Disable pattern CF-2151 by inesgomas · Pull Request #185 · codacy/codacy-vscode-extension

inesgomas · 2026-01-27T14:07:14Z

codacy-production · 2026-01-27T14:08:44Z

Codacy's Analysis Summary

0 new issue (≤ 1 medium issue)
0 new security issue (≤ 0 issue)
7 complexity
0 duplications

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.

Copilot

Pull request overview

This pull request implements a feature to disable Codacy patterns directly from the IDE. The feature adds a "Disable pattern" quick fix action for Codacy diagnostics, with permission checking and support for both direct pattern disabling and guidance for patterns in coding standards.

Changes:

Added permission checking logic to verify user access for pattern configuration
Implemented UI flow for disabling patterns, including webview panel for standards-based patterns
Integrated the feature into VS Code's quick fix system via CodeActionProvider
Added setup completion tracking to gate the feature

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/views/hasPermissions.ts	New utility function to check if users have required permissions based on organization settings and repository access
src/views/PatternInStandardView.ts	New webview panel implementation to guide users through disabling patterns in coding standards
src/views/SetupView.ts	Added module-level state tracking for setup completion count
src/views/ProblemsDiagnosticCollection.ts	Updated code action provider to include disable pattern option and prefixed action titles with "Codacy:"
src/views/IssueDetailsProvider.ts	Implemented main command handler for disabling patterns with permission checks and API integration
src/extension.ts	Registered new disable pattern command and updated IssueActionProvider with repository params
package.json	Added command definition for disable pattern feature
media/styles/pattern-in-standard.css	Styling for the pattern-in-standard webview panel
media/scripts/patternInStandardScript.js	Client-side JavaScript for webview interactions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/views/hasPermissions.ts

src/views/PatternInStandardView.ts

src/views/IssueDetailsProvider.ts

src/views/PatternInStandardView.ts

src/views/IssueDetailsProvider.ts

src/views/PatternInStandardView.ts

src/views/hasPermissions.ts

src/views/PatternInStandardView.ts

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/views/PatternInStandardView.ts

src/views/IssueDetailsProvider.ts

src/views/SetupView.ts

src/views/PatternInStandardView.ts

src/views/hasPermissions.ts

src/views/PatternInStandardView.ts

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 13 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/views/PatternInStandardView.ts

src/views/IssueDetailsProvider.ts

src/views/PatternInStandardView.ts

src/views/IssueDetailsProvider.ts

src/views/PatternInStandardView.ts

media/styles/pattern-in-standard.css

src/views/utils.ts

src/views/IssueDetailsProvider.ts

src/views/ProblemsDiagnosticCollection.ts

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/views/IssueDetailsProvider.ts

src/views/hasPermissions.ts

src/views/SetupView.ts

src/views/ProblemsDiagnosticCollection.ts

src/views/IssueDetailsProvider.ts

src/views/PatternInStandardView.ts

src/views/IssueDetailsProvider.ts

…-2151

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-09T10:08:24Z

src/views/IssueDetailsProvider.ts

+  const pendingCount = getCurrentPendingCount()
+
+  // If pendingCount is undefined, assume setup is not complete (safer default)
+  // If pendingCount > 0, setup is incomplete
+  if (pendingCount === undefined || pendingCount > 0) {
+    const action = await vscode.window.showInformationMessage(
+      'Complete your Codacy setup to disable patterns.',
+      'Complete setup'
+    )
+
+    if (action === 'Complete setup') {
+      await vscode.commands.executeCommand('workbench.view.extension.codacy-main')
+    }
+    return
+  }


disablePatternFn blocks when getCurrentPendingCount() is undefined, which happens whenever the Setup webview was never opened/resolved. This makes “Disable pattern” unusable even if the user is fully set up. Use a source of truth independent of the SetupView UI (e.g., CodacyCloud state / Config + params checks) or persist setup completion in context/state, instead of relying on a module-global value updated only by the webview.

Copilot · 2026-02-09T10:08:24Z

src/views/IssueDetailsProvider.ts

+export const disablePatternCommand = async (issue: CommitIssue, params: RepositoryParams, cli?: CodacyCli) => {
+  const props: DisablePatternProps = {
+    provider: params.provider,
+    organization: params.organization,
+    repository: params.repository,
+    toolUuid: issue.toolInfo.uuid,
+    patternId: issue.patternInfo.id,
+    commitSHA: issue.commitInfo?.sha,
+  }
+
+  await disablePatternFn(props, cli)
+}
+
+export const disableCliPatternCommand = async (
+  params: RepositoryParams,
+  issue?: ProcessedSarifResult,
+  cli?: CodacyCli
+) => {
+  const tools = await Api.Tools.listTools()
+  const toolUuid = tools.data.find((tool) => tool.name === issue?.tool)?.uuid
+
+  if (!issue || !issue.rule || !toolUuid) {
+    vscode.window.showErrorMessage('Unable to show issue details: missing tool or rule information.')
+    Logger.error('Unable to show issue details: missing tool or rule information.')
+    return
+  }
+
+  const props: DisablePatternProps = {
+    provider: params.provider,
+    organization: params.organization,
+    repository: params.repository,
+    toolUuid,
+    patternId: issue.rule.id,
+    // no commit SHA for CLI issues, we should simply re-initialize the CLI
+  }
+  await disablePatternFn(props, cli)
+}


These commands are contributed in package.json, so they can be invoked from the Command Palette without arguments. disablePatternCommand assumes issue and params are always provided and will throw if called directly. Make parameters optional and show a user-facing error when missing, and/or hide these commands from the command palette via a contributes.menus.commandPalette entry with when: "false".

src/views/utils.ts

src/views/IssueDetailsProvider.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-09T10:44:36Z

src/views/PatternInStandardView.ts

+    undefined,
+    []


onDidReceiveMessage is called with an empty disposables array ([]). This means the returned disposable isn’t retained anywhere, making the parameter ineffective and potentially leaking listeners. Either omit the third argument or store the returned disposable and dispose it when the panel is disposed.

Suggested change

undefined,

[]

undefined

Copilot · 2026-02-09T10:44:36Z

src/views/ProblemsDiagnosticCollection.ts

+  constructor(
+    private getParams?: () => { provider: string; organization: string; repository: string } | undefined,
+    private cli?: CodacyCli
+  ) {}


IssueActionProvider’s getParams callback is typed as { provider: string; organization: string; repository: string }, but the codebase already defines RepositoryParams (and provider is now typed as Provider). Reuse RepositoryParams here to keep types aligned and avoid accidentally passing invalid provider values.

Copilot · 2026-02-09T10:44:37Z

src/views/hasPermissions.ts

+export const hasPermission = async (
+  provider: string,
+  organization: string,
+  allowedByDefault: Permission,
+  repositoryPermission?: Permission
+) => {
+  let minimumPermission: Permission | undefined
+
+  try {
+    const { data: organizationData } = await Api.Organization.getOrganization(provider, organization)
+    minimumPermission = organizationData.analysisConfigurationMinimumPermission
+  } catch (error) {
+    // If we cannot retrieve the organization or its configuration, deny permission by default.
+    return false
+  }
+
+  if (!minimumPermission) return false
+
+  switch (repositoryPermission) {
+    case 'read':
+      return minimumPermission === 'read' || allowedByDefault === 'read'
+    case 'write': {
+      const writePermissions = ['read', 'write']
+      return writePermissions.includes(minimumPermission) || writePermissions.includes(allowedByDefault)
+    }
+    case 'admin': {
+      const adminPermissions = ['read', 'write', 'admin']
+      return adminPermissions.includes(minimumPermission) || adminPermissions.includes(allowedByDefault)
+    }


allowedByDefault is currently combined with the organization’s analysisConfigurationMinimumPermission using ||, which can allow callers to bypass the org minimum depending on what they pass (e.g., allowedByDefault='read' would grant access even if the org minimum is admin). Since this function already fetches a minimum permission and returns false when it’s missing, consider removing allowedByDefault entirely or only using it as a fallback when the org minimum cannot be retrieved (instead of OR-ing it with the org minimum).

Copilot · 2026-02-09T10:44:37Z

src/views/IssueDetailsProvider.ts

+export const disablePatternCommand = async (issue: CommitIssue, params: RepositoryParams, cli?: CodacyCli) => {
+  const props: DisablePatternProps = {
+    provider: params.provider,
+    organization: params.organization,
+    repository: params.repository,
+    toolUuid: issue.toolInfo.uuid,
+    patternId: issue.patternInfo.id,
+    commitSHA: issue.commitInfo?.sha,
+  }
+
+  await disablePatternFn(props, cli)
+}


This command is contributed in package.json, so it can be invoked from the Command Palette without arguments. The handler currently requires issue and params and will throw if invoked without them (e.g., issue.toolInfo access). Make the parameters optional and add a guard that shows a user-friendly message and returns when required arguments are missing.

Copilot · 2026-02-09T10:44:37Z

src/views/IssueDetailsProvider.ts

+export const disableCliPatternCommand = async (
+  params: RepositoryParams,
+  issue?: ProcessedSarifResult,
+  cli?: CodacyCli
+) => {
+  const tools = await Api.Tools.listTools()
+  const toolUuid = tools.data.find((tool) => tool.name === issue?.tool)?.uuid
+
+  if (!issue || !issue.rule || !toolUuid) {
+    vscode.window.showErrorMessage('Unable to disable pattern: missing tool or rule information.')
+    Logger.error('Unable to disable pattern: missing tool or rule information.')
+    return
+  }


This command is contributed in package.json, so it can be invoked without arguments from the Command Palette. params is required here and will cause a runtime exception when undefined. Consider making params optional and validating inputs (showing an error) before proceeding.

Copilot · 2026-02-09T10:44:37Z

src/views/utils.ts

+export function getNonce() {
+  let text = ''
+  const possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
+  for (let i = 0; i < 32; i++) {
+    text += possible.charAt(Math.floor(Math.random() * possible.length))
+  }
+  return text


getNonce() uses Math.random(), which is not suitable for CSP nonces and can be predictable. Use a cryptographically secure source (e.g., Node's crypto.randomBytes/crypto.randomUUID) to generate the nonce string.

Suggested change

export function getNonce() {

let text = ''

const possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'

for (let i = 0; i < 32; i++) {

text += possible.charAt(Math.floor(Math.random() * possible.length))

}

return text

import { randomBytes } from 'crypto';

export function getNonce() {

return randomBytes(16).toString('base64')

Copilot · 2026-02-09T10:44:37Z

src/views/PatternInStandardView.ts

+          <button class="copy-pattern-button" data-pattern-title="${escapedTitle}" aria-label="Copy pattern">
+            <svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" class="copy-icon" width="16" height="16" viewBox="0 0 512 512"><rect x="128" y="128" width="336" height="336" rx="57" ry="57" fill="none" stroke="currentColor" stroke-linejoin="round" stroke-width="32"/><path d="M383.5 128l.5-24a56.16 56.16 0 00-56-56H112a64.19 64.19 0 00-64 64v216a56.16 56.16 0 0056 56h24" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="32"/></svg>
+            Copy pattern: "${escapedTitle}"
+          </button>


The data-pattern-title attribute is populated with escapedTitle. HTML escaping is correct for rendering, but getAttribute('data-pattern-title') returns the escaped entity text (e.g. &), so the clipboard/message will contain entities instead of the original title. Store the raw title separately for copying (while still escaping for display/attributes), or decode entities before copying.

inesgomas added 4 commits January 23, 2026 14:56

fix: Distinguish Issue details from CLI

c77abee

feature: Create base scenarios for disable pattern CF-2151

c2e63c3

feature: Add webview for coding standards CF-2151

81f6875

clean: Isolate css and js in seperated files CF-2151

88890eb

Copilot AI review requested due to automatic review settings January 27, 2026 14:07

Copilot started reviewing on behalf of inesgomas January 27, 2026 14:07 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

inesgomas force-pushed the disable-pattern-CF-2151 branch from e950a85 to 2962164 Compare January 27, 2026 14:15

fix: Fix standard link CF-2151

02a935e

Copilot AI review requested due to automatic review settings January 27, 2026 14:19

inesgomas force-pushed the disable-pattern-CF-2151 branch from 2962164 to 02a935e Compare January 27, 2026 14:19

Copilot started reviewing on behalf of inesgomas January 27, 2026 14:20 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

inesgomas requested a review from claudiacodacy January 27, 2026 15:05

inesgomas commented Jan 27, 2026

View reviewed changes

src/views/PatternInStandardView.ts Outdated Show resolved Hide resolved

fix: Apply suggestions from copilot CF-2151

ff6bfa5

inesgomas force-pushed the disable-pattern-CF-2151 branch from 573d94c to ff6bfa5 Compare January 27, 2026 15:19

feature: Add refresh action CF-2151

b63bbae

Copilot AI review requested due to automatic review settings January 27, 2026 17:08

inesgomas marked this pull request as ready for review January 27, 2026 17:08

inesgomas requested a review from a team as a code owner January 27, 2026 17:08

Copilot started reviewing on behalf of inesgomas January 27, 2026 17:08 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

fix: Apply copilot suggestions CF-2151

0b311aa

nedaKaighobadi reviewed Jan 30, 2026

View reviewed changes

src/views/IssueDetailsProvider.ts Outdated Show resolved Hide resolved

nedaKaighobadi reviewed Jan 30, 2026

View reviewed changes

src/views/IssueDetailsProvider.ts Outdated Show resolved Hide resolved

nedaKaighobadi reviewed Jan 30, 2026

View reviewed changes

src/views/ProblemsDiagnosticCollection.ts Outdated Show resolved Hide resolved

Add disable for CLI CF-2151

33c0d56

Copilot AI review requested due to automatic review settings February 6, 2026 17:58

Copilot started reviewing on behalf of inesgomas February 6, 2026 17:59 View session

Copilot AI reviewed Feb 6, 2026

View reviewed changes

inesgomas added 2 commits February 6, 2026 18:26

fix: Use standards related to pattern instead of all standards CF-2151

e6a75b3

fix: Add pattern title to action to be able to distinguish actions CF…

2f13a88

…-2151

inesgomas requested a review from nedaKaighobadi February 6, 2026 19:35

nitpick

b7b9ae4

Copilot AI review requested due to automatic review settings February 9, 2026 10:02

Copilot started reviewing on behalf of inesgomas February 9, 2026 10:02 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

Update src/views/IssueDetailsProvider.ts

f1a9a54

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings February 9, 2026 10:38

Copilot started reviewing on behalf of inesgomas February 9, 2026 10:38 View session

Copilot AI reviewed Feb 9, 2026

View reviewed changes

nedaKaighobadi approved these changes Feb 9, 2026

View reviewed changes

inesgomas merged commit fe4db32 into main Feb 9, 2026
8 of 9 checks passed

inesgomas deleted the disable-pattern-CF-2151 branch February 9, 2026 17:18

Conversation

inesgomas commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codacy-production bot commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codacy's Analysis Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

inesgomas commented Jan 27, 2026 •

edited

Loading

codacy-production bot commented Jan 27, 2026 •

edited

Loading