@fabriziosalmi/slopless 1.15.2 → 1.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.15.2",
+  "version": "1.16.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-001.yaml

@@ -28,6 +28,11 @@ match:
     - py
     - env
     - yaml
+    # Both spellings. This rule was the only one that read YAML at all and it
+    # named one of them, while `.yml` is the commoner of the two — 401 against
+    # 213 across the repositories this was measured on, and it is what GitHub
+    # workflows are called.
+    - yml
     - json
     - astro
   # A credential in a test is a fixture. Ten of the eleven findings this rule

package/rules/VBC-018.yaml

@@ -6,6 +6,11 @@ tags:
   - clean-code
 match:
   regex: console\.(log|info|debug|dir)\(
+  # A file that opens with a shebang is run directly, and what it prints is its
+  # interface. Telling a CLI to route its own report through "a professional
+  # logging library" is advice that would break the thing it is aimed at, and it
+  # was 26 of the 35 findings this rule produced against slopless itself.
+  exclude_programs: true
   file_types:
     - js
     - ts
@@ -19,3 +24,8 @@ tests:
     - console.log("debug me");
   quiet:
     - logger.info("started");
+    # A program's output is not a leftover.
+    - file: cli.js
+      code: |
+        #!/usr/bin/env node
+        console.log("2 errors, 5 warnings");

package/rules/VBC-504.yaml

@@ -18,3 +18,9 @@ tests:
     - const filePath = req.query.path;
     - const fakeFs = createFakeFs();
     - const res = await api.getNotes();
+    # Importing a module under its own name is not shadowing it. This is how
+    # every Node file in existence spells it, and it was twelve of the twelve
+    # findings this rule produced against slopless itself.
+    - const fs = require('fs');
+    - const path = require('path');
+    - const crypto = require('node:crypto');