Rules
43 checks, grouped by area.
No matching rules.
Architecture & ownership
17 rulesDependency boundaries
Avoid cross-product code dependencies Product code does not depend on another product's implementation.
sarj/graph/cross-product-import error Follow the code dependency matrix Production code dependencies follow the closed component-kind matrix. sarj/graph/disallowed-code-dependency error Keep applications independent Applications do not depend on another application's implementation. sarj/graph/application-imports-application error Keep code dependencies acyclic Boundary-clean production code dependencies are acyclic. sarj/graph/code-cycle warning Keep contracts implementation-free Contracts depend only on other contracts. sarj/graph/contract-imports-implementation error Keep libraries below applications Libraries do not depend on application implementation. sarj/graph/library-imports-application error Keep shared code product-neutral Shared components do not depend on product implementation. sarj/graph/shared-imports-product error Remove self-dependencies Components do not declare dependencies on themselves. sarj/graph/self-dependency error Use compatible edge endpoints Constrained non-code edges connect compatible component kinds. sarj/graph/edge-endpoints error Repository layout
Keep component roots disjoint Each tracked path has one declared component owner.
core/layout/non-overlapping-root error Use canonical component paths Component paths match their declared ownership kind. sarj/layout/component-path error Use canonical operational paths Operational components use canonical deployment paths. sarj/layout/operational-path warning Naming
Align IDs with ownership Stable component IDs include their declared ownership namespace.
sarj/naming/component-id error Name the application role Application names end in a controlled deployable role. sarj/naming/application-role warning Use kebab-case capabilities Capabilities use one lowercase ASCII kebab-case token. sarj/naming/capability-token error Reuse
Component schema
Delivery & CI
8 rulesGitHub Actions
Declare Actions permissions GitHub workflows declare token permissions explicitly.
sarj/github/explicit-permissions warning Handle merge-group events An inspected workflow handles merge-group events when a merge queue is active. sarj/github/merge-queue-trigger warning Keep scanner failures blocking Recognized vulnerability scanner failures propagate to CI. sarj/github/vulnerability-gate warning Pin workflow dependencies Non-local workflow dependencies are pinned to immutable digests. sarj/github/actions-sha-pinning warning Set job timeouts Executable GitHub Actions jobs have explicit time bounds. sarj/github/job-timeouts warning Use lock-enforcing installs Recognized CI installs use lock-enforcing modes. sarj/github/immutable-installs warning Repository governance
Release flow
Change safety
7 rulesMigrations
Commit files at the migration target Every declared migration target contains at least one tracked file.
core/migration/target-missing warning Do not track Node install artifacts during migrations A tree with declared migrations does not track node_modules files or Yarn install state. core/migration/tracked-install-artifacts warning Empty or reassign the migration source A moved component leaves no unowned tracked files at its old root. core/migration/source-retained warning Keep moved packages in their workspace A relocated package remains selected by every same-ecosystem workspace that selected its old path. core/migration/workspace-membership-lost warning Move one component at a time One selected Git tree declares at most one component relocation. core/migration/batch-too-large warning Baselines
Exceptions
API contracts
11 rulesAPI security
Exposure conflicts with authentication Declared exposure agrees with effective OpenAPI security.
rest/security/exposure-contradiction error Literal HTTP server URL Literal OpenAPI server URLs use transport security. rest/security/insecure-server warning OAuth implicit flow OAuth schemes prefer code-based flows over the legacy implicit flow. rest/security/oauth-implicit-grant warning OAuth password flow OAuth schemes avoid exposing resource-owner credentials to clients. rest/security/oauth-password-grant error