@xenos1996/usa 2.26.0 → 2.27.0

package/rules/core/code-quality.yaml

@@ -100,7 +100,12 @@ rules:
     applies_when: { fact: 'lang:typescript' }
     check:
       kind: grep_absent
-      pattern: '(@ts-ignore|@ts-expect-error|:\s*any\b|\bas any\b|as unknown as)'
+      # `:\s*any\b` alone matched prose — "Degraded-never-empty: any fetch
+      # failure" in a doc comment — so the type-escape branch now requires a
+      # type position after the keyword (`: any,` `: any)` `: any[]` `: any =`).
+      # Masking comments instead is not an option here: `@ts-ignore` lives in a
+      # comment, and the rule exists to catch it.
+      pattern: '(@ts-ignore|@ts-expect-error|:\s*any\b(?=\s*[,;)\]}>=]|$)|\bas any\b|as unknown as)'
       include: ['**/*.{ts,tsx}']
       exclude: ['**/*.test.*', '**/*.spec.*', '**/*.d.ts']
     why: 'Every `any` is a place the type system was told to stop helping. A few are fine; a pattern is a problem.'
@@ -204,7 +209,12 @@ rules:
       kind: grep_wrong
       pattern: '(TODO|FIXME|XXX|HACK|WORKAROUND)\b'
       include: ['**/*.{ts,tsx,js,jsx,py,go,rs,java,kt,rb,php,cs,yml,yaml}']
-      exclude: ['**/*.md', '**/docs/**', '**/node_modules/**']
+      # A fixture is a *sample of bad code*, not debt: CQ-010.yaml contains a
+      # TODO precisely so this rule has something to flag. Excluding them here
+      # (rather than from the audit index) keeps the fixtures visible to the
+      # rules that need to see them, e.g. TAS-011.
+      exclude:
+        ['**/*.md', '**/docs/**', '**/node_modules/**', '**/fixtures/**', '**/__fixtures__/**']
     why: 'A TODO with no owner and no ticket is a lie the codebase tells itself.'
     remediation: 'Convert each one to a tracked issue with a link in the comment, or delete it if it no longer applies.'
 

package/rules/core/provenance-attestation.yaml

@@ -58,6 +58,11 @@ rules:
       # An empty signature file signs nothing — presence alone is not evidence.
       non_empty: true
       files:
+        # cosign's own default bundle name is `<artifact>.sigstore.json`
+        # (`cosign sign-blob --bundle x.sigstore.json`), which `*.sigstore`
+        # does not match — that gap made every cosign-signed repo fail this
+        # rule. `*.sigstore` stays for legacy bundles written with that suffix.
+        - '**/*.sigstore.json'
         - '**/*.sigstore'
         - '**/*.bundle'
         - '**/*.sig'

package/rules/core/security.yaml

@@ -534,7 +534,7 @@ rules:
       assert: { rule: SEC-014, status: [PASS] }
     why: 'Sound tokens with expiry but no rate limiting leave a credential-stuffing window: each token check passes, the login endpoint still takes unlimited guesses.'
     remediation: 'Rate-limit failed authentication (see SEC-014) on every endpoint that accepts these tokens.'
-    references: ['CWE-307', 'ASVS-6.3.3']
+    references: ['CWE-307']
 
   - id: INV-SEC-003
     title: Validated input is also encoded on output

package/rules/core/testing-assurance.yaml

@@ -137,11 +137,22 @@ rules:
       patterns:
         - 'reports/**/*mut*'
         - 'reports/mutation/**'
+        # Stryker's default config file has been `stryker.config.*` since v6;
+        # `stryker.conf.*` is the pre-6 name and is kept for older projects.
+        - 'stryker.config.*'
         - 'stryker.conf.*'
         - '.stryker.conf.*'
         - '.mutmut*'
         - 'mutants/**'
-    why: 'Coverage tells you which lines ran, not whether the test would have failed if the line were wrong; a mutation config or report proves the question was asked.'
+        # A committed harness that mutates and asserts is evidence too — and
+        # stronger evidence than a config file, which proves only that someone
+        # installed a tool. USA mutates every rule check and asserts its own
+        # fixture flips (tests/integration/auditor-mutation.test.ts, ~100
+        # probes in every CI run); no third-party tool name appears anywhere in
+        # the repo, so the tool-only globs scored that work as absent.
+        - 'tests/**/*mutation*'
+        - 'tests/**/mutation/**'
+    why: 'Coverage tells you which lines ran, not whether the test would have failed if the line were wrong; a mutation config, report, or committed mutation harness proves the question was asked.'
     remediation: 'Run mutation testing on the highest-risk module first and keep the config or report in the repo.'
     references: ['Mutation-Testing']
 
@@ -178,7 +189,11 @@ rules:
     class: operations
     check:
       kind: grep_present
-      pattern: '(retries\s*:\s*[1-9]|"retries"\s*:\s*[1-9]|retries=[1-9]|--retries[ =][1-9]|rerun-failed|flaky-test-retry|retry-on-failure)'
+      # A declared budget of zero is a budget, and a stricter one than 2:
+      # the project has decided a flaky test is a failure, not a rerun. The
+      # earlier `[1-9]` required paying for retries, so the most honest
+      # answer a deterministic suite can give was scored as absent.
+      pattern: '(retr(?:y|ies)\s*:\s*\d|retries=\d|--retries[ =]\d|rerun-failed|flaky-test-retry|retry-on-failure)'
       include:
         [
           'playwright.config.*',
@@ -190,8 +205,8 @@ rules:
           '.github/workflows/*.yaml',
           '.gitlab-ci.yml',
         ]
-    why: 'A retries setting proves the project pays for reruns; it proves nothing about whether the tests are flaky or stable — only that the budget exists.'
-    remediation: 'Declare an explicit retry budget (e.g. retries: 2 on CI) and track which tests consume it; quarantine chronic consumers.'
+    why: 'A declared retry budget says what the project does when a test fails twice: rerun it, or treat it as a defect. Either answer is a policy; silence means nobody decided.'
+    remediation: 'Declare the budget explicitly. Prefer retries: 0 and fix flakes; if reruns are unavoidable, set retries: 2 on CI only, track which tests consume it, and quarantine chronic consumers.'
     references: ['Google-Testing-Blog:Flaky']
 
   - id: TAS-010