@codacy/tools-bandit-1

Table of Contents

• Overview
• Updating patterns
• Updating the Bandit version
• Development
• Notes for maintainers

Overview

Python security linter using the Bandit binary. Uses the CLI execution strategy -- spawns bandit from a managed Python venv via spawnTool() and parses its JSON output.

| Property | Value | |----------|-------| | Tool ID | Bandit | | Codacy UUID | 89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738 | | Strategy | CLI | | Languages | Python | | Binary | bandit (pip-installed in venv) | | File patterns | **/*.py |

Updating patterns

# Re-fetch pattern metadata from the Codacy API
pnpm prefetch

# Commit the result
git add src/patterns.json

Pattern IDs follow the format Bandit_B602, Bandit_B301, etc.

Updating the Bandit version

1. Update preferredVersion in src/adapter.ts
2. Update the PIP_PACKAGES array with the new pinned version
3. Run pnpm prefetch to check for new/removed rules
4. Run pnpm test to verify compatibility
5. If the major version changes, create a new adapter package (bandit-2/)

Development

pnpm build    # Build with tsup
pnpm test     # Run tests (requires bandit in PATH or venv)

To install bandit locally for testing:

pip install bandit==1.8.3

Notes for maintainers

• Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at ~/.codacy/runtimes/bandit-1/venv/.
• Exit code 0 = no findings, 1 = findings found (normal), >1 = error.
• col_offset in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.
• Bandit's issue_confidence (LOW/MEDIUM/HIGH) maps to numeric confidence (1/2/3) on the Issue.
• CWE information from issue_cwe is appended to the issue message as (CWE-{id}).
• Config file detection supports .bandit (INI, passed with --ini), bandit.yml (YAML, passed with -c), and pyproject.toml (TOML, passed with -c).
• Pattern filtering uses the -t flag to pass comma-separated test IDs to bandit.
• The errors array in bandit's JSON output (file-level errors like syntax errors) is mapped to AnalysisError objects with level "warning".