Repository navigation
Core detection - #118
Merged
Merged
Core detection#118
Conversation
Every JSON, TOML, YAML and XML file in the project must parse, including the configuration in .github/, .gitlab/, .circleci/, .buildkite/, .devcontainer/ and .vscode/. A failure lists each file with the parser's line and column. - JSON that tools read with comments (*.jsonc, tsconfig*.json, jsconfig.json, devcontainer.json, .vscode/*.json) may have comments and trailing commas. - YAML is composed rather than constructed, so the tags of any tool (GitLab's !reference, CloudFormation's !Ref) are accepted; every document must parse. - XML is parsed with expat, which never reads external entities or DTDs. - Files must be UTF-8; files over 5 MiB are not parsed and are listed. Closes #84. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: add the data-wellformed check: every data file parses
…n license A license file at the root (LICENSE, LICENSE.md, LICENSE-MIT, COPYING, UNLICENSE, ...) or REUSE's LICENSES/ directory must hold a recognised license: an SPDX-License-Identifier line, or the standard text of AGPL, LGPL, GPL, Apache-2.0, MPL-2.0, EPL-2.0, BSL-1.0, Unlicense, CC0-1.0, MIT, BSD, ISC, 0BSD or Zlib. A project without one fails. It warns when the license is not recognised, or when a manifest declares another license than the files. Manifests come from a new DeclaredLicense rule: Python's `[project] license` and Rust's `[package] license`. `-only`, `-or-later` and `WITH` exceptions are not part of a license's text, so they are not compared. The well-configured fixtures are MIT licensed. Closes #99. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A committed file larger than 5 MiB (--max-file-size MIB) warns unless Git LFS stores it (`filter=lfs` in a .gitattributes, which applies below its own directory) or DVC tracks it (a .dvc file beside it). The largest five are listed. In a git checkout only the files git tracks are judged: Project.tracked_files() asks `git ls-files`, and falls back to every file when the project is not a checkout or git is not installed. Exclusions apply either way. Closes #104. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A SECURITY.md (or .rst, .txt, ...) at the root, in .github/ or in docs/ must say how to report a vulnerability: an email address, a link, or the forge's private vulnerability reporting. The check warns otherwise. The places forges look for such documents are shared in evidence.documents(), which the license check now uses too. This project's SECURITY.md asks for reports through GitHub's private vulnerability reporting. Closes #100. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI must lint the configuration of each CI provider it uses. Each CiProvider now names its linters: actionlint or zizmor for GitHub Actions, glab ci lint, gitlab-ci-local --preview or the CI lint API for GitLab CI, and circleci config validate for CircleCI. A pre-commit hook counts too. The check warns naming the providers left unlinted, and is skipped without CI or when no linter is known for the providers used. This project's CI gains a ci lint job running actionlint (with shellcheck) and zizmor, both pinned in .github/requirements/ci-lint.txt. Their findings are fixed: - the workflows only get read access (`permissions: contents: read`); - checkout no longer persists credentials; - the pip-audit step no longer word-splits a command substitution; - Dependabot waits a week before taking a release (security updates are not delayed). zizmor's unpinned-uses audit is disabled until actions are pinned (#102). Closes #101. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every action and reusable workflow CI uses from another repository must be pinned to a full commit SHA, and every docker:// image to a digest, so that a moved tag or a pushed branch cannot change what CI runs. The references are read from the parsed workflows (CiProvider.step_references). The check fails when a reference follows a branch or names no ref, and warns when it is pinned to a tag or an abbreviated commit. --allow-official-tags accepts tags for the actions GitHub publishes (actions/, github/). This project's actions are pinned to the commits of their releases, with the version in a comment for Dependabot, so zizmor's unpinned-uses audit is on again. The fixtures' actions are pinned too. Closes #102. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CI or a pre-commit hook must run a secret scanner: gitleaks, TruffleHog, detect-secrets, ggshield or Nosey Parker. The check warns otherwise, and says so when a scanner is configured (.gitleaks.toml, .secrets.baseline, .gitguardian.yaml) but nothing runs it. GitHub's own secret scanning is a repository setting that cannot be seen from a checkout, as the hint says. The pre-commit configuration files move to evidence.py, shared with ci-lint. This project's CI gains a secret scanning job: TruffleHog scans the commits of each push and pull request. The action is pinned to its release's commit, and the image it runs to that release's digest, since by default it runs the latest image. Closes #103. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…dges The README (at the root, in .github/ or in docs/) must show a CI status badge and a quality badge. Each CI provider now names its badge images (CiProvider.badges), so a badge of any supported provider counts, including their shields.io badges. Quality badges are Codecov, Coveralls, SonarCloud, Codacy, Code Climate, DeepSource, Coverity Scan and the OpenSSF Scorecard and Best Practices badges. The check warns when only one kind of badge is shown, and fails when there is no README or no badge. The well-configured fixtures gain READMEs with both. Closes #58. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: add the status-badges check: the README shows CI and quality badges
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #118 +/- ##
==========================================
+ Coverage 97.97% 98.35% +0.38%
==========================================
Files 45 53 +8
Lines 1680 2069 +389
Branches 154 205 +51
==========================================
+ Hits 1646 2035 +389
Misses 28 28
Partials 6 6 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.