RULE DIRECTORY / 163

All rules

Search by behavior, diagnostic code, language, or historical alias.

Find a rule / Clear

163 rules

Rule	Engine	Category	Default
duplicate-test-body Disallow substantial sibling tests with the same body shape; express their differing inputs as a parameterized case table.	TypeScript	testing	error
enforce-file-structure Require imports before body statements and require `use server` to be the first statement.	TypeScript	correctness	error
no-async-callback-in-wait-for Disallow async callbacks in `waitFor` to prevent swallowed promise rejections.	TypeScript	testing	error
no-client-side-data-fetching Disallow direct data fetching inside `useEffect` or `useLayoutEffect`.	TypeScript	performance	error
no-comment-cruft Flag commented-out code, section-banner comments, and leading file-header comment preambles.	TypeScript	maintainability	error
no-conditional-in-test Disallow test conditionals that can skip a runtime assertion or exit the test before one runs.	TypeScript	testing	error
no-cors-wildcard-with-credentials Disallow wildcard CORS origins when credentials are enabled.	TypeScript	security	error
no-declaration-comment-wall Flag an enum body or class body whose member comments mostly re-spell the members' own names.	TypeScript	maintainability	error
no-dynamic-sql Disallow runtime interpolation or concatenation in SQL passed to statement-execution methods.	TypeScript	security	error
no-enum Disallow TypeScript `enum`; use string-literal unions or `as const` objects instead.	TypeScript	maintainability	error
no-fat-try-blocks Disallow `try` blocks containing more than three top-level operations that can throw.	TypeScript	correctness	error
no-generic-single-export-module Disallow generic module stems when one runtime export already names the responsibility.	TypeScript	maintainability	error
no-hand-rolled-sleep Disallow uncancellable promisified timers and timeout arms.	TypeScript	correctness	error
no-hand-rolled-spinner Disallow intrinsic elements styled as Tailwind border-ring spinners outside the design-system implementation.	TypeScript	maintainability	error
no-impossible-zod-literal-bounds Disallow same-chain literal Zod bounds whose accepted set is mathematically empty.	TypeScript	correctness	error
no-insecure-random-id Disallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead.	TypeScript	security	error
no-json-stringify-error Disallow `JSON.stringify` on an Error value; it yields `{}` because `message`/`stack` are non-enumerable.	TypeScript	correctness	error
no-log-only-catch Disallow `catch` clauses that only log (or silently do nothing) and then swallow the error; rethrow or handle it instead.	TypeScript	correctness	error
no-long-comment Flag unusually large unstructured prose blocks in implementation code.	TypeScript	maintainability	error
no-offset-pagination Disallow OFFSET pagination in embedded SQL; it is O(N) per page and drops or repeats rows under concurrent writes. Use a keyset cursor.	TypeScript	performance	error
no-positional-tuple-return Disallow returning a multi-field tuple from an exported function; return a named object so call sites cannot mismatch slots.	TypeScript	maintainability	error
no-raw-env Disallow direct `process.env` and `import.meta.env` reads outside validated boundaries.	TypeScript	correctness	error
no-raw-fetch-outside-clients Disallow calling the global `fetch` outside the client layer; route outbound HTTP through a client module that owns retry, timeout and status handling.	TypeScript	architecture	error
no-repeated-string-literal Disallow a long structured string literal repeated across functions; the copies drift when one is edited. Extract a module-level constant.	TypeScript	maintainability	error
no-restated-comment Flag a single-line comment whose every word already appears on the statement below it.	TypeScript	maintainability	error
no-restated-jsdoc Flag a JSDoc block whose description and tags only re-spell the signature they document.	TypeScript	maintainability	error
no-restricted-library-load Apply a configured library-replacement policy to literal dynamic imports, CommonJS loads, and TypeScript import-equals declarations.	TypeScript	architecture	error
no-secret-in-log Disallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit.	TypeScript	security	error
no-select-star Disallow SELECT * in embedded SQL; it over-fetches and leaves the row contract implicit, so a schema change breaks row parsing silently.	TypeScript	correctness	error
no-sentinel-return-on-catch Disallow swallowing a caught error by returning an empty sentinel unless the error is handled or the sentinel is part of the function contract.	TypeScript	correctness	error
no-silent-promise-catch Disallow `.catch()` and second-argument `.then()` handlers that silently swallow a rejection; log, rethrow, or handle the error.	TypeScript	correctness	error
no-sleep-in-test-body Disallow a fixed timed sleep directly in a test body; it flakes under CI load. Synchronize on the signal or use fake timers.	TypeScript	testing	error
no-storage-in-stateless-modules Disallow SQL or key/value access inside configured stateless modules; derive state from a system of record instead.	TypeScript	architecture	error
no-string-concat-in-loop Disallow O(n^2) string building via `+=` on a string variable inside a loop; push parts to an array and `join` instead.	TypeScript	performance	error
no-tautological-expect Disallow an assertion whose operands are all literals; its outcome is fixed before the code runs, so it can never fail.	TypeScript	testing	error
no-trailing-value-narration Flag a trailing comment that repeats the line's numeric value only to name its unit.	TypeScript	maintainability	error
no-type-member-comment-wall Flag an object type whose member comments mostly re-spell the members' own names and types.	TypeScript	maintainability	error
no-typed-doc-sections Reject typed-signature repetition while preserving behavior that types cannot express.	TypeScript	maintainability	error
no-union-in-comment Flag a comment that lists a `string` field's allowed values instead of the type listing them.	TypeScript	correctness	error
no-unnecessary-use-client Flag `'use client'` files with no hooks or event handlers — they could be RSC.	TypeScript	performance	error
no-unsafe-mock-casting Disallow casting to mock types like `jest.Mock` or `vi.Mock`. Use `vi.mocked()` or `jest.mocked()` instead.	TypeScript	testing	error
no-zod-native-enum Disallow `z.nativeEnum()` (and `z.enum()` over a TypeScript enum); use `z.enum(["a", "b"])` with a string-literal union instead.	TypeScript	maintainability	error
prefer-constant-time-secret-compare Disallow `===`/`!==` on a secret-like value; short-circuiting comparison leaks the secret through timing. Use a constant-time compare.	TypeScript	security	error
prefer-discriminated-union Flag flat result objects with a required positive boolean status and optional success/failure payloads.	TypeScript	correctness	error
prefer-immutable-module-constant Require module-level constant collections to expose readonly state.	TypeScript	correctness	error
prefer-input-group-search Require search icons and shared Input controls in the same visual wrapper to use InputGroup.	TypeScript	style	error
prefer-module-level-constant Hoist literal-only constant collections and regexes out of function bodies to module scope so they are allocated once.	TypeScript	performance	error
prefer-module-level-schema Declare a Zod schema at module scope when it closes over nothing in the enclosing function	TypeScript	performance	error
prefer-native-random-uuid Prefer `globalThis.crypto.randomUUID()` over resolved zero-argument UUID v4 bindings from the `uuid` package.	TypeScript	maintainability	error
prefer-non-nullable-collection Suggest non-null arrays only when local control flow proves the nullish state is equivalent to an empty collection.	TypeScript	maintainability	error
prefer-schema-for-api-payload Require Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access.	TypeScript	correctness	error
prefer-semantic-colors Enforce semantic color tokens over raw Tailwind palette classes, arbitrary color values, and inline color literals.	TypeScript	style	error
prefer-server-actions Prefer Next.js Server Actions over /api/* mutations.	TypeScript	architecture	error
prefer-shadcn-primitives Require visible raw JSX controls to use the corresponding shared shadcn primitive.	TypeScript	style	error
prefer-whole-object-assertion Collapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together.	TypeScript	testing	error
prefer-zod-infer Derive a type from its Zod schema with `z.infer` instead of hand-writing a twin declaration beside it.	TypeScript	correctness	error
require-assert-never Require an empty switch default to call `assertNever` so discriminated unions remain exhaustive at compile time.	TypeScript	correctness	error
require-fetch-timeout Require an abort `signal` (e.g. `AbortSignal.timeout(ms)`) on global `fetch()` calls so stalled upstreams cannot hang the caller forever.	TypeScript	correctness	error
require-port-for-service Advise when an exported service with injected collaborators has public methods not covered by its declared ports.	TypeScript	architecture	error
require-static-next-matcher Require Next.js middleware and proxy matcher configuration to contain only build-time literals.	TypeScript	correctness	error
require-zod-form-validation Require Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object.	TypeScript	security	error
stepdown Place a private helper below its sole direct same-scope caller.	TypeScript	maintainability	error
store-insert-requires-on-conflict Require an embedded SQL INSERT to carry ON CONFLICT; store writes replay under cron re-runs and queue redelivery and must be idempotent upserts.	TypeScript	correctness	error
test-loops-over-literal-cases Disallow assertions over an inline literal case loop in a test; parameterization reports and names every case independently.	TypeScript	testing	error
zod-naming-convention Enforce a consistent Zod schema naming convention — a `Z` prefix (`ZUser`) or a `Schema` suffix (`userSchema`); both are accepted by default.	TypeScript	style	error
no-comment-cruft Commented-out Terraform/IaC or a section-banner comment — delete it; code carries the what, comments only the why.	IaC	maintainability	error
require-deletion-protection Stateful resource (Cloud SQL, GKE, BigQuery, RDS, ...) must set deletion_protection = true so a stray apply cannot destroy prod data.	IaC	security	error
require-prevent-destroy-on-irreplaceable Bucket, secret, or artifact registry must use a supported literal provider-side deletion guard or lifecycle { prevent_destroy = true }.	IaC	security	error
conditional-assertion-in-test Tests should guarantee that at least one assertion runs on every execution path.	Python	testing	error
defect-xfail-requires-strict Bug-pinning `xfail` without `strict=True` — an XPASS reports as a pass and the pin rots.	Python	testing	error
docstring-args-restate-signature Argument documentation must add facts beyond the function signature.	Python	maintainability	error
docstring-returns-restate-signature Return documentation must add facts beyond the function name and annotation.	Python	maintainability	error
duplicate-test-body Similar test bodies should be represented as one named parameterized case table.	Python	testing	error
duplicated-override-docstring Remove an override docstring copied verbatim from its local base method.	Python	maintainability	error
fastapi-openapi-contract FastAPI operations must publish explicit request, response, and OpenAPI contracts.	Python	correctness	error
fixture-returns-bare-tuple Fixture returns a bare multi-field tuple — return a NamedTuple so consumers destructure by name.	Python	testing	error
interaction-only-test Tests should verify outcomes, not only mock interaction bookkeeping.	Python	testing	error
invalid-pydantic-field-default Require literal Pydantic `Field` defaults to satisfy their declared contract.	Python	correctness	error
kwarg-heavy-construction-in-test Object built with many keywords inline in a test — extract a helper with defaults.	Python	testing	error
mock-without-spec Mock built without `spec=`/`autospec=` — it accepts any attribute and cannot rot loudly.	Python	testing	error
no-aggregation-in-store-query Postgres store queries should not perform analytical aggregation.	Python	architecture	error
no-comment-cruft Comment repeats code, preserves dead code, or adds a decorative section marker.	Python	maintainability	error
no-cors-wildcard-with-credentials Credentialed CORS must not allow a wildcard origin.	Python	security	error
no-duplicate-dunder-all-entry static package `__all__` declarations should list each exported name once	Python	correctness	error
no-fat-try-blocks Keep a `try` body narrow enough to identify which operation a handler covers.	Python	correctness	error
no-file-level-escape-hatch-noqa File-level Ruff noqa suppresses an escape-hatch rule across the entire file.	Python	maintainability	error
no-file-level-suppression Unscoped file-level suppressions disable a checker for the entire file, including diagnostics added later.	Python	maintainability	error
no-first-party-private-import Code imports a private name or module from another first-party package.	Python	architecture	error
no-frozen-after-validator-field-write Do not assign declared fields in after-validators on frozen Pydantic models.	Python	correctness	error
no-gen-random-uuid-in-sql Embedded SQL calls gen_random_uuid() instead of uuidv7().	Python	performance	error
no-generic-single-export-module A generic module with one public definition should be named after that definition.	Python	architecture	error
no-hidden-constructor-fallback Constructor option silently falls back to application settings when omitted.	Python	architecture	error
no-isinstance-union-chain Use exhaustive pattern matching for dispatch over a local closed class union.	Python	correctness	error
no-long-comment Long docstrings must use deliberate documentation structure or technical anchors.	Python	maintainability	error
no-offset-pagination Store queries should use keyset cursors instead of `OFFSET` pagination.	Python	performance	error
no-optional-tenant-predicate Tenant predicate is added only conditionally, allowing an unscoped query.	Python	security	error
no-query-with-many-joins Store queries should use at most two explicit or implicit joins.	Python	architecture	error
no-raw-sql-in-tests Tests should seed records through store or service methods instead of raw SQL inserts.	Python	testing	error
no-repeated-string-literal Structured string literals repeated across functions should use a module constant.	Python	maintainability	error
no-restated-comment Comment restates the statement immediately below it.	Python	maintainability	error
no-secret-in-log Secret-like value is passed to a logging call under a secret-like keyword.	Python	security	error
no-select-star Store queries should select explicit columns instead of `*`.	Python	maintainability	error
no-sentinel-return-on-except Exception handler silently converts a failure into a sentinel return value.	Python	correctness	error
no-sleep-in-test-body Tests should synchronize on observable state instead of waiting a fixed duration.	Python	testing	error
no-stdlib-logging Application code imports standard-library logging instead of the configured house logger.	Python	architecture	error
no-string-concat-in-loop Do not grow one string with repeated concatenation inside a loop.	Python	performance	error
no-tautological-expect Assertion outcome is fixed entirely by literal values.	Python	testing	error
no-typed-doc-sections Docstring sections must not repeat types already present in a fully typed signature.	Python	maintainability	error
opaque-parametrize-case-needs-id Opaque `parametrize` case with no `ids=`/`id=` — the failing case reports as `case0`.	Python	testing	error
over-mocked-test Tests should not replace more than five distinct collaborators.	Python	testing	error
prefer-class-row Use a validated model row instead of Psycopg `dict_row`.	Python	correctness	error
prefer-constant-time-secret-compare Secret-like values are compared with timing-sensitive equality operators.	Python	security	error
prefer-fstring-over-concat Build short strings with f-strings instead of concatenating literals and known strings.	Python	style	error
prefer-immutable-module-constant module-level constant collections expose mutable shared state; use tuple, frozenset, or an immutable mapping	Python	maintainability	error
prefer-library-fake Tests should use maintained service fakes or emulators instead of hand-rolled third-party doubles.	Python	testing	error
prefer-match-assert-never Closed-set dispatch should fail explicitly when a variant is unhandled.	Python	correctness	error
prefer-match-type-dispatch Use `match` for explicit runtime type dispatch instead of branching parser machinery.	Python	maintainability	error
prefer-module-level-constant Literal-only collections and compiled regular expressions built inside a function should be module-level constants.	Python	performance	error
prefer-namedtuple-over-tuple-return Public functions should return named records instead of fixed positional tuples.	Python	maintainability	error
prefer-nominal-id-types Production boundaries with multiple ID roles must distinguish them with nominal types.	Python	correctness	error
prefer-non-nullable-collection Avoid nullable list parameters when local use proves `None` and an empty list are equivalent.	Python	correctness	error
prefer-or-pattern Merge adjacent `case` arms with identical bodies into one or-pattern.	Python	maintainability	error
prefer-real-store-in-tests Tests should exercise the real persistence implementation instead of an in-memory reimplementation.	Python	testing	error
prefer-self-documenting-constant Encode a constant's units or HTTP status meaning in its name, type, or value.	Python	maintainability	error
prefer-self-type-annotation Annotate fluent methods and alternate constructors with `Self`.	Python	correctness	error
prefer-str-enum Represent corroborated closed string domains with `StrEnum` or a named `Literal` alias.	Python	correctness	error
prefer-struct-over-namedtuple `collections.namedtuple` creates an untyped, positionally constructed record.	Python	maintainability	error
prefer-timedelta-for-durations Duration-bearing name is typed as a raw integer or float.	Python	correctness	error
prefer-walrus-comprehension-filter Evaluate a repeated comprehension call once with a named expression.	Python	performance	error
prefer-walrus-regex-match Bind a regex result in the `if` condition that immediately tests it.	Python	style	error
prefer-walrus-stream-loop Bind each stream value in the `while` condition instead of using an explicit break.	Python	maintainability	error
pydantic-at-boundaries Public function or route returns a fixed-shape untyped dictionary.	Python	architecture	error
redundant-class-docstring Class docstrings must add information beyond the class name and bases.	Python	maintainability	error
redundant-docstring Docstring only restates the signature — delete the whole docstring or document behavior callers cannot infer.	Python	maintainability	error
redundant-module-docstring Module docstrings must add information beyond the file path.	Python	maintainability	error
require-keyword-only-swap-prone-params Swap-prone parameters with the same primitive type should be keyword-only.	Python	correctness	error
require-port-for-service Consider a consumer-owned port for a service with a behaviorally used collaborator.	Python	architecture	error
restated-test-docstring Test docstrings must add information beyond the test name and body.	Python	testing	error
sleep-with-computed-arg-in-test Computed `sleep()` in a test body — synchronize on the signal, don't guess a delay.	Python	testing	error
stepdown A private helper used by one caller should be defined below that caller.	Python	maintainability	error
store-insert-requires-on-conflict Embedded SQL inserts in store code must handle conflicts explicitly.	Python	correctness	error
test-loops-over-literal-cases Test loops over a literal case table — use `@pytest.mark.parametrize` so cases report separately.	Python	testing	error
test-phase-label-comment Tests must not use bare Arrange, Act, Assert, Given, When, or Then phase comments.	Python	testing	error
trailing-value-narration Trailing comment restates a literal value and its unit.	Python	maintainability	error
trivially-true-assertion Assertions should depend on behavior rather than echoing values supplied by the test.	Python	testing	error
unused-mock-setup Tests should remove mock configuration that cannot affect execution.	Python	testing	error
zero-assertion-test Test contains no assertion of any kind — it passes as long as nothing raises.	Python	testing	error
add-constraint-requires-not-valid ADD CONSTRAINT (CHECK/FK) without NOT VALID blocks writes during full-table validation.	SQL	performance	error
enforce-timestamptz TIMESTAMP without TIME ZONE — use TIMESTAMPTZ.	SQL	correctness	error
idempotent-ddl DDL without IF [NOT] EXISTS — migrations must be safe to re-run.	SQL	correctness	error
index-concurrently CREATE INDEX without CONCURRENTLY — locks the table against writes.	SQL	performance	error
insert-requires-on-conflict INSERT without ON CONFLICT — migration data writes must be idempotent upserts.	SQL	correctness	error
no-offset-pagination OFFSET pagination — use cursor pagination (WHERE id > :cursor).	SQL	performance	error
no-pg-enum CREATE TYPE ... AS ENUM — use TEXT + CHECK constraint instead.	SQL	maintainability	error
prefer-jsonb JSON column type or ::json cast — use JSONB.	SQL	performance	error
prefer-text-over-varchar VARCHAR(n) — use TEXT (+ CHECK length if needed).	SQL	maintainability	error
prefer-uuidv7-default `gen_random_uuid()` emits a random UUIDv4 — use `uuidv7()` so keys are time-ordered.	SQL	performance	error
require-fk-index FOREIGN KEY column missing index — causes full-table scans and locks on parent row deletes.	SQL	performance	error
require-lock-timeout DDL migration missing positive SET [LOCAL] lock_timeout or statement_timeout prior to DDL.	SQL	correctness	error
commented-out-config commented-out config syntax	Text	maintainability	error
config-comment-wall four-entry config narration wall with 75% weak restatements	Text	maintainability	error
ephemeral-execution-artifact ephemeral execution brief, audit report, or change diary	Text	maintainability	error
unpinned-github-action remote GitHub Action or container action without an immutable digest	Text	security	error