feat(sarif reporter): add SARIF reporter for jscpd

apps/jscpd/README.md

@@ -92,9 +92,9 @@ Minimal block size of code in tokens. The block of code less than `min-tokens` w
  - Cli options: `--min-tokens`, `-k`
  - Type: **number**
  - Default: **50**
- 
+
  *This option is called ``minTokens`` in the config file.*
- 
+
 ### Min Lines
 
 Minimal block size of code in lines. The block of code less than `min-lines` will be skipped.
@@ -151,6 +151,7 @@ Available reporters:
  - **csv** - output `jscpd-report.csv` file with clones report in csv format;
  - **markdown** - output `jscpd-report.md` file with clones report in markdown format;
  - **html** - generate html report to `html/` folder;
+ - **sarif** - generate a report in SARIF format (https://github.com/oasis-tcs/sarif-spec), save it to `jscpd-sarif.json` file;
  - **verbose** - output a lot of debug information to console;
 
 > Note: A reporter can be developed manually, see [@jscpd/finder](../finder) package.

apps/jscpd/package.json

@@ -36,6 +36,7 @@
     "@jscpd/core": "workspace:*",
     "@jscpd/finder": "workspace:*",
     "@jscpd/html-reporter": "workspace:*",
+    "@jscpd/sarif-reporter": "workspace:*",
     "@jscpd/tokenizer": "workspace:*",
     "colors": "^1.4.0",
     "commander": "^5.0.0",

apps/jscpd/src/init/reporters.ts

@@ -13,6 +13,7 @@ import {
 import {IOptions} from '@jscpd/core';
 import {grey, yellow} from 'colors/safe';
 import HtmlReporter from "@jscpd/html-reporter";
+import SarifReporter from "@jscpd/sarif-reporter";
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const reporters: Record<string, any> = {
@@ -26,6 +27,7 @@ const reporters: Record<string, any> = {
   silent: SilentReporter,
   threshold: ThresholdReporter,
   xcode: XcodeReporter,
+  sarif: SarifReporter,
 }
 
 export function registerReporters(options: IOptions, detector: InFilesDetector): void {

package.json

@@ -6,6 +6,7 @@
   "version": "4.0.0-rc.0",
   "scripts": {
     "build": "turbo run build",
+    "commit": "cz",
     "generate": "turbo run generate",
     "dev": "turbo run dev --parallel",
     "lint": "turbo run lint",
@@ -16,8 +17,15 @@
     "publish-packages": "changeset version && changeset publish"
   },
   "devDependencies": {
-    "@changesets/cli": "^2.27.3",
+    "@changesets/cli": "^2.27.4",
+    "commitizen": "^4.3.0",
+    "cz-conventional-changelog": "^3.3.0",
     "turbo": "^1.13.3"
   },
+  "config": {
+    "commitizen": {
+      "path": "cz-conventional-changelog"
+    }
+  },
   "readmeFilename": "README.md"
 }

packages/sarif-reporter/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2013-2024 Andrey Kucherenko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/sarif-reporter/README.md

@@ -0,0 +1,22 @@
+# `@jscpd/sarif-reporter`
+
+> The sarif reporter for [jscpd](https://github.com/kucherenko/jscpd).
+
+Generate report in sarif format for jscpd.
+
+## Getting started
+
+### Install
+
+```bash
+npm install @jscpd/sarif-reporter
+```
+
+### Usage
+
+```bash
+jscpd [...options] --reporters sarif /path/to/source
+```
+
+
+[MIT](LICENSE) © Andrey Kucherenko

packages/sarif-reporter/nodemon.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json.schemastore.org/nodemon.json",
+  "watch": ["./src/**"],
+  "ignoreRoot": [],
+  "ext": "ts,js",
+  "exec": "pnpm build"
+}

packages/sarif-reporter/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@jscpd/sarif-reporter",
+  "version": "4.0.1",
+  "description": "Reporter for jscpd. Generate a report in SARIF format (https://github.com/oasis-tcs/sarif-spec).",
+  "keywords": [
+    "jscpd",
+    "cpd",
+    "reporter",
+    "jscpd-reporter",
+    "sarif"
+  ],
+  "author": "Andrey Kucherenko <[email protected]>",
+  "homepage": "https://github.com/kucherenko/jscpd#readme",
+  "license": "MIT",
+  "main": "dist/index.js",
+  "module": "dist/index.mjs",
+  "typings": "dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    },
+    "./README.md": "./README.md"
+  },
+  "scripts": {
+    "build": "tsup-node --dts",
+    "dev": "nodemon",
+    "test:dev": "vitest",
+    "typecheck": "tsc",
+    "cleanup": "rimraf ./dist .turbo"
+  },
+  "directories": {
+    "src": "src",
+    "test": "__tests__"
+  },
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://[email protected]/kucherenko/jscpd.git"
+  },
+  "bugs": {
+    "url": "https://github.com/kucherenko/jscpd/issues"
+  },
+  "dependencies": {
+    "colors": "^1.4.0",
+    "fs-extra": "^11.2.0",
+    "node-sarif-builder": "^2.0.3"
+  },
+  "devDependencies": {
+    "@jscpd/core": "workspace:*",
+    "@jscpd/finder": "workspace:*",
+    "@jscpd/tsconfig": "workspace:*",
+    "@types/fs-extra": "^11.0.4",
+    "@types/node": "^20.12.12",
+    "nodemon": "^3.1.0",
+    "tsup": "^8.0.2",
+    "typescript": "^5.4.5",
+    "vitest": "^1.6.0"
+  }
+}

packages/sarif-reporter/src/index.ts

@@ -0,0 +1,88 @@
+import type {IClone, IOptions, IStatistic, ITokenLocation} from '@jscpd/core';
+import type {IReporter} from "@jscpd/finder";
+import {join} from 'path';
+import {ensureDirSync, readJsonSync, writeFileSync} from "fs-extra";
+import {green} from "colors/safe";
+import {SarifBuilder, SarifResultBuilder, SarifRuleBuilder, SarifRunBuilder} from "node-sarif-builder";
+
+
+function getSourceLocation(start: ITokenLocation, end: ITokenLocation): string {
+  return `${start.line}:${start.column} - ${end.line}:${end.column}`;
+}
+
+export default class SarifReporter implements IReporter {
+  constructor(private options: IOptions) {
+  }
+
+  public report(clones: IClone[], statistic: IStatistic): void {
+    const url = "https://github.com/kucherenko/jscpd/";
+    if (this.options.output) {
+      const pkg = readJsonSync(join(__dirname, '../package.json'))
+      // SARIF builder
+      const sarifBuilder = new SarifBuilder();
+      // SARIF Run builder
+      const sarifRunBuilder = new SarifRunBuilder().initSimple({
+        toolDriverName: "jscpd",
+        toolDriverVersion: pkg.version,
+        url
+      });
+
+      sarifRunBuilder.addRule(
+        new SarifRuleBuilder().initSimple({
+          ruleId: 'duplication',
+          shortDescriptionText: 'Found code duplication',
+          helpUri: url
+        })
+      )
+
+      sarifRunBuilder.addRule(
+        new SarifRuleBuilder().initSimple({
+          ruleId: 'duplications-threshold',
+          shortDescriptionText: 'Level of duplication is too high',
+          helpUri: url
+        })
+      )
+
+
+      for (const clone of clones) { // issues from your linter in any format
+        const sarifResultBuilder = new SarifResultBuilder();
+        // Init sarifResultBuilder
+        sarifRunBuilder.addResult(
+          sarifResultBuilder.initSimple(
+            {
+              // Transcode to a SARIF level:  can be "warning" or "error" or "note"
+              level: "warning",
+              messageText: `Clone detected in ${clone.format}, - ${clone.duplicationA.sourceId}[${getSourceLocation(clone.duplicationA.start, clone.duplicationA.end)}] and ${clone.duplicationB.sourceId}[${getSourceLocation(clone.duplicationB.start, clone.duplicationB.end)}]`,
+              ruleId: 'duplication',
+              fileUri: clone.duplicationA.sourceId,
+              startLine: clone.duplicationA.start.line,
+              startColumn: clone.duplicationA.start.column,
+              endLine: clone.duplicationA.end.line,
+              endColumn: clone.duplicationA.end.column
+            }
+          )
+        )
+      }
+
+      if (statistic.total?.percentage >= (this.options.threshold || 100)) {
+        const sarifResultBuilderThreshold = new SarifResultBuilder();
+        sarifRunBuilder.addResult(
+          sarifResultBuilderThreshold.initSimple({
+            level: 'error',
+            messageText: `The duplication level (${statistic.total.percentage}%) is bigger than threshold (${this.options.threshold}%)`,
+            ruleId: "duplications-threshold",
+          })
+        )
+      }
+
+      const path = join(this.options.output, 'jscpd-sarif.json');
+
+      sarifBuilder.addRun(sarifRunBuilder);
+      const sarifJsonString = sarifBuilder.buildSarifJsonString({ indent: false });
+      ensureDirSync(this.options.output);
+      writeFileSync(path, sarifJsonString);
+
+      console.log(green(`SARIF report saved to ${path}`));
+    }
+  }
+}

packages/sarif-reporter/tsconfig.build.json

@@ -0,0 +1,11 @@
+{
+  "extends": "../tsconfig.build.json",
+
+  "compilerOptions": {
+    "outDir": "./dist"
+  },
+
+  "include": [
+    "src/**/*"
+  ]
+}

packages/sarif-reporter/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "@jscpd/tsconfig/pkg.json",
+  "compilerOptions": {
+    "outDir": "build",
+    "baseUrl": "."
+  },
+  "include": ["src"],
+  "exclude": ["dist", "bundle", "node_modules"]
+}

packages/sarif-reporter/tsup.config.ts

@@ -0,0 +1,10 @@
+import {defineConfig} from 'tsup'
+
+export default defineConfig({
+  entry: ['src/index.ts'],
+  splitting: false,
+  sourcemap: true,
+  clean: true,
+  format: ['esm', 'cjs'],
+  shims: true,
+})