mirror of https://github.com/kucherenko/jscpd.git synced 2026-09-19 08:11:03 +08:00

Files

T

apk b0c31a4042 chore: apply audit fixes across repo, crates, npm wrapper and pipelines

Rust / crates.io
- report the invoked binary name in --version/--help (jscpd vs cpd)
- add repository, documentation, keywords, categories to all crates
- exclude tests/ from the jscpd crate package; add cargo-binstall metadata
- expand the crates.io README and render it on docs.rs

npm
- add funding field to jscpd, cpd and jscpd@4 packages
- add jscpd-linux-arm64-musl platform package and clearer unsupported-platform error
- enable provenance for the v4 changeset publish

Pipelines
- rust.yml: windows-latest in the matrix, drop dead schedule guard
- release.yml: cosign-sign release assets, floating v5 tag, LICENSE in tarballs,
  invoke the new docker.yml (GHCR multi-arch image) after each release
- audit.yml: nightly cargo audit, cargo deny and pnpm audit
- Dockerfile: multi-stage image from release binaries (distroless), mcp target for Glama

Docs / community
- README: shields badges, single primary install per OS, GitHub Action snippet,
  link to jscpd.dev, v5.1 features, 15 reporters, 224 formats, 8 platforms
- docs: @v5 action tag, Docker usage, baseline section, current crate versions
- YAML issue forms with engine selector, config.yml, CODEOWNERS
- remove stale .github/CONTRIBUTING.md stub, custom.md, TODO.md; untrack rust/jscpd-report.json
- examples: mark as v4 API, add a Rust cpd-finder example

2026-09-02 09:57:06 +02:00

3.9 KiB

Raw Permalink Blame History

jscpd

Copy/paste detector for source code — a fast Rust CLI that finds duplicated blocks across 223 languages, writes reports in 15 formats and can fail CI when duplication grows.

This crate is the Rust engine behind jscpd (v5+). Full documentation lives at jscpd.dev.

Install

cargo install jscpd
# or, without compiling (prebuilt release binaries via cargo-binstall):
cargo binstall jscpd

cargo install jscpd installs two binaries with identical behaviour: jscpd and cpd. The unrelated cpd crate on crates.io is not this project; the crate name is jscpd.

Also available on npm (npm install -g jscpd), Homebrew (brew install jscpd) and as prebuilt archives on the GitHub releases page.

Usage

jscpd .                                   # scan the current directory
jscpd src/ lib/                           # scan specific paths
jscpd --min-tokens 50 --min-lines 5 .     # tune sensitivity
jscpd --reporters json,html --output report .
jscpd --threshold 5 .                     # exit 1 above 5% duplicated lines
jscpd --blame .                           # annotate clones with git blame
jscpd --list                              # list supported formats
jscpd --help                              # every option

Config file

Options can also come from .jscpd.json in the scanned directory (or the jscpd key of package.json, or --config <path>):

{
  "minTokens": 50,
  "minLines": 5,
  "mode": "mild",
  "format": ["typescript", "javascript", "rust"],
  "ignore": ["**/node_modules/**", "**/dist/**"],
  "reporters": ["console", "json"],
  "output": "report",
  "threshold": 5
}

Reporters

Select one or more with --reporters (-r):

console, console-full, json, xml, csv, html, markdown, badge, sarif, ai, xcode, threshold, silent, openmetrics, codeclimate

Baselines and CI gating

# Record the current state, then fail only on clones that were not in it.
jscpd --update-baseline --baseline .jscpd-baseline.json .
jscpd --baseline .jscpd-baseline.json --fail-on-new-clones .

# Or compare against a git ref without a stored baseline file
# (the ref's tree is scanned with the same options).
jscpd --baseline-from-ref origin/main --fail-on-new-clones .

MCP server

jscpd --mcp . scans the given paths once, then serves the Model Context Protocol over stdio, exposing check_duplication, get_statistics and check_current_directory tools to MCP clients (Claude Code, Cursor, ...).

GitHub Action

- uses: kucherenko/jscpd@v5
  with:
    path: .
    threshold: 5
    reporters: console,sarif

Library use

The jscpd crate's library target is not a public API — it only exists to share helpers with the crate's tests and may change in any release. For programmatic use depend on the engine crates instead:

Crate	Purpose
`cpd-finder`	File walking, orchestration, git blame — the entry point
`cpd-core`	Detection algorithm (Rabin–Karp rolling hash), data models
`cpd-tokenizer`	Language tokenization (223 formats)
`cpd-reporter`	Output formatting (15 reporters)

use cpd_finder::orchestrate::{RunConfig, run};

let config = RunConfig {
    paths: vec!["./src".into()],
    min_tokens: 50,
    ..Default::default()
};

let result = run(&config).unwrap();
println!("Found {} clones", result.clones.len());
println!("Analyzed {} files", result.statistics.total.sources);

License

MIT

3.9 KiB Raw Permalink Blame History Unescape Escape