bmad-plus 0.18.0 → 0.20.0

package/tools/cli/review-rules/containers.md

@@ -0,0 +1,6 @@
+- **Privilege.** Containers running as root without need; `privileged: true`, added capabilities, host network or PID namespace; the Docker socket mounted into a container (root on the host).
+- **Images.** Base images on `latest` or an unpinned tag; packages installed without cleanup or version pins where reproducibility matters; secrets passed as build arguments or copied into a layer.
+- **Exposure.** Ports published on `0.0.0.0` for services that should stay internal (databases, caches, admin APIs); missing network separation between stacks.
+- **Health and restart.** No health check for a service others depend on; `depends_on` without a health condition; restart policies that loop a crashing container.
+- **Data.** Volumes for stateful services missing or anonymous; host paths mounted read-write where read-only suffices.
+- **Resources.** No memory or CPU limits on a shared host; Kubernetes pods without requests/limits, probes or a `securityContext` (`runAsNonRoot`, `readOnlyRootFilesystem`).

package/tools/cli/review-rules/general.md

@@ -0,0 +1,10 @@
+Look for what the diff changes in behaviour, not how it reads.
+
+- **Callers.** Search every caller of a changed function, export, route, command or schema. A signature, return shape or error type that changed is a defect at the caller that was not updated.
+- **Removed behaviour.** Read what the diff deletes: a check, a branch, a cleanup, a log that an operator relies on. Deleted protection is the most often missed defect.
+- **Boundaries.** Empty input, one element, the last element, the maximum size, a missing optional field, a concurrent second call, a retry after a partial failure.
+- **Errors.** An error swallowed, logged and ignored, or turned into a success value. A failure path that leaves state half-written.
+- **Trust.** Data that crosses a boundary (request, file, environment, another service, a model's output) and reaches a query, a command, a path, HTML or a permission decision without validation.
+- **Tests.** A changed behaviour whose test still passes because it mocks the changed path, asserts nothing about the new case, or is skipped.
+
+Do not report formatting, naming or style a linter enforces, and do not propose rewrites the change did not need.

package/tools/cli/review-rules/index.yaml

@@ -0,0 +1,36 @@
+# Built-in review checklists, applied by path. Every matching rule applies to a file.
+# A project adds, replaces (same id) or disables rules in _bmad/review-rules.yaml.
+schema: bmad-plus/review-rules/1
+rules:
+  - id: general
+    title: Every change
+    globs: ['**']
+    doc: general.md
+  - id: javascript-typescript
+    title: JavaScript and TypeScript
+    globs: ['**/*.{js,cjs,mjs,jsx,ts,cts,mts,tsx}', '**/*.{vue,svelte}']
+    doc: javascript-typescript.md
+  - id: python
+    title: Python
+    globs: ['**/*.{py,pyi}']
+    doc: python.md
+  - id: sql-and-migrations
+    title: SQL, queries and migrations
+    globs: ['**/*.sql', '**/{migrations,migrate,db/migrate}/**', '**/*.prisma', '**/schema.rb']
+    doc: sql-and-migrations.md
+  - id: shell
+    title: Shell and PowerShell scripts
+    globs: ['**/*.{sh,bash,zsh,ps1,psm1}', '**/{Makefile,makefile}']
+    doc: shell.md
+  - id: ci-workflows
+    title: CI workflows
+    globs: ['.github/workflows/**/*.{yml,yaml}', '**/.gitlab-ci.yml', '**/{bitbucket-pipelines.yml,azure-pipelines.yml}']
+    doc: ci-workflows.md
+  - id: containers
+    title: Containers and deployment manifests
+    globs: ['**/{Dockerfile,Containerfile}', '**/*.dockerfile', '**/{docker-,}compose*.{yml,yaml}', '**/{k8s,kubernetes,helm,charts}/**/*.{yml,yaml}']
+    doc: containers.md
+  - id: configuration
+    title: Configuration and dependency manifests
+    globs: ['**/*.{json,yml,yaml,toml,ini,properties}', '**/.env.example', '**/{package.json,pyproject.toml,requirements*.txt,go.mod,Cargo.toml,composer.json}']
+    doc: configuration.md

package/tools/cli/review-rules/javascript-typescript.md

@@ -0,0 +1,7 @@
+- **Async.** A promise that is created but not awaited or returned; `forEach` with an async callback; an `await` inside a loop that should run in parallel, or `Promise.all` where one failure must not cancel the others (`allSettled`). Unhandled rejections in event handlers and timers.
+- **Nullish values.** Property access on a value that can be `undefined` after an `await`, a `find`, a map lookup or an optional API field; `||` used where `0`, `''` or `false` are valid values and `??` was meant.
+- **Equality and numbers.** Loose equality across types; floating-point money; `parseInt` without a radix or on user input without a `NaN` check; array index arithmetic off by one.
+- **Mutation.** A function that mutates its argument or a shared default object; sorting or splicing an array the caller still uses; state mutated in a React render or a reducer.
+- **Injection.** `innerHTML`, `dangerouslySetInnerHTML`, `v-html`, template literals building SQL, shell commands through `exec` or `shell: true`, `eval`/`new Function`, a user-controlled path reaching `fs` without confinement, a user-controlled URL fetched by the server (SSRF), `Object.assign`/spread of untrusted keys (`__proto__`).
+- **Types that lie.** `as` casts, non-null assertions (`!`) and `any` that hide a real `undefined` or a wrong shape at runtime.
+- **Resources.** Listeners, intervals, streams, file handles or database connections opened without a matching close on every path, including errors.

package/tools/cli/review-rules/python.md

@@ -0,0 +1,6 @@
+- **Defaults and scope.** Mutable default arguments; a loop variable captured late by a closure; a module-level object mutated per request.
+- **Exceptions.** Bare `except:` or `except Exception` that swallows and continues; `raise` without `from` that loses the cause; cleanup that is not in `finally` or a context manager.
+- **Resources.** Files, sockets, database cursors and locks not managed by `with`; a subprocess whose output is never drained.
+- **Injection.** SQL built with f-strings or `%`; `subprocess` with `shell=True` or a string command built from input; `pickle`, `yaml.load` without a safe loader, `eval`/`exec` on untrusted data; `os.path.join` with an absolute user path; `tarfile`/`zipfile` extraction without member path checks.
+- **Types and values.** `None` returned on one path and used unconditionally; integer division where a float was meant; naive and aware datetimes compared; timezones assumed.
+- **Concurrency.** Shared state touched from threads or async tasks without a lock; a blocking call inside an `async def`.

package/tools/cli/review-rules/shell.md

@@ -0,0 +1,6 @@
+- **Failure handling.** Bash without `set -euo pipefail` (or an explicit reason); a failing command in a pipeline hidden by the last stage; PowerShell without `$ErrorActionPreference = 'Stop'` where errors must stop the script; native exit codes (`$LASTEXITCODE`) not checked.
+- **Quoting.** Unquoted variables and command substitutions that split on spaces or expand globs; `eval` or `Invoke-Expression` on data.
+- **Destructive commands.** `rm -rf`, `Remove-Item -Recurse`, `git reset --hard`, `DROP` or deploy commands on a path or target built from a variable that can be empty or wrong.
+- **Secrets.** Tokens passed on the command line (visible in process lists and logs), echoed, or written to world-readable files; `set -x` in a script that handles credentials.
+- **Portability.** Bash-only syntax under `#!/bin/sh`; GNU-only flags on macOS; PowerShell 7 syntax (`&&`, `??`, ternary) in scripts run by Windows PowerShell 5.1; CRLF line endings in a script run by Linux.
+- **Temporary files.** Predictable names in shared directories instead of `mktemp`/`New-TemporaryFile`, and no cleanup trap.

package/tools/cli/review-rules/sql-and-migrations.md

@@ -0,0 +1,6 @@
+- **Parameters.** Any value reaching a query must be bound, never concatenated; identifiers (table, column, sort order) chosen from an allow-list.
+- **Scope of writes.** An `UPDATE` or `DELETE` whose `WHERE` can match more rows than intended, or none at all silently; a missing tenant or owner filter.
+- **Migrations.** A migration that locks a large table, drops or renames a column still read by the running version, adds a `NOT NULL` column without a default or backfill, or cannot be rolled back. Data migrations must be idempotent and safe to rerun.
+- **Transactions.** Several writes that must succeed together outside a transaction; a transaction held open across a network call.
+- **Performance.** A new filter or join on a column without an index; a query inside a loop (N+1); an unbounded result set returned to a caller.
+- **Nulls.** Comparisons with `NULL` using `=`; aggregates or `NOT IN` over nullable columns.