audit-tools 0.28.4 → 0.28.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -4,11 +4,11 @@
|
|
|
4
4
|
"do_not_report": "Style issues, naming problems, missing tests, or findings that belong to other lenses."
|
|
5
5
|
},
|
|
6
6
|
"maintainability": {
|
|
7
|
-
"description": "Code that is hard to change safely: excessive function length, deep nesting, tight coupling between unrelated modules, poor naming, magic constants, duplicated logic, inconsistent abstractions, unclear public APIs.",
|
|
7
|
+
"description": "Code that is hard to change safely: excessive function length, deep nesting, tight coupling between unrelated modules, poor naming, magic constants, duplicated logic, inconsistent abstractions, unclear public APIs. A specific high-value smell: the same logic, format, or contract implemented in two or more places and kept consistent by a test or by convention instead of extracted to one shared source — flag the duplication and recommend single-sourcing it (the sync test is a workaround for the missing abstraction, not the fix). The change-cost tell is 'every edit must be made in N places to stay correct.'",
|
|
8
8
|
"do_not_report": "Correctness bugs, test gaps, or operational concerns."
|
|
9
9
|
},
|
|
10
10
|
"tests": {
|
|
11
|
-
"description": "Test coverage gaps for important paths, tests that assert incorrect behavior (pinning bugs as expected), fragile or non-deterministic tests, missing negative/edge-case tests, tests that silently pass on stale builds (e.g. importing compiled dist/ rather than source).",
|
|
11
|
+
"description": "Test coverage gaps for important paths, tests that assert incorrect behavior (pinning bugs as expected), fragile or non-deterministic tests, missing negative/edge-case tests, tests that silently pass on stale builds (e.g. importing compiled dist/ rather than source). Also flag a test whose purpose is to keep two copies of logic/format/output in sync (a drift guard): the real defect is the duplication it polices, which should be extracted to one shared source so the guard is unnecessary — report the test as the symptom and call out the duplication to single-source.",
|
|
12
12
|
"do_not_report": "Source code bugs — report only issues with the tests themselves."
|
|
13
13
|
},
|
|
14
14
|
"security": {
|
|
@@ -36,7 +36,7 @@
|
|
|
36
36
|
"do_not_report": "Runtime code issues; findings that belong to other lenses."
|
|
37
37
|
},
|
|
38
38
|
"architecture": {
|
|
39
|
-
"description": "Big-picture design, conceptual elegance, over-engineering, under-engineering, appropriate use of abstractions, and identifying opportunities where custom code should be replaced by third-party tools or standard libraries. Flag structural findings that span multiple components as 'systemic: true'.",
|
|
39
|
+
"description": "Big-picture design, conceptual elegance, over-engineering, under-engineering, appropriate use of abstractions, and identifying opportunities where custom code should be replaced by third-party tools or standard libraries. Flag a missing single source of truth: the same logic, format, or contract realized in multiple components where it should live in one shared module — the durable fix is extraction to that shared source, not a test or convention that keeps the copies in sync. Flag structural findings that span multiple components as 'systemic: true'.",
|
|
40
40
|
"do_not_report": "Minor style issues, localized logic bugs, or formatting."
|
|
41
41
|
},
|
|
42
42
|
"observability": {
|