@opensip-tools/fitness 1.0.4

package/src/recipes/built-in-recipes.ts

@@ -0,0 +1,273 @@
+/**
+ * @fileoverview Built-in fitness recipe definitions
+ *
+ * Defines the standard set of recipes (default, quick-smoke, backend, etc.)
+ * that ship with the fitness framework.
+ */
+
+import { DEFAULT_MAX_PARALLEL, defineRecipe, type FitnessRecipe } from './types.js'
+
+// =============================================================================
+// DEFAULT RECIPE
+// =============================================================================
+
+/** Default recipe: runs all enabled checks in parallel */
+const defaultRecipe: FitnessRecipe = defineRecipe({
+  name: 'default',
+  displayName: 'Default',
+  description: 'Run all enabled checks in parallel',
+  checks: { type: 'all' },
+  execution: { mode: 'parallel', stopOnFirstFailure: false, timeout: 30_000 },
+  reporting: { format: 'table', verbose: false },
+  tags: ['comprehensive', 'default'],
+})
+
+// =============================================================================
+// QUICK SMOKE RECIPE
+// =============================================================================
+
+/** Quick smoke recipe: fast critical checks for rapid validation */
+const quickSmokeRecipe: FitnessRecipe = defineRecipe({
+  name: 'quick-smoke',
+  displayName: 'Quick Smoke',
+  description: 'Fast critical checks for rapid validation',
+  checks: {
+    type: 'explicit',
+    checkIds: [
+      'no-console-log',
+      'no-any-types',
+      'null-safety',
+      'detached-promises',
+      'catch-clause-safety',
+      'error-handling-quality',
+      'no-hardcoded-secrets',
+      'no-eval',
+      'sql-injection',
+      'env-secret-exposure',
+      'input-sanitization',
+      'no-focused-tests',
+      'no-skipped-tests',
+    ],
+  },
+  execution: { mode: 'parallel', stopOnFirstFailure: false, timeout: 15_000 },
+  reporting: { format: 'table', verbose: false },
+  tags: ['fast', 'smoke', 'critical'],
+})
+
+// =============================================================================
+// BACKEND RECIPE
+// =============================================================================
+
+/** Backend recipe: architecture, resilience, and quality checks for server code */
+const backendRecipe: FitnessRecipe = defineRecipe({
+  name: 'backend',
+  displayName: 'Backend',
+  description: 'Backend-focused checks (architecture, resilience, quality)',
+  checks: {
+    type: 'pattern',
+    include: [
+      'architecture/*',
+      'resilience/*',
+      'quality/*-backend',
+      'quality/fastify-*',
+      'quality/database-*',
+      'quality/pino-*',
+      'quality/logging-*',
+      'quality/correlation-*',
+      'quality/no-console-log',
+      'quality/result-pattern-*',
+      'quality/api-*',
+      'quality/null-safety',
+      'quality/no-any-types',
+      'quality/file-headers',
+      'quality/concurrency-safety',
+      'quality/error-swallowing-*',
+      'security/*',
+      'testing/*',
+    ],
+    exclude: ['quality/*-frontend', 'testing/*-frontend'],
+  },
+  execution: { mode: 'parallel', stopOnFirstFailure: false, timeout: 30_000 },
+  reporting: { format: 'table', verbose: false },
+  tags: ['backend', 'server', 'api'],
+})
+
+// =============================================================================
+// FRONTEND RECIPE
+// =============================================================================
+
+/** Frontend recipe: React and accessibility checks for UI code */
+const frontendRecipe: FitnessRecipe = defineRecipe({
+  name: 'frontend',
+  displayName: 'Frontend',
+  description: 'Frontend-focused checks (React, accessibility)',
+  checks: {
+    type: 'pattern',
+    include: [
+      'quality/*-frontend',
+      'quality/accessible-*',
+      'quality/navigation-*',
+      'quality/theme-*',
+      'quality/image-*',
+      'quality/lazy-*',
+      'quality/no-inline-functions',
+      'quality/async-state-*',
+      'quality/no-any-types',
+      'quality/null-safety',
+      'architecture/heavy-import-detection',
+      'testing/no-focused-tests',
+      'testing/no-skipped-tests',
+      'testing/*-frontend',
+    ],
+    exclude: ['quality/*-backend', 'testing/*-backend'],
+  },
+  execution: { mode: 'parallel', stopOnFirstFailure: false, timeout: 30_000 },
+  reporting: { format: 'table', verbose: false },
+  tags: ['frontend', 'react', 'ui'],
+})
+
+// =============================================================================
+// SECURITY RECIPE
+// =============================================================================
+
+/** Security recipe: comprehensive security audit checks */
+const securityRecipe: FitnessRecipe = defineRecipe({
+  name: 'security',
+  displayName: 'Security Audit',
+  description: 'Comprehensive security analysis',
+  checks: {
+    type: 'pattern',
+    include: [
+      'security/*',
+      'quality/pii-*',
+      'quality/dependency-security-*',
+      'quality/centralized-input-*',
+      'quality/security-*',
+      'quality/no-console-log',
+      'resilience/no-custom-cache',
+      'resilience/no-custom-rate-limiter',
+      'resilience/context-leakage',
+    ],
+  },
+  execution: { mode: 'sequential', stopOnFirstFailure: false, timeout: 60_000 },
+  reporting: { format: 'table', verbose: true },
+  tags: ['security', 'audit', 'comprehensive'],
+})
+
+// =============================================================================
+// PRE-COMMIT RECIPE
+// =============================================================================
+
+/** Pre-commit recipe: fast checks suitable for git pre-commit hooks */
+const preCommitRecipe: FitnessRecipe = defineRecipe({
+  name: 'pre-commit',
+  displayName: 'Pre-Commit',
+  description: 'Fast checks for git pre-commit hooks',
+  checks: {
+    type: 'explicit',
+    checkIds: [
+      'no-console-log',
+      'no-any-types',
+      'no-hardcoded-secrets',
+      'detached-promises',
+      'no-focused-tests',
+      'no-skipped-tests',
+    ],
+  },
+  execution: { mode: 'parallel', stopOnFirstFailure: true, timeout: 10_000 },
+  reporting: { format: 'table', verbose: false },
+  tags: ['fast', 'hook', 'pre-commit'],
+})
+
+// =============================================================================
+// PRE-RELEASE RECIPE
+// =============================================================================
+
+/** Pre-release recipe: comprehensive checks run before a release */
+const preReleaseRecipe: FitnessRecipe = defineRecipe({
+  name: 'pre-release',
+  displayName: 'Pre-Release',
+  description: 'Comprehensive checks before release',
+  checks: { type: 'all' },
+  execution: { mode: 'sequential', stopOnFirstFailure: false, timeout: 120_000 },
+  reporting: { format: 'unified', verbose: true },
+  tags: ['comprehensive', 'release', 'thorough'],
+})
+
+// =============================================================================
+// NIGHTLY FULL RECIPE
+// =============================================================================
+
+/** Nightly full recipe: complete check suite for scheduled nightly runs */
+const nightlyFullRecipe: FitnessRecipe = defineRecipe({
+  name: 'nightly-full',
+  displayName: 'Nightly Full',
+  description: 'Complete suite for nightly scheduled runs',
+  checks: { type: 'all' },
+  execution: {
+    mode: 'parallel',
+    stopOnFirstFailure: false,
+    timeout: 300_000,
+    maxParallel: DEFAULT_MAX_PARALLEL,
+  },
+  reporting: { format: 'unified', verbose: true, outputPath: 'fitness-nightly-report.json' },
+  tags: ['nightly', 'comprehensive', 'scheduled'],
+})
+
+// =============================================================================
+// CI RECIPE
+// =============================================================================
+
+/** CI recipe: optimized for CI pipelines with JSON output */
+const ciRecipe: FitnessRecipe = defineRecipe({
+  name: 'ci',
+  displayName: 'CI',
+  description: 'Optimized for CI pipelines with JSON output',
+  checks: { type: 'all', exclude: ['testing/flaky-*', 'performance/*'] },
+  execution: { mode: 'parallel', stopOnFirstFailure: false, timeout: 60_000 },
+  reporting: { format: 'json', verbose: false },
+  tags: ['ci', 'pipeline', 'automated'],
+})
+
+// =============================================================================
+// ARCHITECTURE RECIPE
+// =============================================================================
+
+/** Architecture recipe: architecture validation and compliance checks */
+const architectureRecipe: FitnessRecipe = defineRecipe({
+  name: 'architecture',
+  displayName: 'Architecture Review',
+  description: 'Architecture validation and compliance',
+  checks: { type: 'tags', include: ['architecture'] },
+  execution: { mode: 'parallel', stopOnFirstFailure: false, timeout: 30_000 },
+  reporting: { format: 'table', verbose: true },
+  tags: ['architecture', 'structure'],
+})
+
+// =============================================================================
+// EXPORTS
+// =============================================================================
+
+/** All built-in fitness recipes */
+export const builtInRecipes: readonly FitnessRecipe[] = Object.freeze([
+  defaultRecipe,
+  quickSmokeRecipe,
+  backendRecipe,
+  frontendRecipe,
+  securityRecipe,
+  preCommitRecipe,
+  preReleaseRecipe,
+  nightlyFullRecipe,
+  ciRecipe,
+  architectureRecipe,
+])
+
+/** Map of built-in recipe name to recipe definition */
+export const builtInRecipesByName: ReadonlyMap<string, FitnessRecipe> = new Map(
+  builtInRecipes.map((recipe) => [recipe.name, recipe]),
+)
+
+/** Check whether a recipe name corresponds to a built-in recipe */
+export function isBuiltInRecipe(name: string): boolean {
+  return builtInRecipesByName.has(name)
+}

package/src/recipes/check-config.ts

@@ -0,0 +1,64 @@
+/**
+ * @fileoverview Per-check recipe configuration plumbing.
+ *
+ * Recipes can carry a `checks.config` map keyed by check slug. The recipe
+ * service projects this map into module-level state before any check runs
+ * (`setCurrentRecipeCheckConfig`) and clears it once the run completes
+ * (`clearCurrentRecipeCheckConfig`).
+ *
+ * Individual checks read their slice via `getCheckConfig<T>(slug)` —
+ * typically once at module load (when imported by the registry) or at the
+ * top of `analyze` — and merge it with their built-in defaults.
+ *
+ * This is the seam that lets us keep `@opensip-tools/checks-builtin`'s
+ * defaults to *generic* conventions (Node stdlib, well-known SDKs, common
+ * filename patterns) while letting downstream projects (like opensip)
+ * extend the safe-lists with project-specific names.
+ */
+
+import type { RecipeCheckConfigMap } from './types.js'
+
+/**
+ * Module-scoped current-recipe config. Populated by the recipe service at
+ * the start of a run and cleared at the end. Checks read from it lazily via
+ * {@link getCheckConfig}.
+ *
+ * Module-level singleton is acceptable here because a recipe service runs
+ * one session at a time (the service throws SESSION_IN_PROGRESS otherwise).
+ * If we ever support concurrent recipe runs in the same process, this needs
+ * to move into AsyncLocalStorage.
+ */
+let currentRecipeCheckConfig: RecipeCheckConfigMap | undefined
+
+/**
+ * Read the per-check config slice for the given slug.
+ *
+ * Returns an empty object when no recipe-config has been set or no entry
+ * exists for the slug — checks that call this should treat the result as
+ * "augmentation only" and merge with their own defaults.
+ *
+ * @typeParam T - The shape the calling check expects. Each check declares
+ *                its own config interface.
+ */
+export function getCheckConfig<T extends Record<string, unknown>>(slug: string): T {
+  if (!currentRecipeCheckConfig) return {} as T
+  const entry = currentRecipeCheckConfig[slug]
+  if (!entry) return {} as T
+  return entry as T
+}
+
+/**
+ * Replace the module-level recipe config. Called by the recipe service at
+ * the start of a recipe run, before any check executes.
+ */
+export function setCurrentRecipeCheckConfig(config: RecipeCheckConfigMap | undefined): void {
+  currentRecipeCheckConfig = config
+}
+
+/**
+ * Clear the module-level recipe config. Called by the recipe service at
+ * the end of a recipe run (success or failure).
+ */
+export function clearCurrentRecipeCheckConfig(): void {
+  currentRecipeCheckConfig = undefined
+}

package/src/recipes/check-resolution.ts

@@ -0,0 +1,169 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collections (config entries, registry items, or small analysis results)
+/**
+ * @fileoverview Check resolution for fitness recipes
+ *
+ * Resolves recipe check selectors (explicit, category, pattern, all)
+ * into concrete check slug lists using the check registry.
+ */
+
+import { SystemError } from '@opensip-tools/core'
+import { minimatch } from 'minimatch'
+
+import type { CheckSelector } from './types.js'
+import type { CheckRegistry } from '../framework/registry.js'
+
+
+/**
+ * Resolve a CheckSelector to a list of check slugs from the registry.
+ */
+export function resolveChecks(selector: CheckSelector, registry: CheckRegistry): readonly string[] {
+  const allCheckSlugs = registry.listSlugs()
+
+  switch (selector.type) {
+    case 'explicit': {
+      return resolveExplicitSelector(selector.checkIds, allCheckSlugs, registry)
+    }
+    case 'pattern': {
+      return resolvePatternSelector(selector.include, selector.exclude ?? [], allCheckSlugs, registry)
+    }
+    case 'tags': {
+      return resolveTagsSelector(selector.include, selector.exclude ?? [], registry)
+    }
+    case 'all': {
+      return resolveAllSelector(selector.exclude ?? [], allCheckSlugs, registry)
+    }
+    default: {
+      const _exhaustive: never = selector
+      throw new SystemError(`Unknown selector type: ${JSON.stringify(_exhaustive)}`, { code: 'SYSTEM.FITNESS.UNKNOWN_SELECTOR' })
+    }
+  }
+}
+
+function resolveExplicitSelector(
+  checkIds: readonly string[],
+  allCheckSlugs: readonly string[],
+  registry?: CheckRegistry,
+): readonly string[] {
+  const existingIds = new Set(allCheckSlugs)
+  const result: string[] = []
+
+  for (const id of checkIds) {
+    // Exact match (works for both namespaced and bare slugs already in registry)
+    if (existingIds.has(id)) {
+      result.push(id)
+      continue
+    }
+    // Bare slug → try registry resolution (handles namespace lookup)
+    if (registry && !id.includes(':')) {
+      const check = registry.getBySlug(id)
+      if (check) {
+        // Find the namespaced key for this check
+        const key = allCheckSlugs.find(s => s.endsWith(`:${id}`)) ?? id
+        result.push(key)
+      }
+    }
+  }
+  return result
+}
+
+function buildMatchTargets(slug: string, registry?: CheckRegistry): string[] {
+  const targets = [slug]
+  // Extract bare slug from namespaced key (e.g., 'builtin:no-eval' → 'no-eval')
+  const bareSlug = slug.includes(':') ? slug.split(':').pop()! : slug
+  if (bareSlug !== slug) targets.push(bareSlug)
+
+  if (registry) {
+    const check = registry.getBySlug(slug)
+    if (check?.config.tags) {
+      for (const tag of check.config.tags) {
+        targets.push(`${tag}/${bareSlug}`)
+      }
+    }
+  }
+  return targets
+}
+
+function resolvePatternSelector(
+  includePatterns: readonly string[],
+  excludePatterns: readonly string[],
+  allCheckSlugs: readonly string[],
+  registry?: CheckRegistry,
+): readonly string[] {
+  return allCheckSlugs.filter((slug) => {
+    const matchTargets = buildMatchTargets(slug, registry)
+
+    const included = includePatterns.some((pattern) =>
+      matchTargets.some((target) => minimatch(target, pattern, { nocase: false })),
+    )
+    if (!included) return false
+
+    const excluded = excludePatterns.some((pattern) =>
+      matchTargets.some((target) => minimatch(target, pattern, { nocase: false })),
+    )
+    return !excluded
+  })
+}
+
+function resolveTagsSelector(
+  includeTags: readonly string[],
+  excludeTags: readonly string[],
+  registry: CheckRegistry,
+): readonly string[] {
+  const includeSet = new Set(includeTags)
+  const excludeSet = new Set(excludeTags)
+  const allSlugs = registry.listSlugs()
+
+  return allSlugs.filter((key) => {
+    const check = registry.getBySlug(key)
+    if (!check) return false
+    const tags = check.config.tags ?? []
+    const hasInclude = tags.some((tag) => includeSet.has(tag))
+    if (!hasInclude) return false
+    const hasExclude = tags.some((tag) => excludeSet.has(tag))
+    return !hasExclude
+  })
+}
+
+function resolveAllSelector(
+  excludePatterns: readonly string[],
+  allCheckSlugs: readonly string[],
+  registry?: CheckRegistry,
+): readonly string[] {
+  if (excludePatterns.length === 0) return allCheckSlugs
+
+  return allCheckSlugs.filter((slug) => {
+    const matchTargets = buildMatchTargets(slug, registry)
+
+    const excluded = excludePatterns.some((pattern) =>
+      matchTargets.some((target) => minimatch(target, pattern, { nocase: false })),
+    )
+    return !excluded
+  })
+}
+
+/** Result of validating check references against the registry */
+interface CheckReferenceValidation {
+  valid: string[]
+  missing: string[]
+}
+
+/** Validate a list of check IDs against known IDs, returning valid and missing sets */
+export function validateCheckReferences(
+  checkIds: readonly string[],
+  allCheckIds: readonly string[],
+): CheckReferenceValidation {
+  const existingSet = new Set(allCheckIds)
+  const valid: string[] = []
+  const missing: string[] = []
+
+  for (const id of checkIds) {
+    if (existingSet.has(id)) {
+      valid.push(id)
+    } else {
+      missing.push(id)
+    }
+  }
+
+  return { valid, missing }
+}
+