a fast, scalable, multi-language and extensible build system
This report summarizes scanner evidence for bazelbuild/bazel, a Java project with 25,933 GitHub stars. SynthScan examined 433,781 lines of code across 1982 source files, recording 1568 pattern matches distributed across 19 syntactic categories. The legacy adjusted pattern signal is 4.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1487 finding(s).
Are imports declared and package/API names verified? 38 finding(s).
Are wrappers, guards, and repeated structures necessary? 160 finding(s).
Which changes need focused human review? 1568 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1568 distinct pattern matches across 19 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | compile.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | verify_module_bazel_lock.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | verify_module_bazel_lock.sh | 41 | # Verifies that Bazel's own MODULE.bazel.lock is up-to-date, i.e., that running | COMMENT |
| LOW | combine_distfiles.py | 1 | # pylint: disable=g-bad-file-header | COMMENT |
| LOW | combine_distfiles_to_tar.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tools/mirror_external_deps.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/upload_bazel_mirror.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/genrule/genrule-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/launcher/empty.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/test/test-setup.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/test/test-setup.sh | 241 | trap "signal_children ${signal}" ${signal} | COMMENT |
| LOW | tools/test/collect_coverage.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/test/collect_coverage.sh | 101 | # Setting up the environment for executing the C++ tests. | COMMENT |
| LOW | tools/test/collect_coverage.sh | 121 | # | COMMENT |
| LOW | tools/test/collect_coverage.sh | 221 | COMMENT | |
| LOW | tools/test/dummy.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/test/generate-xml.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/test/generate-xml.sh | 21 | DURATION_IN_SECONDS="$3" | COMMENT |
| LOW | tools/test/generate-xml.sh | 41 | # We can't use sed in UTF-8 mode, because it would fail on the first | COMMENT |
| LOW | tools/test/generate-xml.sh | 61 | # 4. Replace the string ']]>' with ']]>]]<![CDATA[>' to prevent escaping the | COMMENT |
| LOW | tools/test/collect_cc_coverage.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/test/collect_cc_coverage.sh | 21 | # | COMMENT |
| LOW | tools/test/collect_cc_coverage.sh | 121 | # If the gcda file was not found we skip generating coverage from the gcno | COMMENT |
| LOW | tools/test/collect_cc_coverage.sh | 141 | # Invoke gcov to generate a code coverage report with the flags: | COMMENT |
| LOW | …e/devtools/coverageoutputgenerator/BranchCoverage.java | 1 | // Copyright 2025 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …/devtools/coverageoutputgenerator/LcovMergerFlags.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …om/google/devtools/coverageoutputgenerator/Parser.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …vtools/coverageoutputgenerator/SourceFileCoverage.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …gle/devtools/coverageoutputgenerator/LineCoverage.java | 1 | // Copyright 2025 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …/google/devtools/coverageoutputgenerator/Coverage.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …oogle/devtools/coverageoutputgenerator/LcovParser.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …evtools/coverageoutputgenerator/BranchCoverageKey.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …vtools/coverageoutputgenerator/BranchCoverageItem.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …/com/google/devtools/coverageoutputgenerator/Main.java | 1 | // Copyright 2016 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …oogle/devtools/coverageoutputgenerator/GcovParser.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …e/devtools/coverageoutputgenerator/GcovJsonParser.java | 1 | // Copyright 2020 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …e/devtools/coverageoutputgenerator/build_and_upload.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …ogle/devtools/coverageoutputgenerator/LcovPrinter.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …google/devtools/coverageoutputgenerator/Constants.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …vtools/coverageoutputgenerator/BranchCoverageTest.java | 1 | // Copyright 2025 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …gle/devtools/coverageoutputgenerator/CoverageTest.java | 1 | // Copyright 2016 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …e/devtools/coverageoutputgenerator/GcovParserTest.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …/devtools/coverageoutputgenerator/LcovPrinterTest.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …devtools/coverageoutputgenerator/LineCoverageTest.java | 1 | // Copyright 2025 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …tools/coverageoutputgenerator/LcovMergerTestUtils.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …e/devtools/coverageoutputgenerator/LcovParserTest.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …vtools/coverageoutputgenerator/GcovJsonParserTest.java | 1 | // Copyright 2025 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …tools/coverageoutputgenerator/LcovMergerFlagsTest.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …/google/devtools/coverageoutputgenerator/MainTest.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …ls/coverageoutputgenerator/SourceFileCoverageTest.java | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | tools/test/windows/tw.h | 1 | // Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | tools/osx/xcode_locator_stub.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/osx/xcode_locator.m | 1 | // Copyright 2015 Google Inc. All rights reserved. | COMMENT |
| LOW | tools/python/runfiles/runfiles.py | 1 | # Copyright 2018 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | tools/jdk/proguard_allowlister_test_lib.h | 1 | // Copyright 2026 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | tools/jdk/proguard_allowlister_lib.h | 1 | // Copyright 2026 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | …ls/cpp/modules_tools/generate-modmap/generate-modmap.h | 1 | // Copyright 2024 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | tools/cpp/modules_tools/common/json.hpp | 1 | // Copyright 2024 The Bazel Authors. All rights reserved. | COMMENT |
| LOW | tools/cpp/modules_tools/common/json.hpp | 21 | #include <iomanip> | COMMENT |
| LOW | tools/cpp/modules_tools/common/common.h | 1 | // Copyright 2024 The Bazel Authors. All rights reserved. | COMMENT |
| 1132 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | compile.sh | 42 | # Create an initial binary so we can host ourself | COMMENT |
| MEDIUM | tools/upload_bazel_mirror.sh | 48 | # Create a temp directory to hold the versioned tarball, | COMMENT |
| MEDIUM | tools/test/test-setup.sh | 98 | # Create the test temp directory, which may not exist on the remote host when | COMMENT |
| MEDIUM | tools/test/collect_coverage.sh | 137 | # Create a paramsfile for invoking SingleJar. | COMMENT |
| MEDIUM | tools/build_defs/hash/sha256_test.sh | 37 | # The following code produces a 120MB file (30*2^22 bytes) | COMMENT |
| MEDIUM | third_party/ijar/test/ijar_test.sh | 327 | # Create a huge (~2.2Gb) input jar to test "large file" correctness | COMMENT |
| MEDIUM | third_party/ijar/test/ijar_test.sh | 336 | # Create an output jar with upper bound on size > 2GB | COMMENT |
| MEDIUM | scripts/bootstrap/build_windows_jni.sh | 38 | # Create a temp directory. It will used for the batch file we generate soon and | COMMENT |
| MEDIUM | scripts/bootstrap/compile.sh | 199 | # Create the deploy JAR | COMMENT |
| MEDIUM | scripts/bootstrap/compile.sh | 303 | # Create the bazel_tools repository. | COMMENT |
| MEDIUM | scripts/bootstrap/compile.sh | 361 | # Create the rest of @bazel_tools//tools/... | COMMENT |
| MEDIUM | scripts/bootstrap/buildenv.sh | 325 | # Create a link for a directory on the filesystem | COMMENT |
| MEDIUM | scripts/ci/build.sh | 376 | # Create a debian package with version in package name and add it to the repo | COMMENT |
| MEDIUM | scripts/release/relnotes.sh | 124 | # Create the release notes since commit $1 ($2...${[#]} are the cherry-picks, | COMMENT |
| MEDIUM | scripts/release/relnotes.sh | 196 | # Create the revision information given a list of commits. The first | COMMENT |
| MEDIUM | scripts/release/release.sh | 86 | # Create the release commit by changing the CHANGELOG file | COMMENT |
| MEDIUM | scripts/release/release.sh | 132 | # Create a new release named "$1" with "$2" as the baseline commit. | COMMENT |
| MEDIUM | scripts/packages/dmg/create_bazel_dmg.sh | 93 | # Create the dmg file | COMMENT |
| MEDIUM | src/create_java_tools_release.sh | 70 | # Create a tmp directory to download the artifacts from GCS and compute their | COMMENT |
| MEDIUM | src/upload_java_tools.sh | 79 | # Create a temp directory and a writable temp zip file to add a README.md file to | COMMENT |
| MEDIUM | src/upload_java_tools.sh | 92 | # Create the README.md file and add the re-build java tools instructions. | COMMENT |
| MEDIUM | src/tools/singlejar/zip64_huge_entry_test.sh | 67 | # Create a single 4GB file | COMMENT |
| MEDIUM | src/test/py/bazel/launcher_test.py | 802 | # Create a directory with a path longer than 260 | COMMENT |
| MEDIUM | src/test/py/bazel/runfiles_test.py | 205 | # Create a copy of the runfiles manifest, replacing | COMMENT |
| MEDIUM | src/test/py/bazel/bazel_external_repository_test.py | 519 | # Create a repository rule for bar that symlinks to foo's file. | COMMENT |
| MEDIUM | …el/bzlmod/remote_repo_contents_cache_rewinding_test.py | 59 | # Create a repo with two BUILD files (one in a subpackage), build a target | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 163 | # Create a project with deps on 'sss' | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 247 | # Create a project with deps on 'sss' | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 282 | # Create a project with deps on 'sss' | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 315 | # Create a project with deps on the BCR's 'platforms' module | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 350 | # Create a project with deps on the BCR's 'platforms' module | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 390 | # Create a project with an outdated direct dep on aaa | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/repo_contents_cache_test.py | 676 | # Create the external file outside the workspace so it's not treated as | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/mod_command_test.py | 1102 | # Create a lockfile and let the extension evaluations emit fixup warnings. | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/mod_command_test.py | 1514 | # Create a lockfile and let the extension evaluations emit fixup warnings. | COMMENT |
| MEDIUM | src/test/shell/unittest.bash | 61 | # This file provides utilities for assertions over the output of a | COMMENT |
| MEDIUM | src/test/shell/testenv.sh | 227 | # Create a shorter bazel root on Windows to avoid long path issue. | COMMENT |
| MEDIUM | src/test/shell/integration/thread_dump_test.sh | 25 | # Create a new workspace to ensure the output_base is clean | COMMENT |
| MEDIUM | src/test/shell/integration/exec_group_test.sh | 673 | # Define the toolchains. | COMMENT |
| MEDIUM | src/test/shell/integration/exec_group_test.sh | 703 | # Define the platforms. | COMMENT |
| MEDIUM | src/test/shell/integration/exec_group_test.sh | 752 | # Define a simple rule to put the aspect on. | COMMENT |
| MEDIUM | src/test/shell/integration/exec_group_test.sh | 794 | # Define the toolchains. | COMMENT |
| MEDIUM | src/test/shell/integration/exec_group_test.sh | 837 | # Define a simple rule to put the aspect on. | COMMENT |
| MEDIUM | src/test/shell/integration/platform_based_flags_test.sh | 77 | # Create a transition on platform. | COMMENT |
| MEDIUM | …test/shell/integration/starlark_configurations_test.sh | 901 | # Define the flags that are used. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 176 | # Define the toolchain. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 255 | # Define the toolchain. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 306 | # Define the toolchain. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 355 | # Create an alias for the toolchain type. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 373 | # Define the toolchain. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 415 | # Create an alias for the toolchain type. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 752 | # Define a toolchain that can't be used due to the target_settings | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 974 | # Define the toolchain. | COMMENT |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1552 | # Define the toolchain. | STRING |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1640 | # Define the toolchain. | STRING |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1757 | # Define the toolchains. | STRING |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1823 | # Create a toolchain rule that also exposes make variables. | STRING |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1846 | # Create a rule that consumes the toolchain. | STRING |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1870 | # Define the toolchain. | STRING |
| MEDIUM | src/test/shell/integration/toolchain_test.sh | 1963 | # Define the actual targets using these. | STRING |
| 44 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 56 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40 | CODE |
| CRITICAL⚡ | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 102 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40:42 | CODE |
| CRITICAL⚡ | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 109 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40 | CODE |
| CRITICAL⚡ | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 119 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40 | CODE |
| CRITICAL⚡ | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 127 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40 | CODE |
| CRITICAL⚡ | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 137 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40 | CODE |
| CRITICAL⚡ | …/proguard/proguard6.2.2/docs/manual/retrace/mapping.md | 146 | 3040:3042:java.io.PrintWriter com.example.application.util.PrintWriterUtil.createPrintWriterOut(java.io.File):40 | CODE |
| CRITICAL | src/test/shell/bazel/remote/remote_execution_test.sh | 1006 | myrunfiles = ctx.runfiles(files=ctx.attr.dir.default_runfiles.files.to_list()) | STRING |
| CRITICAL | …t/runner/testdata/system_exit_detecting_test_stack.txt | 5 | at com.google.testing.junit.runner.ProgramThatCallsSystemExit.main(ProgramThatCallsSystemExit.java:XXX) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/test/collect_coverage.sh | 95 | # -------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/unittest.bash | 23 | # ------------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/test/shell/unittest.bash | 43 | # ------------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/test/shell/integration/jvm_flags_escaping_test.sh | 47 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/integration/jvm_flags_escaping_test.sh | 49 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/integration/jvm_flags_escaping_test.sh | 236 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/integration/jvm_flags_escaping_test.sh | 238 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/shell/integration/starlark_dependency_pruning_test.sh | 212 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/shell/integration/starlark_dependency_pruning_test.sh | 214 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/shell/integration/starlark_dependency_pruning_test.sh | 237 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/shell/integration/starlark_dependency_pruning_test.sh | 239 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | …test/shell/integration/config_stripped_outputs_test.sh | 22 | # ------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/run_test.sh | 43 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/test/shell/bazel/run_test.sh | 45 | # ------------------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/test/shell/bazel/py_args_escaping_test.sh | 43 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/py_args_escaping_test.sh | 45 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/py_args_escaping_test.sh | 201 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/py_args_escaping_test.sh | 203 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2591 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2593 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | src/test/shell/bazel/bazel_java_test.sh | 2608 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | src/test/shell/bazel/bazel_java_test.sh | 2610 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | src/test/shell/bazel/bazel_java_test.sh | 2616 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | src/test/shell/bazel/bazel_java_test.sh | 2618 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2633 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2635 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2648 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2650 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2664 | # ------------------------------------------------------------- | COMMENT |
| MEDIUM | src/test/shell/bazel/bazel_java_test.sh | 2666 | # ------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/mirror_external_deps.py | 78 | def parse_downloader_cfg_domains(workspace: pathlib.Path) -> set[str]: | CODE |
| LOW | tools/mirror_external_deps.py | 142 | def extract_lockfile_source_urls( | CODE |
| LOW⚡ | tools/android/instrumentation_test_check_test.py | 51 | def test_extract_instrumentation_target_package(self): | STRING |
| LOW⚡ | tools/android/instrumentation_test_check_test.py | 56 | def test_extract_target_package(self): | STRING |
| LOW⚡ | tools/android/instrumentation_test_check_test.py | 60 | def test_target_package_check(self): | STRING |
| LOW⚡ | tools/android/instrumentation_test_check_test.py | 66 | def test_target_package_check_failure(self): | STRING |
| LOW | scripts/generate_fish_completion.py | 195 | def _normalize_subcommand_name(subcommand): | CODE |
| LOW | scripts/aquery_differ/aquery_differ.py | 137 | def _map_action_index_to_output_files(actions, artifacts): | CODE |
| LOW | scripts/aquery_differ/aquery_differ.py | 158 | def _map_output_files_to_input_artifacts( | CODE |
| LOW | scripts/aquery_differ/aquery_differ.py | 195 | def _map_output_files_to_command_line(actions, action_index_to_output_files): | CODE |
| LOW | scripts/aquery_differ/aquery_differ_test.py | 54 | def make_aquery_output_with_dep_set( | CODE |
| LOW | scripts/aquery_differ/aquery_differ_test.py | 98 | def test_no_difference_different_output_files_order(self): | CODE |
| LOW | scripts/aquery_differ/aquery_differ_test.py | 135 | def test_first_has_extra_output_files(self): | CODE |
| LOW | scripts/aquery_differ/aquery_differ_test.py | 180 | def test_different_command_lines(self): | CODE |
| LOW⚡ | scripts/release/relnotes_test.py | 31 | def test_parse_version_standard(self): | CODE |
| LOW⚡ | scripts/release/relnotes_test.py | 36 | def test_parse_version_two_digit_major(self): | CODE |
| LOW⚡ | scripts/release/relnotes_test.py | 41 | def test_parse_version_with_v_prefix(self): | CODE |
| LOW⚡ | scripts/release/relnotes_test.py | 45 | def test_parse_version_prerelease_and_rc(self): | CODE |
| LOW⚡ | scripts/release/relnotes_test.py | 51 | def test_parse_version_invalid(self): | CODE |
| LOW⚡ | scripts/release/relnotes_test.py | 55 | def test_version_sorting_two_digit_major(self): | CODE |
| LOW | scripts/release/relnotes_test.py | 74 | def test_extract_relnotes_standard(self): | CODE |
| LOW | scripts/release/relnotes_test.py | 87 | def test_extract_relnotes_incompatible(self): | CODE |
| LOW | scripts/release/relnotes_test.py | 98 | def test_extract_relnotes_none(self): | CODE |
| LOW | scripts/release/relnotes.py | 155 | def get_external_authors_between(base, head): | CODE |
| LOW | scripts/docs/docs2mdx.py | 115 | def _cell_has_complex_content(cell): | CODE |
| LOW | scripts/docs/docs2mdx.py | 157 | def _convert_html_to_single_line_md(content): | CODE |
| LOW | scripts/docs/docs2mdx.py | 282 | def _fix_configuration_dot_html(content): | CODE |
| LOW | scripts/docs/docs2mdx.py | 329 | def _move_flag_links_outside_code(content): | CODE |
| LOW | scripts/docs/docs2mdx.py | 348 | def _convert_heading_ids_to_mdx_anchors(content): | CODE |
| LOW | scripts/docs/docs2mdx.py | 378 | def _post_markdown_transforms(content): | CODE |
| LOW | scripts/docs/clr_converter_test.py | 69 | def test_void_expansion_option(self): | STRING |
| LOW | scripts/docs/clr_converter_test.py | 89 | def test_allow_multiple_option(self): | STRING |
| LOW | scripts/docs/clr_converter_test.py | 162 | def test_quotes_in_type_description(self): | STRING |
| LOW | scripts/docs/clr_converter_test.py | 176 | def test_angle_brackets_in_type_description(self): | STRING |
| LOW | scripts/docs/mdx_fixes.py | 188 | def _remove_trailing_whitespaces(content): | CODE |
| LOW | scripts/docs/mdx_fixes.py | 193 | def _remove_anything_before_front_matter(content): | CODE |
| LOW | scripts/docs/docs2mdx_test.py | 27 | def test_code_blocks_keep_literal_characters(self): | CODE |
| LOW | scripts/docs/docs2mdx_test.py | 41 | def test_prose_still_escapes_mdx_special_characters(self): | CODE |
| LOW | scripts/docs/docs2mdx_test.py | 51 | def test_pre_blocks_in_markdown_are_not_entity_escaped(self): | CODE |
| LOW | scripts/docs/docs2mdx_test.py | 168 | def test_heading_id_preserved(self, html, expected_heading): | STRING |
| LOW | scripts/docs/docs2mdx_test.py | 172 | def test_heading_without_id_has_no_anchor(self): | STRING |
| LOW | scripts/docs/docs2mdx_test.py | 213 | def test_flag_anchor_preserved(self, html, anchor_id): | STRING |
| LOW | scripts/docs/docs2mdx_test.py | 218 | def test_duplicate_anchor_id_inserted_once(self): | STRING |
| LOW | scripts/ctexplain/bazel_api.py | 139 | def _parse_cquery_result_line(line: str) -> ConfiguredTarget: | CODE |
| LOW | scripts/ctexplain/ctexplain.py | 101 | def _render_analysis_help_text() -> str: | CODE |
| LOW⚡ | .github/scripts/check_ssl.py | 60 | def get_days_until_expiration(self, domain: str) -> int: | CODE |
| LOW | src/tools/singlejar/data/log4j2_plugins_gen.py | 78 | def load_cache_files_from_bytes(byte_data, consolidated_plugins): | CODE |
| LOW | src/tools/singlejar/data/log4j2_plugins_gen.py | 113 | def create_jar_with_empty_data(jar_file_path): | CODE |
| LOW | …est/py/bazel/bzlmod/remote_repo_contents_cache_test.py | 311 | 'def _platform_dependent_repo_impl(rctx):', | CODE |
| LOW | …est/py/bazel/bzlmod/remote_repo_contents_cache_test.py | 407 | 'def _platform_dependent_binary_impl(rctx):', | CODE |
| LOW | src/test/shell/unittest_test.py | 235 | def test_set_bash_errexit_prints_stack_trace(self): | CODE |
| LOW | src/test/shell/unittest_test.py | 263 | def test_set_bash_errexit_runs_tear_down(self): | CODE |
| LOW | src/test/shell/unittest_test.py | 291 | def test_set_bash_errexit_pipefail_propagates_failure_through_pipe(self): | CODE |
| LOW | src/test/shell/unittest_test.py | 312 | def test_set_bash_errexit_no_pipefail_ignores_failure_before_pipe(self): | CODE |
| LOW | src/test/shell/unittest_test.py | 334 | def test_set_bash_errexit_pipefail_long_testname_succeeds(self): | CODE |
| LOW | src/test/shell/unittest_test.py | 366 | def test_empty_test_succeeds_sharding(self): | CODE |
| LOW | src/test/shell/unittest_test.py | 576 | def __run_sharded_test_assert_expected_tests_were_run( | STRING |
| LOW | src/test/shell/unittest_test.py | 600 | def test_manual_sharding_unknown_test(self): | STRING |
| LOW | src/test/shell/unittest_test.py | 622 | def test_manual_sharding_double_defined_test(self): | STRING |
| LOW | src/test/shell/unittest_test.py | 643 | def test_filter_runs_only_matching_test(self): | STRING |
| 55 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/ctexplain/bazel_api.py | 103 | Calls "bazel config" with the given config hash. Args: config_hash: A config hash as reported by "bazel cquer | STRING |
| HIGH | scripts/ctexplain/bazel_api.py | 178 | Strips a fully qualified Java class name to the file scope. Examples: - "A.B.OuterClass" -> "OuterClass" - "A | STRING |
| HIGH | scripts/ctexplain/lib.py | 27 | Gets a build invocation's configured targets. Args: bazel: API for invoking Bazel. labels: The targets to bui | STRING |
| HIGH | src/test/py/bazel/test_base.py | 142 | Extracts the version of a module from the default MODULE.bazel.lock file. Args: module: string; the name of t | STRING |
| HIGH | src/test/py/bazel/test_base.py | 269 | Returns environment variable `name`. Args: name: string; name of the environment variable default: anyt | STRING |
| HIGH | src/test/py/bazel/test_base.py | 323 | Returns the absolute path of `path` relative to self._test_cwd. Args: path: string; a path, relative to self. | STRING |
| HIGH | src/test/py/bazel/test_base.py | 369 | Creates directories under the test's scratch directory. Args: path: string; a path, relative to the test's sc | STRING |
| HIGH | src/test/py/bazel/test_base.py | 391 | Creates a file under the test's scratch directory. Args: path: string; a path, relative to the test's scratch | STRING |
| HIGH | src/test/py/bazel/test_base.py | 424 | Copy a file to a path under the test's scratch directory. Args: src_path: string; a path, the file to copy | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/test/test-setup.sh | 124 | # If the file path is already fully specified, simply return it. | COMMENT |
| LOW | tools/test/test-setup.sh | 127 | # If the file exists in the $TEST_SRCDIR then just use it. | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_module_test.py | 1473 | # The test harness disables the repo contents cache, which this test is | COMMENT |
| LOW | …est/py/bazel/bzlmod/remote_repo_contents_cache_test.py | 123 | # Deleting the cache fails on Windows, so we just use a different directory. | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/bazel_fetch_test.py | 382 | # The test harness disables the repo contents cache, which this test is | COMMENT |
| MEDIUM | src/test/py/bazel/bzlmod/repo_contents_cache_test.py | 52 | # The test harness disables the repo contents cache in its own bazelrc, | COMMENT |
| MEDIUM | src/test/shell/unittest.bash | 95 | # be absolute to be robust against | COMMENT |
| LOW | src/test/shell/unittest.bash | 248 | # the stack because they just add noise.) Also prints the contents of | COMMENT |
| LOW | src/test/shell/unittest.bash | 276 | # the stack because they just add noise.) | COMMENT |
| MEDIUM | …est/shell/integration/param_file_flag_per_line_test.sh | 17 | # Tests Starlark API pertaining to action inspection via aspect. | COMMENT |
| MEDIUM | src/test/shell/integration/action_aspect_test.sh | 17 | # Tests Starlark API pertaining to action inspection via aspect. | COMMENT |
| MEDIUM | src/test/shell/bazel/coverage_helpers.sh | 67 | # Replace newlines with commas to facilitate the assertion. | COMMENT |
| MEDIUM | src/test/shell/bazel/execution_phase_tests.sh | 109 | # We cannot make any robust assertions on the first run because of implicit | COMMENT |
| LOW | src/test/shell/bazel/bazel_test_test.sh | 429 | # We don't just use the local PATH, but use the test's PATH, which is more restrictive. | COMMENT |
| LOW | src/test/shell/bazel/jdeps_test.sh | 71 | # If jdeps fails with a NPE, just add the class file to the list in | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/test/test-setup.sh | 70 | # Set USER to the current user, unless passed by Bazel via --test_env. | COMMENT |
| LOW | scripts/bash_completion_test.sh | 39 | # Set this to test completion with package path (if enabled) | COMMENT |
| LOW | scripts/bootstrap/build_windows_jni.sh | 48 | # Check if BAZEL_VC points to Visual C++ Build Tools 2019 | COMMENT |
| LOW | scripts/bootstrap/build_windows_jni.sh | 65 | # Check if Visual Studio 2019 is installed. Look for it at the default | COMMENT |
| LOW | scripts/bootstrap/buildenv.sh | 21 | # Check if all necessary tools are available. | COMMENT |
| LOW | src/test/py/bazel/bazel_windows_test.py | 278 | # Set BAZEL_VC to a non-existing path, | COMMENT |
| LOW | src/test/py/bazel/bazel_windows_test.py | 335 | # Set BAZEL_VC to a non-existing path, | COMMENT |
| LOW | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 1161 | # Set version to old | COMMENT |
| LOW | src/test/shell/shell_utils.sh | 47 | # Print the result to stdout. | COMMENT |
| LOW | src/test/shell/unittest.bash | 170 | # Check if the script path is absolute, if not prefix the PWD. | COMMENT |
| LOW | src/test/shell/unittest_utils.sh | 30 | # Print message in "$1" then exit with status "$2" | COMMENT |
| LOW | src/test/shell/unittest_utils.sh | 67 | # Print message in "$1" then record that a non-fatal error occurred in | COMMENT |
| LOW | src/test/shell/integration/java_integration_test.sh | 293 | # Set javabase to an absolute path. | COMMENT |
| LOW | src/test/shell/integration/build_event_stream_test.sh | 1558 | # Check if null builds still have build metrics | COMMENT |
| LOW | src/test/shell/bazel/cc_integration_test.sh | 1161 | # Check if clang version is less than 17 | COMMENT |
| LOW | src/test/shell/bazel/bazel_cc_code_coverage_test.sh | 31 | # Check if all the tools required by CC coverage are installed. | COMMENT |
| LOW | src/test/shell/bazel/bazel_java_test.sh | 2545 | # Check if rules_java has the toolchain-driven unused_deps support | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/generate_fish_completion.py | 184 | params.append("({} query -k '{}' 2>/dev/null)".format(_BAZEL, query)) | CODE |
| HIGH | scripts/ctexplain/bazel_api.py | 147 | "<label> (null)" | STRING |
| HIGH | src/test/py/bazel/bzlmod/bazel_repo_mapping_test.py | 234 | source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \ | STRING |
| HIGH | src/test/py/bazel/bzlmod/bazel_repo_mapping_test.py | 235 | source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \ | STRING |
| HIGH | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 755 | # resolution doesn't rerun (its event is null), the lockfile is still | COMMENT |
| HIGH | src/test/shell/unittest_test.py | 35 | if [[ -f "${RUNFILES_DIR:-/dev/null}/bazel_tools/tools/bash/runfiles/runfiles.bash" ]]; then | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | combine_distfiles.py | 28 | CODE | |
| LOW | tools/mirror_external_deps.py | 142 | CODE | |
| LOW | tools/build_defs/pkg/archive_test.py | 27 | CODE | |
| LOW | tools/build_defs/pkg/build_tar.py | 56 | CODE | |
| LOW | scripts/aquery_differ/aquery_differ.py | 317 | CODE | |
| LOW | scripts/docs/docs2mdx.py | 262 | CODE | |
| LOW | scripts/docs/create_release_docs.py | 109 | CODE | |
| LOW | scripts/docs/clr_converter.py | 215 | CODE | |
| LOW | scripts/docs/clr_converter.py | 345 | CODE | |
| LOW | scripts/docs/clr_converter.py | 388 | CODE | |
| LOW | scripts/docs/clr_converter.py | 432 | CODE | |
| LOW | scripts/packages/debian/generate_changelog.py | 22 | CODE | |
| LOW | src/create_embedded_tools.py | 120 | CODE | |
| LOW | src/create_embedded_tools_lib.py | 34 | CODE | |
| LOW | src/test/py/bazel/first_time_use_test.py | 31 | CODE | |
| LOW | src/test/py/bazel/test_wrapper_test.py | 274 | CODE | |
| LOW | src/test/py/bazel/test_wrapper_test.py | 315 | CODE | |
| LOW | src/test/py/bazel/test_wrapper_test.py | 363 | CODE | |
| LOW | src/test/py/bazel/test_wrapper_test.py | 618 | CODE | |
| LOW | src/test/py/bazel/test_base.py | 33 | CODE | |
| LOW | src/test/py/bazel/bzlmod/repo_contents_cache_test.py | 57 | CODE | |
| LOW | src/test/py/bazel/bzlmod/mod_command_test.py | 771 | CODE | |
| LOW | src/test/shell/bazel/testing_server.py | 135 | CODE | |
| LOW | src/test/shell/bazel/remote/uds_proxy.py | 41 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | examples/py_native/lib.py | 0 | a tiny example binary for the native python rules of bazel. | STRING |
| HIGH | examples/py_native/bin.py | 0 | a tiny example binary for the native python rules of bazel. | STRING |
| HIGH | examples/py_native/test.py | 0 | a tiny example binary for the native python rules of bazel. | STRING |
| HIGH | examples/py_native/fail.py | 0 | a tiny example binary for the native python rules of bazel. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/build_defs/hash/sha256.py | 18 | CODE | |
| LOW | tools/build_defs/hash/sha256.py | 19 | CODE | |
| LOW | tools/build_defs/hash/sha256.py | 20 | CODE | |
| LOW | scripts/generate_fish_completion.py | 16 | CODE | |
| LOW | scripts/generate_fish_completion.py | 17 | CODE | |
| LOW | scripts/generate_fish_completion.py | 18 | CODE | |
| LOW | scripts/docs/docs2mdx_test.py | 15 | CODE | |
| LOW | scripts/docs/docs2mdx_test.py | 16 | CODE | |
| LOW | scripts/docs/docs2mdx_test.py | 17 | CODE | |
| LOW | scripts/docs/rewriter_test.py | 15 | CODE | |
| LOW | scripts/docs/rewriter_test.py | 16 | CODE | |
| LOW | scripts/docs/rewriter_test.py | 17 | CODE | |
| LOW | src/test/py/bazel/testdata/runfiles_test/foo/foo.py | 16 | CODE | |
| LOW | src/test/py/bazel/testdata/runfiles_test/bar/bar.py | 16 | CODE | |
| LOW | src/test/shell/unittest_test.py | 17 | CODE | |
| LOW | src/test/shell/unittest_test.py | 18 | CODE | |
| LOW | src/test/shell/unittest_test.py | 19 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/test/py/bazel/test_base.py | 46 | except (FileNotFoundError, OSError): | CODE |
| HIGH | src/test/py/bazel/bzlmod/bazel_lockfile_test.py | 67 | except FileNotFoundError: | CODE |
| HIGH | src/test/py/bazel/bzlmod/repo_contents_cache_test.py | 114 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/release/relnotes.py | 211 | except Exception: # pylint: disable=broad-exception-caught | CODE |
| MEDIUM | scripts/release/relnotes.py | 212 | print("Error: Not a release branch.") | CODE |
| MEDIUM⚡ | .github/scripts/check_ssl.py | 49 | print(f"Error: Config file not found at {self.config_path}") | CODE |
| MEDIUM⚡ | .github/scripts/check_ssl.py | 57 | print(f"Error parsing YAML config: {exc}") | CODE |
| MEDIUM | .github/scripts/check_ssl.py | 135 | print("Error: No domains found in config.") | CODE |
| MEDIUM | …n/java/com/google/devtools/common/options/Options.java | 37 | * System.err.print("Error parsing options: " + e.getMessage()); | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/test/generate-xml.sh | 35 | # make sure to append a whitespace in step #1. | COMMENT |
| MEDIUM | scripts/ci/ci.sh | 35 | # you can replace origin/master in the COMMIT_RANGE variable initialization | COMMENT |
| LOW | .github/ISSUE_TEMPLATE/feature_request.yml | 26 | description: Help us triage this issue faster and more accurately to the relevant team(s). Check the [team labels | CODE |
| LOW | .github/ISSUE_TEMPLATE/bug_report.yml | 26 | description: Help us triage this issue faster and more accurately to the relevant team(s). Check the [team labels | CODE |
| LOW | …main/java/net/starlark/java/eval/MethodDescriptor.java | 476 | @CheckReturnValue // don't forget to throw it | CODE |
| LOW | src/main/java/net/starlark/java/eval/Starlark.java | 1037 | @CheckReturnValue // don't forget to throw it | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/docs/testdata/input/markdown_with_html.md | 1 | Lorem ipsum [short link](/foo/bar). Or rather a [long link](https://bazel.build/foo/bar)? | CODE |
| LOW | …ts/docs/testdata/expected_output/markdown_with_html.md | 1 | Lorem ipsum [short link](/versions/6.6.6/foo/bar). Or rather a [long link](https://bazel.build/versions/6.6.6/foo/bar)? | CODE |
| LOW | src/test/py/bazel/test_wrapper_test.py | 56 | ' "@echo lorem ipsum",', | CODE |
| LOW | src/test/py/bazel/test_wrapper_test.py | 286 | if line.startswith('lorem ipsum'): | CODE |
| LOW | src/test/shell/bazel/bazel_workspace_status_test.sh | 55 | echo BUILD_USER fake_user | CODE |
| LOW | src/test/shell/bazel/bazel_workspace_status_test.sh | 76 | expect_log "BUILD_USER fake_user" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ty/java/proguard/proguard6.2.2/docs/manual/examples.md | 929 | ### Processing dependency injection {: #injection} | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/bootstrap/buildenv.sh | 359 | # Usage: | COMMENT |
| LOW | src/test/shell/unittest_utils.sh | 143 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/build_defs/pkg/archive.py | 143 | CODE | |
| LOW | src/test/py/bazel/bzlmod/test_utils.py | 322 | CODE |