vouchington-tooling 0.6.2 → 0.6.3

package/README.md

@@ -22,6 +22,7 @@ vouchington gha-runtime-audit --pr-workflow CI --push-workflow '/^Main CI \\(.+\
 vouchington require-up-to-date --remote origin --branch main
 vouchington gitleaks-directory-scan --config .gitleaks.toml
 vouchington ast-grep-examples --rules ast-grep-tests --config sgconfig.yml
+vouchington ast-grep-pack
 vouchington gha-workspace-policy
 vouchington gha-output name
 vouchington gha-needs-results
@@ -88,6 +89,8 @@ ancestor of `HEAD`. `gitleaks-directory-scan` builds and scans isolated staged-i
 nonignored-working-tree mirrors with an explicit config; `--directory` selects the repository root.
 `ast-grep-examples` runs native `ast-grep test`, then validates each scoped rule's `files:` and
 `ignores:` examples with project `languageGlobs` replay from its root `--config`.
+`ast-grep-pack` prints JSON `{ rules, config }` for the shipped unconditional rule pack. Point a
+consumer `sgconfig.yml` `ruleDirs` at `rules` and keep product-specific YAML locally.
 `gha-workspace-policy` checks tracked workflow and composite-action files in the current repository;
 pass `--root`, `--workflow-directory`, or `--action-directory` for consumer-owned layouts.
 
@@ -192,6 +195,7 @@ import { checkGhaWorkspacePolicy } from 'vouchington-tooling/gha-workspace-polic
 import { requireUpToDate } from 'vouchington-tooling/require-up-to-date'
 import { runGitleaksDirectoryScan } from 'vouchington-tooling/gitleaks-directory-scan'
 import { runAstGrepExamples } from 'vouchington-tooling/ast-grep-examples'
+import { astGrepPackPaths } from 'vouchington-tooling/ast-grep-pack'
 import { validateNugetUpdate } from 'vouchington-tooling/nuget-central-version'
 import { normalizeSwiftSource } from 'vouchington-tooling/swift-semantic-equal'
 import { parseUniqueSwiftBinaryTargetChecksum } from 'vouchington-tooling/swift-source-offset'

package/ast-grep/rules/backend-no-test-file-imports.yml

@@ -0,0 +1,44 @@
+id: backend-no-test-file-imports
+language: TypeScript
+severity: error
+message: 'Do not import backend test files from backend Vitest files; move shared helpers to test-helpers or a support module.'
+files:
+  - 'backend/**/*.test.mts'
+  - 'backend/**/__tests__/**/*.mts'
+rule:
+  any:
+    - all:
+        - kind: import_statement
+        - regex: "['\"`](?:\\.\\./|\\./)[^'\"`]*\\.test\\.mts['\"`]"
+    - all:
+        - kind: export_statement
+        - regex: "['\"`](?:\\.\\./|\\./)[^'\"`]*\\.test\\.mts['\"`]"
+    - pattern: 'import($PATH)'
+      regex: "['\"`](?:\\.\\./|\\./)[^'\"`]*\\.test\\.mts['\"`]"
+    - pattern: 'require($PATH)'
+      regex: "['\"`](?:\\.\\./|\\./)[^'\"`]*\\.test\\.mts['\"`]"
+examples:
+  - code: "import { createTestUser } from './user.test.mts'"
+    isValid: false
+    file: 'backend/services/example/__tests__/user-login.test.mts'
+  - code: "import * as suite from './search.part-2.test.mts'"
+    isValid: false
+    file: 'backend/services/example/__tests__/search.test.mts'
+  - code: "import type { Helper } from '../helpers.test.mts'"
+    isValid: false
+    file: 'backend/services/example/__tests__/search.test.mts'
+  - code: "export { createThing } from './thing.test.mts'"
+    isValid: false
+    file: 'backend/services/example/__tests__/search.test.mts'
+  - code: "const mod = await import('./search.test.mts')"
+    isValid: false
+    file: 'backend/services/example/__tests__/search.test.mts'
+  - code: "const mod = require('./search.test.mts')"
+    isValid: false
+    file: 'backend/services/example/__tests__/search.test.mts'
+  - code: "import { searchSuite } from '../search.test-suites.mts'"
+    isValid: true
+    file: 'backend/services/example/__tests__/search.test.mts'
+  - code: "const mod = await import('../search.test-suites.mts')"
+    isValid: true
+    file: 'backend/services/example/__tests__/search.test.mts'

package/ast-grep/rules/force-dynamic-layout.yml

@@ -0,0 +1,57 @@
+id: force-dynamic-layout
+language: Tsx
+severity: error
+message: "layout file accesses request context but is missing `export const dynamic = 'force-dynamic'`"
+files:
+  - 'web/app/**/layout.tsx'
+ignores:
+  - 'web/app/layout.tsx'
+rule:
+  all:
+    - kind: program
+    - has:
+        stopBy: end
+        any:
+          - pattern: 'headers()'
+          - pattern: 'cookies()'
+          - pattern: 'getCurrentUser($$$)'
+    - not:
+        has:
+          # No stopBy:end — only check direct children of program so that a
+          # 'use client' string nested inside a function body does not exempt
+          # the layout. Top-level directives and exports are direct children.
+          any:
+            - kind: expression_statement
+              has:
+                any:
+                  - pattern: "'use client'"
+                  - pattern: '"use client"'
+            - pattern: "export const dynamic = 'force-dynamic'"
+examples:
+  - code: |
+      import { headers } from 'next/headers'
+      export const dynamic = 'force-dynamic'
+      export default function Layout({ children }) { return <div>{children}</div> }
+    isValid: true
+    file: 'web/app/dashboard/layout.tsx'
+  - code: |
+      import { headers } from 'next/headers'
+      export default function Layout({ children }) {
+        const h = headers()
+        return <div>{children}</div>
+      }
+    isValid: false
+    file: 'web/app/dashboard/layout.tsx'
+  - code: |
+      export default function Layout({ children }) { return <div>{children}</div> }
+    isValid: true
+    file: 'web/app/dashboard/layout.tsx'
+  - code: |
+      'use client'
+      import { headers } from 'next/headers'
+      export default function Layout({ children }) {
+        const h = headers()
+        return <div>{children}</div>
+      }
+    isValid: true
+    file: 'web/app/dashboard/layout.tsx'

package/ast-grep/rules/force-dynamic-pages.yml

@@ -0,0 +1,38 @@
+id: force-dynamic-pages
+language: Tsx
+severity: error
+message: "page file must export `export const dynamic = 'force-dynamic'`"
+files:
+  - 'web/app/**/page.tsx'
+rule:
+  all:
+    - kind: program
+    - not:
+        has:
+          any:
+            - kind: expression_statement
+              has:
+                any:
+                  - pattern: "'use client'"
+                  - pattern: '"use client"'
+            - pattern: "export const dynamic = 'force-dynamic'"
+examples:
+  - code: |
+      export const dynamic = 'force-dynamic'
+      export default function Page() { return <div /> }
+    isValid: true
+    file: 'web/app/home/page.tsx'
+  - code: |
+      'use client'
+      export default function Page() { return <div /> }
+    isValid: true
+    file: 'web/app/home/page.tsx'
+  - code: |
+      "use client"
+      export default function Page() { return <div /> }
+    isValid: true
+    file: 'web/app/home/page.tsx'
+  - code: |
+      export default function Page() { return <div /> }
+    isValid: false
+    file: 'web/app/home/page.tsx'

package/ast-grep/rules/no-dynamic-import-in-vitest-config.yml

@@ -0,0 +1,30 @@
+id: no-dynamic-import-in-vitest-config
+language: TypeScript
+severity: error
+message: >-
+  vitest config files must use static imports — dynamic import() prevents
+  vitest-project-mapping from statically analyzing project structure
+files:
+  - '**/vitest.config.mts'
+  - '**/test-helpers/vitest-config/*.mts'
+rule:
+  pattern: import($$$)
+examples:
+  - code: "const { default: react } = await import('@vitejs/plugin-react')"
+    isValid: false
+    file: 'vitest.config.mts'
+  - code: "const [{ defineConfig }] = await Promise.all([import('vitest/config')])"
+    isValid: false
+    file: 'vitest.config.mts'
+  - code: "import react from '@vitejs/plugin-react'"
+    isValid: true
+    file: 'vitest.config.mts'
+  - code: "import { defineConfig } from 'vitest/config'"
+    isValid: true
+    file: 'vitest.config.mts'
+  - code: "const { default: react } = await import('@vitejs/plugin-react')"
+    isValid: false
+    file: 'test-helpers/vitest-config/backend-core-projects.mts'
+  - code: "import react from '@vitejs/plugin-react'"
+    isValid: true
+    file: 'test-helpers/vitest-config/backend-core-projects.mts'

package/ast-grep/rules/no-dynamic-server-components-tsx.yml

@@ -0,0 +1,71 @@
+# NOTE: This rule flags calls to `dynamic` or `nextDynamic` (next/dynamic) that use a dynamic import.
+# It cannot verify the import source — it matches by function name.
+# If you have other functions named `dynamic` or `nextDynamic`, add a suppression comment.
+id: no-dynamic-server-components-tsx
+language: Tsx
+severity: error
+message: "dynamic()/nextDynamic() may wrap a server component — ensure the target has 'use client'"
+# NOTE: ast-grep maps `.tsx` to language `Tsx`, not `TypeScript`. This rule
+# only scans `.tsx` files; see no-dynamic-server-components.yml for the
+# companion rule that covers `.ts` files.
+files:
+  - 'web/**/*.tsx'
+ignores:
+  - '**/*.test.tsx'
+  - '**/*.spec.tsx'
+rule:
+  any:
+    - pattern: '$FN(() => import($PATH))'
+    - pattern: '$FN(() => { return import($PATH); })'
+    - pattern: '$FN(() => import($PATH).then($$$))'
+    - pattern: '$FN(() => import($PATH), $OPTS)'
+    - pattern: '$FN(() => { return import($PATH); }, $OPTS)'
+    - pattern: '$FN(() => import($PATH).then($$$), $OPTS)'
+constraints:
+  FN:
+    regex: '^(dynamic|nextDynamic)$'
+  PATH:
+    regex: "^['\"`](\\.\\./|\\./|@/)"
+  # NOTE: `$OPTS` is only bound by the two-argument pattern arms above. This
+  # `not` constraint filters out `{ ssr: false }` only for those arms; the
+  # single-argument dynamic import arms still match and remain violations.
+  OPTS:
+    not:
+      regex: '(?:\bssr\b|[''"]ssr[''"])\s*:\s*false\b'
+examples:
+  - code: "const Comp = dynamic(() => import('./my-component'))"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: 'const Comp = dynamic(() => import(`./my-component`))'
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('../components/comp'))"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('./add-tag-form').then(m => ({ default: m.AddTagForm })))"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = nextDynamic(() => import('./my-component'))"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('./c'), { loading: () => null })"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('./c'), { not_ssr: false })"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('./c'), { ssr: falsey })"
+    isValid: false
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('./c'), { ssr: false })"
+    isValid: true
+    file: 'web/app/page.tsx'
+  - code: 'const Comp = dynamic(() => import("./c"), { "ssr": false })'
+    isValid: true
+    file: 'web/app/page.tsx'
+  - code: "const Comp = dynamic(() => import('./c'), { 'ssr': false })"
+    isValid: true
+    file: 'web/app/page.tsx'
+  - code: "const Comp = lazy(() => import('./my-component'))"
+    isValid: true
+    file: 'web/app/page.tsx'

package/ast-grep/rules/no-dynamic-server-components.yml

@@ -0,0 +1,71 @@
+# NOTE: This rule flags calls to `dynamic` or `nextDynamic` (next/dynamic) that use a dynamic import.
+# It cannot verify the import source — it matches by function name.
+# If you have other functions named `dynamic` or `nextDynamic`, add a suppression comment.
+id: no-dynamic-server-components
+language: TypeScript
+severity: error
+message: "dynamic()/nextDynamic() may wrap a server component — ensure the target has 'use client'"
+# NOTE: ast-grep maps `.tsx` to language `Tsx`, not `TypeScript`. This rule
+# only scans `.ts` files; see no-dynamic-server-components-tsx.yml for the
+# companion rule that covers `.tsx` files.
+files:
+  - 'web/**/*.ts'
+ignores:
+  - '**/*.test.ts'
+  - '**/*.spec.ts'
+rule:
+  any:
+    - pattern: '$FN(() => import($PATH))'
+    - pattern: '$FN(() => { return import($PATH); })'
+    - pattern: '$FN(() => import($PATH).then($$$))'
+    - pattern: '$FN(() => import($PATH), $OPTS)'
+    - pattern: '$FN(() => { return import($PATH); }, $OPTS)'
+    - pattern: '$FN(() => import($PATH).then($$$), $OPTS)'
+constraints:
+  FN:
+    regex: '^(dynamic|nextDynamic)$'
+  PATH:
+    regex: "^['\"`](\\.\\./|\\./|@/)"
+  # NOTE: `$OPTS` is only bound by the two-argument pattern arms above. This
+  # `not` constraint filters out `{ ssr: false }` only for those arms; the
+  # single-argument dynamic import arms still match and remain violations.
+  OPTS:
+    not:
+      regex: '(?:\bssr\b|[''"]ssr[''"])\s*:\s*false\b'
+examples:
+  - code: "const Comp = dynamic(() => import('./my-component'))"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: 'const Comp = dynamic(() => import(`./my-component`))'
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('../components/comp'))"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('./add-tag-form').then(m => ({ default: m.AddTagForm })))"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = nextDynamic(() => import('./my-component'))"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('./c'), { loading: () => null })"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('./c'), { not_ssr: false })"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('./c'), { ssr: falsey })"
+    isValid: false
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('./c'), { ssr: false })"
+    isValid: true
+    file: 'web/app/page.ts'
+  - code: 'const Comp = dynamic(() => import("./c"), { "ssr": false })'
+    isValid: true
+    file: 'web/app/page.ts'
+  - code: "const Comp = dynamic(() => import('./c'), { 'ssr': false })"
+    isValid: true
+    file: 'web/app/page.ts'
+  - code: "const Comp = lazy(() => import('./my-component'))"
+    isValid: true
+    file: 'web/app/page.ts'

package/ast-grep/rules/no-enable-indexscan-off-tsx.yml

@@ -0,0 +1,33 @@
+# NOTE: ast-grep maps `.tsx` to language `Tsx`, not `TypeScript`. This rule
+# only scans `.tsx` files; see no-enable-indexscan-off.yml for the companion
+# rule that covers `.ts/.mts/.cts` files.
+id: no-enable-indexscan-off-tsx
+language: Tsx
+severity: error
+message: >-
+  Do not use `enable_indexscan = off` — it disables index scans repo-wide within the transaction
+  (not just for HNSW vector search), forcing a full sequential scan. For HNSW overfiltering on a
+  small hard-capped result window, use `applyFilteredVectorScan()` from `@modules/search-utils`
+  (pgvector `hnsw.iterative_scan`) instead.
+rule:
+  any:
+    - kind: string
+    - kind: template_string
+  regex: '(?i)enable_indexscan[\s\S]{0,12}(=|to)[\s\S]{0,12}off'
+examples:
+  - code: |-
+      import sql from 'sql-template-strings'
+      export const query = sql`SET LOCAL enable_indexscan = off`
+    isValid: false
+    file: 'web/lib/__tests__/example.tsx'
+  - code: |-
+      import sql from 'sql-template-strings'
+      export const query = sql`SET LOCAL enable_indexscan TO off`
+    isValid: false
+    file: 'web/lib/__tests__/example.tsx'
+  - code: |-
+      export function Example() {
+        return <div>hnsw.iterative_scan = strict_order</div>
+      }
+    isValid: true
+    file: 'web/components/example.tsx'

package/ast-grep/rules/no-enable-indexscan-off.yml

@@ -0,0 +1,41 @@
+# NOTE: ast-grep maps `.tsx` to language `Tsx`, not `TypeScript`. This rule
+# only scans `.ts/.mts/.cts` files; see no-enable-indexscan-off-tsx.yml for
+# the companion rule that covers `.tsx` files.
+id: no-enable-indexscan-off
+language: TypeScript
+severity: error
+message: >-
+  Do not use `enable_indexscan = off` — it disables index scans repo-wide within the transaction
+  (not just for HNSW vector search), forcing a full sequential scan. For HNSW overfiltering on a
+  small hard-capped result window, use `applyFilteredVectorScan()` from `@modules/search-utils`
+  (pgvector `hnsw.iterative_scan`) instead.
+rule:
+  any:
+    - kind: string
+    - kind: template_string
+  regex: '(?i)enable_indexscan[\s\S]{0,12}(=|to)[\s\S]{0,12}off'
+examples:
+  - code: |-
+      import sql from 'sql-template-strings'
+      export const query = sql`SET LOCAL enable_indexscan = off`
+    isValid: false
+    file: 'backend/services/example/tools/semantic.mts'
+  - code: |-
+      import sql from 'sql-template-strings'
+      export const query = sql`SET LOCAL enable_indexscan TO off`
+    isValid: false
+    file: 'backend/services/example/tools/semantic.mts'
+  - code: |-
+      const guard = "current_setting('enable_indexscan') = 'off'"
+    isValid: false
+    file: 'backend/test-helpers/entities/posts-semantic.test.mts'
+  - code: |-
+      import sql from 'sql-template-strings'
+      export const query = sql`SET LOCAL hnsw.iterative_scan = strict_order`
+    isValid: true
+    file: 'backend/services/example/tools/semantic.mts'
+  - code: |-
+      // Do not disable index scans for vector search; use iterative scans instead.
+      const note = 'see applyFilteredVectorScan'
+    isValid: true
+    file: 'backend/src/vector-scan.mts'

package/ast-grep/rules/no-exports-in-tests-folder-tsx.yml

@@ -0,0 +1,42 @@
+# NOTE: `__tests__` directories must contain tests only. Shared helpers, registries,
+# fixtures, and other imported support modules belong in a nearby `test-helpers/`
+# directory so test roots stay easy to scan.
+# NOTE: ast-grep maps `.tsx` to language `Tsx`, not `TypeScript`. This rule
+# only scans `.tsx` files; see no-exports-in-tests-folder.yml for the companion
+# rule that covers `.ts/.mts/.cts` files.
+id: no-exports-in-tests-folder-tsx
+language: Tsx
+severity: error
+message: 'Do not export from files under __tests__; move shared test support to a test-helpers directory.'
+files:
+  - '**/__tests__/**/*.tsx'
+rule:
+  all:
+    - kind: export_statement
+    - not:
+        pattern: export {}
+examples:
+  - code: |
+      export function renderThing() {
+        return <div />
+      }
+    isValid: false
+    file: 'web/components/example/__tests__/comment-tree-test-helpers.tsx'
+  - code: 'export type RenderThing = () => JSX.Element'
+    isValid: false
+    file: 'web/components/__tests__/render-helpers.tsx'
+  - code: |
+      it('renders shell exports', () => {
+        expect(`export NEXT_PORT=3901`).toContain('export')
+      })
+    isValid: true
+    file: 'web/components/example/__tests__/comment-tree.test.tsx'
+  - code: |
+      function renderThing() {
+        return <div />
+      }
+    isValid: true
+    file: 'web/components/example/__tests__/comment-tree.test.tsx'
+  - code: 'export {}'
+    isValid: true
+    file: 'web/components/example/__tests__/global-jsx.test.tsx'

package/ast-grep/rules/no-exports-in-tests-folder.yml

@@ -0,0 +1,43 @@
+# NOTE: `__tests__` directories must contain tests only. Shared helpers, registries,
+# fixtures, and other imported support modules belong in a nearby `test-helpers/`
+# directory so test roots stay easy to scan.
+# NOTE: ast-grep maps `.tsx` to language `Tsx`, not `TypeScript`. This rule
+# only scans `.ts/.mts/.cts` files; see no-exports-in-tests-folder-tsx.yml for
+# the companion rule that covers `.tsx` files.
+id: no-exports-in-tests-folder
+language: TypeScript
+severity: error
+message: 'Do not export from files under __tests__; move shared test support to a test-helpers directory.'
+files:
+  - '**/__tests__/**/*.ts'
+  - '**/__tests__/**/*.mts'
+  - '**/__tests__/**/*.cts'
+rule:
+  all:
+    - kind: export_statement
+    - not:
+        pattern: export {}
+examples:
+  - code: 'export const makeThing = () => ({})'
+    isValid: false
+    file: 'backend/services/example/__tests__/user-helpers.mts'
+  - code: 'export type Helper = { id: string }'
+    isValid: false
+    file: 'web/lib/__tests__/manifest-registry.ts'
+  - code: "export { makeThing } from './thing'"
+    isValid: false
+    file: 'src/__tests__/helpers.mts'
+  - code: |
+      describe('script rendering', () => {
+        it('renders shell exports', () => {
+          expect(`export NEXT_PORT=3901`).toContain('export')
+        })
+      })
+    isValid: true
+    file: 'src/__tests__/stop-services.test.mts'
+  - code: 'const makeThing = () => ({})'
+    isValid: true
+    file: 'backend/services/example/__tests__/users.test.mts'
+  - code: 'export {}'
+    isValid: true
+    file: 'backend/services/example/__tests__/global-script.test.mts'

package/ast-grep/rules/no-object-assign-new-error.yml

@@ -0,0 +1,31 @@
+id: no-object-assign-new-error
+language: TypeScript
+severity: error
+message: 'Use http-errors/http-assert or an explicit typed error helper instead of Object.assign(new Error(...))'
+files:
+  - '**/*.mts'
+  - '**/*.ts'
+  - '**/*.tsx'
+ignores:
+  - '**/*.test.mts'
+  - '**/*.test.ts'
+  - '**/*.test.tsx'
+  - '**/*.mock.test.mts'
+  - '**/*.mock.test.ts'
+  - '**/*.mock.test.tsx'
+  - '**/*.spec.mts'
+  - '**/*.spec.ts'
+  - '**/*.spec.tsx'
+  - 'web/storybook/**'
+rule:
+  pattern: Object.assign(new Error($$$), $$$)
+examples:
+  - code: "throw Object.assign(new Error('missing'), { status: 404 })"
+    isValid: false
+    file: backend/services/example.mts
+  - code: "throw createHttpError(404, 'missing')"
+    isValid: true
+    file: backend/services/example.mts
+  - code: "const error = new Error('suppressed'); error.tags = { suppressLogging: true }"
+    isValid: true
+    file: backend/test-helpers/suppressed-error.mts

package/ast-grep/rules/no-runner-temp-nullish.yml

@@ -0,0 +1,33 @@
+id: no-runner-temp-nullish
+language: TypeScript
+severity: error
+message: 'Use logical OR for RUNNER_TEMP temp roots so an empty string falls back safely.'
+files:
+  - '**/*.ts'
+  - '**/*.tsx'
+  - '**/*.mts'
+  - '**/*.cts'
+rule:
+  any:
+    - pattern: $ENV.RUNNER_TEMP ?? $$$
+    - pattern: $ENV['RUNNER_TEMP'] ?? $$$
+    - pattern: $ENV["RUNNER_TEMP"] ?? $$$
+examples:
+  - code: 'const root = process.env.RUNNER_TEMP ?? os.tmpdir()'
+    isValid: false
+    file: 'src/setup.mts'
+  - code: 'const root = env.RUNNER_TEMP ?? env.TMPDIR'
+    isValid: false
+    file: 'src/env.mts'
+  - code: 'const root = process.env["RUNNER_TEMP"] ?? os.tmpdir()'
+    isValid: false
+    file: 'src/setup.mts'
+  - code: "const root = env['RUNNER_TEMP'] ?? env.TMPDIR"
+    isValid: false
+    file: 'src/env.mts'
+  - code: 'const root = process.env.RUNNER_TEMP || os.tmpdir()'
+    isValid: true
+    file: 'src/setup.mts'
+  - code: 'const root = env.RUNNER_TEMP || env.TMPDIR || tmpdir()'
+    isValid: true
+    file: 'src/env.mts'

package/ast-grep/rules/no-self-comparison-assertion-tsx.yml

@@ -0,0 +1,43 @@
+id: no-self-comparison-assertion-tsx
+language: Tsx
+severity: error
+message: 'This compares an expression against itself (e.g. expect(result.id).toBe(result.id)). ast-grep metavariables enforce identical text, so both sides read the same value the same way; nearly every real occurrence of this shape is a copy-paste bug where the second operand should have been an independently derived expected value. Compare against that instead, or a fixture-provided value the code under test did not produce. (Two syntactic shapes are exempted because they cannot be tautological by construction: an expression containing a call anywhere in it, e.g. expect(f(a)).toBe(f(a)) or expect((await load()).id).toBe((await load()).id), is a fresh invocation on each side and legitimately tests that the call is deterministic/pure; and a postfix/prefix increment or decrement, e.g. expect(index++).toBe(index++), advances state between the two reads. A getter or other stateful property access is NOT exempted -- ast-grep cannot see whether a given `.foo` is a plain field or a getter with side effects, and every real violation this rule has caught in this repo is a plain field, so this stays flagged by design; if you are deliberately asserting that such an accessor is stable across two reads, add an `ast-grep-ignore: no-self-comparison-assertion-tsx` comment with that rationale instead of weakening this rule.)'
+files:
+  - '**/*.test.tsx'
+  - '**/*.spec.tsx'
+rule:
+  pattern: 'expect($X).toBe($X)'
+constraints:
+  X:
+    not:
+      any:
+        - kind: 'true'
+        - kind: 'false'
+        - kind: 'number'
+        - kind: 'string'
+        - kind: 'null'
+        - kind: 'undefined'
+        - kind: 'call_expression'
+        - kind: 'update_expression'
+        - has:
+            kind: 'call_expression'
+            stopBy: end
+examples:
+  - code: 'expect(item.id).toBe(item.id)'
+    isValid: false
+    file: 'web/components/example/__tests__/add-to-list-menu-item.mock.test.tsx'
+  - code: 'expect(item.id).toBe(expectedId)'
+    isValid: true
+    file: 'web/components/example/__tests__/add-to-list-menu-item.mock.test.tsx'
+  - code: 'expect(formatItemLabel(item)).toBe(formatItemLabel(item))'
+    isValid: true
+    file: 'web/components/example/__tests__/add-to-list-menu-item.mock.test.tsx'
+  - code: 'expect((await loadItem()).id).toBe((await loadItem()).id)'
+    isValid: true
+    file: 'web/components/example/__tests__/add-to-list-menu-item.mock.test.tsx'
+  - code: 'expect(item.id).toBe(item.id)'
+    isValid: true
+    file: 'web/components/example/add-to-list-menu-item.tsx'
+  - code: 'expect(index++).toBe(index++)'
+    isValid: true
+    file: 'web/components/example/__tests__/add-to-list-menu-item.mock.test.tsx'