@fabriziosalmi/slopless 1.4.6 → 1.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.4.6",
+  "version": "1.6.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {
@@ -22,7 +22,7 @@
     "verify:bundle": "node scripts/verify-bundle.js",
     "verify:action": "bash scripts/run-action-locally.sh . 'src/**/*.ts'",
     "release:prep": "npm run docs:gen && npm run build && npm test && npm run verify:bundle",
-    "version": "npm run build && git add dist"
+    "version": "npm run docs:gen && npm run build && git add dist docs README.md"
   },
   "keywords": [
     "linter",
@@ -42,14 +42,14 @@
   },
   "type": "commonjs",
   "devDependencies": {
-    "@types/glob": "^8.1.0",
+    "@types/glob": "^9.0.0",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.3.0",
+    "@types/node": "^26.4.0",
     "@vitest/coverage-v8": "^4.0.18",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "glob": "^13.0.6",
     "ignore": "^7.0.5",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^5.4.1",
     "minimatch": "^10.2.6",
     "ts-node": "^10.9.2",
     "tsup": "^8.5.1",

package/rules/VBC-003.yaml

@@ -10,6 +10,9 @@ match:
     - sh
     - py
     - js
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
   exclude_files:
     - '**/test/**'
     - '**/tests/**'

package/rules/VBC-015.yaml

@@ -11,6 +11,9 @@ match:
     - js
     - ts
     - py
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
   exclude_files:
     - '**/test/**'
     - '**/tests/**'

package/rules/VBC-019.yaml

@@ -13,6 +13,9 @@ match:
     - ts
     - py
     - sh
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
   exclude_files:
     - '**/test/**'
     - '**/tests/**'

package/rules/VBC-034.yaml

@@ -13,6 +13,9 @@ match:
     - ts
     - py
     - html
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
   exclude_files:
     - '**/test/**'
     - '**/tests/**'

package/rules/VBC-039.yaml

@@ -5,14 +5,21 @@ category: core
 tags:
   - security
 match:
-  regex: eval\(
+  regex: (?<![.\w])eval\s*\(
   file_types:
     - js
     - ts
+    - py
+    - rb
+    - php
 message: >-
   Use of 'eval()' detected at line {line}. This is a massive security risk.
 tests:
   fire:
     - eval(userInput);
+    - { file: a.py, code: 'result = eval(expr)' }
   quiet:
     - JSON.parse(userInput);
+    # PyTorch puts a model into evaluation mode several times per script.
+    - { file: a.py, code: 'model.eval()' }
+    - { file: a.py, code: 'if is_eval(node): pass' }

package/rules/VBC-042.yaml

@@ -9,6 +9,7 @@ match:
   flags: m
   multiline: true
   scan: all
+  exclude_doc_comments: true
   file_types:
     - js
     - ts
@@ -17,10 +18,37 @@ message: >-
   Too many consecutive comment lines at line {line}. Code should be self-documenting.
 tests:
   fire:
-    - code: |
-        // filler comment line
-      repeat: 12
+    # Below the first line of code, so it is commentary rather than a header.
+    - |
+      const answer = 42;
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
+      // filler comment line
   quiet:
     - |
       // one explanatory comment
       const answer = 42;
+    # A banner at the top of a file explains what the file is. Counting it as
+    # excess commentary reported 79 module headers in one project.
+    - |
+      // ─────────────────────────────
+      // Wasm Core Bridge
+      //
+      // Lazy-loads the Rust module.
+      // All functions go through this singleton.
+      //
+      // Usage:
+      //   import { core } from './bridge';
+      //   const c = await core();
+      //
+      // ─────────────────────────────
+      import { core } from './bridge';

package/rules/VBC-049.yaml

@@ -5,15 +5,40 @@ category: clean-code
 tags:
   - clean-code
 match:
-  regex: \b[a-zA-Z0-9_]+\((true|false)\s*,
+  # `store` and `swap` take the value first: `flag.store(false, Ordering::Relaxed)`
+  # is the atomic API, not an opaque flag. `Option(False, "--dry-run", ...)` is a
+  # CLI default followed by the very name that documents it.
+  regex: >-
+    \b(?!(?:store|swap|compare_exchange|compare_and_swap|Option)\b)[a-zA-Z0-9_]+\((true|false|True|False)\s*,
   file_types:
     - js
     - ts
+    - py
+    - go
+    - rs
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/*_test.go'
+    - '**/*.test.*'
+    - '**/*.spec.*'
 message: >-
   Magic boolean passed as first argument at line {line}. Use named parameters or a descriptive
   variable.
 tests:
   fire:
     - renderList(true, items);
+    - { file: a.py, code: 'toggle_server(True, port)' }
+    - { file: a.rs, code: 'format_warn(false, "health", msg);' }
   quiet:
     - 'renderList({ compact: true }, items);'
+    # The atomic API takes the value first; the ordering that follows is not a flag.
+    - { file: a.rs, code: 'healthy.store(false, Ordering::Relaxed);' }
+    # A CLI default, followed by the very name that documents it.
+    - { file: a.py, code: 'dry_run: bool = typer.Option(False, "--dry-run")' }

package/rules/VBC-096.yaml

@@ -6,6 +6,9 @@ tags:
   - clean-code
 match:
   regex: /(?:[^/\n\\]|\\.){30,}/[dgimsuvy]*
+  # Regular expression literals and nothing else. Reading strings found the
+  # slashes in a translation file; reading code found the ones in a division.
+  scan: regex
   file_types:
     - js
     - ts

package/rules/VBC-901.yaml

@@ -16,6 +16,9 @@ match:
     - java
     - json
     - env
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
   exclude_files:
     - '**/test/**'
     - '**/tests/**'

package/rules/VBC-917.yaml

@@ -7,9 +7,17 @@ tags:
   - style
 match:
   regex: \b[A-Z]{3,}\b(?:\s+\b[A-Z]{2,}\b){3,}
+  # In a source file, prose lives in comments. Without this the rule would read
+  # a run of constants as shouting, and miss the comment that actually shouts.
+  scan: comments
   file_types:
     - md
     - txt
+    - py
+    - go
+    - rs
+    - js
+    - ts
 opt_in: true
 message: >-
   Sustained all-caps text at line {line}. Shouting does not add emphasis, it costs readability.

package/rules/VBC-921.yaml

@@ -18,6 +18,9 @@ match:
     - go
     - rs
     - html
+  # The same decision as the paths below, for languages that keep their
+  # tests in the file they test.
+  exclude_test_code: true
   exclude_files:
     - '**/test/**'
     - '**/tests/**'

package/rules/VBC-928.yaml

@@ -8,13 +8,18 @@ tags:
 match:
   regex: Lorem ipsum dolor sit amet
   flags: i
-  scan: strings
+  scan: all
   file_types:
     - md
     - txt
     - html
     - js
     - ts
+    - py
+    - go
+    - rs
+    - java
+    - sh
 message: >-
   Placeholder text 'Lorem ipsum' detected at line {line}. Replace with real content before
   committing.