create the installation directory
 	err = os.MkdirAll(toolInfo.InstallDir, constants.DefaultDirPerms)
 	if err != nil {
 		return fmt.Errorf("failed to create installation directory: %w", err)
 	}

-	// Extract based on file extension
-	logger.Debug("Extracting tool", logrus.Fields{
-		"tool":             toolInfo.Name,
-		"version":          toolInfo.Version,
-		"fileName":         fileName,
-		"extractDirectory": toolInfo.InstallDir,
-	})
+	isArchive := strings.HasSuffix(fileName, ".zip") || strings.HasSuffix(fileName, ".tar.gz") || strings.HasSuffix(fileName, ".tgz")

-	if strings.HasSuffix(fileName, ".zip") {
-		err = utils.ExtractZip(file.Name(), toolInfo.InstallDir)
-	} else {
-		err = utils.ExtractTarGz(file, toolInfo.InstallDir)
-	}
+	if isArchive {


installDownloadBasedTool opens the downloaded file before checking whether it's an archive, but the file handle isn't used in the bare-binary branch (it gets reopened in installBareBinary). Consider moving os.Open(downloadPath) inside the isArchive branch (or passing the already-open file into installBareBinary) to avoid redundant I/O and simplify control flow.

Copilot · 2026-03-11T16:15:34Z

tools/semgrepRunner.go

+// RunOpengrep executes Opengrep analysis on the specified directory
+func RunOpengrep(workDirectory string, binary string, files []string, outputFile string, outputFormat string) error {
 	cmdArgs := []string{"scan"}


The file is still named semgrepRunner.go but now only exposes RunOpengrep. Renaming the file to opengrepRunner.go would keep filenames aligned with the tool name and make future navigation/searching less confusing.

Copilot AI review requested due to automatic review settings March 11, 2026 10:05

Copilot started reviewing on behalf of heliocodacy March 11, 2026 10:06 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

machadoit reviewed Mar 11, 2026

View reviewed changes

heliocodacy force-pushed the semgrep-to-opengrep branch from 34119bb to e3ae014 Compare March 11, 2026 12:01

Copilot AI review requested due to automatic review settings March 11, 2026 12:19

heliocodacy force-pushed the semgrep-to-opengrep branch from e3ae014 to c3ba379 Compare March 11, 2026 12:19

Copilot started reviewing on behalf of heliocodacy March 11, 2026 12:20 View session

heliocodacy force-pushed the semgrep-to-opengrep branch from c3ba379 to f3bc8af Compare March 11, 2026 12:24

Copilot AI reviewed Mar 11, 2026

View reviewed changes

heliocodacy force-pushed the semgrep-to-opengrep branch from f3bc8af to 9cb9979 Compare March 11, 2026 12:28

Copilot AI review requested due to automatic review settings March 11, 2026 12:35

heliocodacy force-pushed the semgrep-to-opengrep branch from 9cb9979 to 6071d96 Compare March 11, 2026 12:35

Copilot started reviewing on behalf of heliocodacy March 11, 2026 12:35 View session

heliocodacy force-pushed the semgrep-to-opengrep branch from 6071d96 to 9a84502 Compare March 11, 2026 12:39

Copilot AI reviewed Mar 11, 2026

View reviewed changes

heliocodacy force-pushed the semgrep-to-opengrep branch from 9a84502 to 6819686 Compare March 11, 2026 12:47

Copilot AI review requested due to automatic review settings March 11, 2026 12:51

heliocodacy force-pushed the semgrep-to-opengrep branch from 6819686 to 049d073 Compare March 11, 2026 12:51

Copilot started reviewing on behalf of heliocodacy March 11, 2026 12:51 View session

heliocodacy force-pushed the semgrep-to-opengrep branch from 049d073 to fd91eb1 Compare March 11, 2026 12:52

Copilot AI reviewed Mar 11, 2026

View reviewed changes

heliocodacy force-pushed the semgrep-to-opengrep branch from fd91eb1 to 508e842 Compare March 11, 2026 14:41

Copilot AI review requested due to automatic review settings March 11, 2026 14:45

heliocodacy force-pushed the semgrep-to-opengrep branch from 508e842 to 989ed12 Compare March 11, 2026 14:45

Copilot started reviewing on behalf of heliocodacy March 11, 2026 14:46 View session

heliocodacy force-pushed the semgrep-to-opengrep branch 2 times, most recently from 6786ff9 to c592bde Compare March 11, 2026 14:50

heliocodacy force-pushed the semgrep-to-opengrep branch from c592bde to 4e95db3 Compare March 11, 2026 14:54

Copilot AI reviewed Mar 11, 2026

View reviewed changes

heliocodacy force-pushed the semgrep-to-opengrep branch from 4e95db3 to 5e1d35c Compare March 11, 2026 15:34

Copilot AI review requested due to automatic review settings March 11, 2026 15:38

heliocodacy force-pushed the semgrep-to-opengrep branch from 5e1d35c to b536581 Compare March 11, 2026 15:38

Copilot started reviewing on behalf of heliocodacy March 11, 2026 15:38 View session

heliocodacy force-pushed the semgrep-to-opengrep branch from b536581 to 8bc8dff Compare March 11, 2026 15:43

Copilot AI reviewed Mar 11, 2026

View reviewed changes

heliocodacy force-pushed the semgrep-to-opengrep branch from 8bc8dff to 1320dac Compare March 11, 2026 15:50

Copilot AI review requested due to automatic review settings March 11, 2026 16:07

heliocodacy force-pushed the semgrep-to-opengrep branch from 1320dac to a3b6ac0 Compare March 11, 2026 16:07

Copilot started reviewing on behalf of heliocodacy March 11, 2026 16:08 View session

heliocodacy force-pushed the semgrep-to-opengrep branch from a3b6ac0 to 6f497d5 Compare March 11, 2026 16:10

replace semgrep with opengrep

03e501f

heliocodacy force-pushed the semgrep-to-opengrep branch from 6f497d5 to 03e501f Compare March 11, 2026 16:13

Copilot AI reviewed Mar 11, 2026

View reviewed changes

heliocodacy enabled auto-merge (squash) March 11, 2026 17:22

-		return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)
+		return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)
+	case "semgrep":
+		// Backwards compatibility: delegate semgrep to opengrep if available,
+		// otherwise fall back to a semgrep binary if defined.
+		binaryPath, ok := tool.Binaries["opengrep"]
+		if !ok {
+			binaryPath = tool.Binaries["semgrep"]
+		}
+		return tools.RunOpengrep(workDirectory, binaryPath, pathsToCheck, outputFile, outputFormat)

	os.system(user_input) # opengrep: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true
	os.system(user_input) # opengrep: python.lang.security.audit.os-system.os-system

	return fmt.Errorf("failed to create Opengrep config: %v", err)
	return fmt.Errorf("failed to create Opengrep config: %w", err)

-	for _, p := range toolInfo.Binaries {
-		destPath = p
-		break
-	}
+	// Prefer a binary whose key matches the tool name, if present.
+	if p, ok := toolInfo.Binaries[toolInfo.Name]; ok && p != "" {
+		destPath = p
+	} else {
+		// Fallback: if there is exactly one binary entry, use that.
+		switch len(toolInfo.Binaries) {
+		case 0:
+			// Handled below as "no binary destination defined".
+		case 1:
+			for _, p := range toolInfo.Binaries {
+				destPath = p
+				break
+			}
+		default:
+			return fmt.Errorf("multiple binary destinations defined for tool %s and none matches its name", toolInfo.Name)
+		}
+	}

Conversation

heliocodacy commented Mar 11, 2026

Uh oh!

codacy-production bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

Uh oh!

codacy-production bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codacy's Analysis Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

machadoit left a comment

Choose a reason for hiding this comment

Uh oh!

machadoit Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

codacy-production bot commented Mar 11, 2026 •

edited

Loading

codacy-production bot commented Mar 11, 2026 •

edited

Loading