fix: Bump Python runtime and fix runtime upgrades OD-969

Python 3.11.17 drops eMudhra roots; versioned Python/Go dirs and venv rebuilds make bumps take effect on existing installs.
CI uses a project token, refreshes drifted trivy/PMD fixtures and compares self-closing PMD rules on Unix.

Author: pedrobpereira

.codacy/codacy.yaml

@@ -2,7 +2,7 @@ runtimes:
     - go@1.26.10
     - java@17.0.10
     - node@22.23.4
-    - python@3.11.11
+    - python@3.11.17
 tools:
     - eslint@9.38.0
     - lizard@1.17.31

.github/workflows/it-test.yml

@@ -74,15 +74,15 @@ jobs:
             exit $LASTEXITCODE
           }
         env:
-          CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}
+          CODACY_CLI_TEST_PROJECT_TOKEN: ${{ secrets.CODACY_CLI_TEST_PROJECT_TOKEN }}
 
       - name: Run init tests on Unix
         if: matrix.os != 'windows-latest'
         id: run_init_tests_unix
         continue-on-error: true
         shell: bash
         env:
-          CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}
+          CODACY_CLI_TEST_PROJECT_TOKEN: ${{ secrets.CODACY_CLI_TEST_PROJECT_TOKEN }}
         run: |
           chmod +x integration-tests/run.sh
           ./integration-tests/run.sh

cmd/init_test.go

@@ -23,7 +23,7 @@ func TestConfigFileTemplate(t *testing.T) {
 			tools: []domain.Tool{},
 			expected: []string{
 				"node@22.23.4",
-				"python@3.11.11",
+				"python@3.11.17",
 				"eslint@8.57.0",
 				"trivy@0.69.3",
 				"pylint@3.3.6",
@@ -45,7 +45,7 @@ func TestConfigFileTemplate(t *testing.T) {
 				"eslint@9.4.0",
 			},
 			notExpected: []string{
-				"python@3.11.11",
+				"python@3.11.17",
 				"pylint",
 				"pmd",
 				"trivy",
@@ -61,7 +61,7 @@ func TestConfigFileTemplate(t *testing.T) {
 				},
 			},
 			expected: []string{
-				"python@3.11.11",
+				"python@3.11.17",
 				"pylint@3.4.0",
 			},
 			notExpected: []string{
@@ -91,7 +91,7 @@ func TestConfigFileTemplate(t *testing.T) {
 				"trivy@0.60.0",
 			},
 			notExpected: []string{
-				"python@3.11.11",
+				"python@3.11.17",
 				"pylint",
 				"pmd",
 			},
@@ -122,7 +122,7 @@ func TestConfigFileTemplate(t *testing.T) {
 			},
 			expected: []string{
 				"node@22.23.4",
-				"python@3.11.11",
+				"python@3.11.17",
 				"eslint@9.4.0",
 				"trivy@0.60.0",
 				"pylint@3.4.0",

config/config.go

@@ -399,6 +399,12 @@ func (c *ConfigType) IsRuntimeInstalled(name string, runtime *plugins.RuntimeInf
 
 // IsToolInstalled checks if a tool is already installed
 func (c *ConfigType) IsToolInstalled(name string, tool *plugins.ToolInfo) bool {
+	if tool.Runtime == "python" {
+		if runtimeInfo, ok := c.Runtimes()["python"]; ok && !venvUsesRuntime(tool, runtimeInfo) {
+			return false
+		}
+	}
+
 	// If there are no binaries, check the install directory
 	if len(tool.Binaries) == 0 {
 		_, err := os.Stat(tool.InstallDir)
@@ -427,6 +433,21 @@ func (c *ConfigType) IsToolInstalled(name string, tool *plugins.ToolInfo) bool {
 	return false
 }
 
+// venvUsesRuntime is false when the venv was built on another runtime, so a Python bump rebuilds it.
+func venvUsesRuntime(toolInfo *plugins.ToolInfo, runtimeInfo *plugins.RuntimeInfo) bool {
+	cfg, err := os.ReadFile(filepath.Join(toolInfo.InstallDir, "venv", "pyvenv.cfg"))
+	if err != nil {
+		return false
+	}
+	runtimeBin := filepath.Dir(runtimeInfo.Binaries["python3"])
+	for _, line := range strings.Split(string(cfg), "\n") {
+		if key, value, ok := strings.Cut(line, "="); ok && strings.TrimSpace(key) == "home" {
+			return filepath.Clean(strings.TrimSpace(value)) == filepath.Clean(runtimeBin)
+		}
+	}
+	return false
+}
+
 // Global singleton config-file
 var Config = ConfigType{}
 

config/runtimes-installer.go

@@ -118,20 +118,25 @@ func downloadAndExtractRuntime(runtimeInfo *plugins.RuntimeInfo) error {
 	}
 	defer file.Close()
 
+	extractDir := filepath.Dir(runtimeInfo.InstallDir)
+	if err := os.MkdirAll(extractDir, constants.DefaultDirPerms); err != nil {
+		return fmt.Errorf("failed to create extract directory: %w", err)
+	}
+
 	// Extract based on file extension
 	logger.Debug("Extracting runtime", logrus.Fields{
 		"runtime":          runtimeInfo.Name,
 		"version":          runtimeInfo.Version,
 		"fileName":         fileName,
-		"extractDirectory": runtimesDir,
+		"extractDirectory": extractDir,
 	})
 
 	if strings.HasSuffix(fileName, ".zip") {
-		err = utils.ExtractZip(file.Name(), runtimesDir)
+		err = utils.ExtractZip(file.Name(), extractDir)
 	} else if strings.HasSuffix(fileName, ".tar.xz") || strings.HasSuffix(fileName, ".txz") {
-		err = utils.ExtractTarXz(file, runtimesDir)
+		err = utils.ExtractTarXz(file, extractDir)
 	} else {
-		err = utils.ExtractTarGz(file, runtimesDir)
+		err = utils.ExtractTarGz(file, extractDir)
 	}
 	if err != nil {
 		return fmt.Errorf("failed to extract runtime: %w", err)

config/tools-installer.go

@@ -417,7 +417,7 @@ func installPythonTool(name string, toolInfo *plugins.ToolInfo) error {
 		"venvDir": filepath.Join(toolInfo.InstallDir, "venv"),
 	})
 
-	cmd := exec.Command(pythonBinary, "-m", "venv", filepath.Join(toolInfo.InstallDir, "venv"))
+	cmd := exec.Command(pythonBinary, "-m", "venv", "--clear", filepath.Join(toolInfo.InstallDir, "venv"))
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		return fmt.Errorf("failed to create venv: %s\nError: %w", string(output), err)

config/tools-installer_test.go

@@ -145,3 +145,18 @@ func TestAddDownloadBasedTool(t *testing.T) {
 	expectedBinaryPath := filepath.Join(expectedInstallDir, "trivy")
 	assert.Equal(t, expectedBinaryPath, trivyInfo.Binaries["trivy"])
 }
+
+func TestVenvUsesRuntime(t *testing.T) {
+	toolDir := t.TempDir()
+	assert.NoError(t, os.MkdirAll(filepath.Join(toolDir, "venv"), 0755))
+	cfg := "home = /runtimes/cpython-3.11.11/python/bin\nversion = 3.11.11\n"
+	assert.NoError(t, os.WriteFile(filepath.Join(toolDir, "venv", "pyvenv.cfg"), []byte(cfg), 0644))
+	tool := &plugins.ToolInfo{InstallDir: toolDir}
+
+	same := &plugins.RuntimeInfo{Binaries: map[string]string{"python3": "/runtimes/cpython-3.11.11/python/bin/python3"}}
+	bumped := &plugins.RuntimeInfo{Binaries: map[string]string{"python3": "/runtimes/cpython-3.11.17/python/bin/python3"}}
+
+	assert.True(t, venvUsesRuntime(tool, same))
+	assert.False(t, venvUsesRuntime(tool, bumped))
+	assert.False(t, venvUsesRuntime(&plugins.ToolInfo{InstallDir: t.TempDir()}, same))
+}

integration-tests/config-discover/expected/codacy.yaml

@@ -2,7 +2,7 @@ runtimes:
     - dart@3.7.2
     - java@17.0.10
     - node@22.23.4
-    - python@3.11.11
+    - python@3.11.17
 tools:
     - dartanalyzer@3.7.2
     - eslint@8.57.0

integration-tests/config-discover/expected/tools-configs/ruleset.xml

@@ -89,7 +89,6 @@
     <rule ref="category/java/errorprone.xml/AvoidInstanceofChecksInCatchClause"/>
     <rule ref="category/java/errorprone.xml/AvoidMultipleUnaryOperators"/>
     <rule ref="category/java/errorprone.xml/BrokenNullCheck"/>
-    <rule ref="category/java/errorprone.xml/CheckSkipResult"/>
     <rule ref="category/java/errorprone.xml/CompareObjectsWithEquals">
         <properties>
             <property name="typesThatCompareByReference" value="java.lang.Enum,java.lang.Class"/>

integration-tests/init-with-token/expected/codacy.yaml

@@ -1,7 +1,7 @@
 runtimes:
     - java@17.0.10
     - node@22.23.4
-    - python@3.11.11
+    - python@3.11.17
 tools:
     - eslint@8.57.0
     - lizard@1.22.2