@codacy/tools-brakeman-4

Table of Contents

• Overview
• Updating patterns
• Updating the Brakeman version
• Development
• Notes for maintainers

Overview

Ruby on Rails security scanner using the Brakeman gem. Uses the CLI execution strategy -- spawns brakeman -f json via spawnTool() and parses its JSON output.

Updating patterns

pnpm prefetch
git add src/patterns.json

Pattern IDs are bare check names (no prefix): SQL, CrossSiteScripting, Execute, etc.

Updating the Brakeman version

1. Update BRAKEMAN_VERSION in src/adapter.ts
2. Run pnpm prefetch to check for new/removed checks
3. Run pnpm test to verify compatibility
4. If the major version changes, create a new adapter package (brakeman-5/)

Development

pnpm build    # Build with tsup
pnpm test     # Run tests (requires ruby + brakeman in PATH for integration tests)

To install brakeman locally for testing:

gem install brakeman -v 4.3.1

Notes for maintainers

• Brakeman is Rails-only. The adapter checks for config/environment.rb before running and returns empty results (not an error) for non-Rails projects.
• Whole-project scanning: Brakeman cannot target individual files. It scans the entire Rails app via -p <path>. Results are filtered by ctx.targetFiles after parsing.
• --no-exit-on-warn --no-exit-on-error ensures Brakeman always produces JSON output.
• -q suppresses informational messages so stdout contains only JSON.
• Pattern IDs match check_name from Brakeman's JSON output (not warning_code).
• Brakeman's confidence field (High/Medium/Weak) is mapped to Issue.confidence (1/2/3).
• The errors array in Brakeman's output contains parse errors (files Brakeman couldn't read), mapped to AnalysisError warnings.
• Config file detection supports config/brakeman.ignore (warning suppression file) and config/brakeman.yml.