gruff-rs 0.1.0

Rust static analyzer and quality linter for CI: dead-code, complexity, security, secrets, and architecture rules with deterministic SARIF/JSON output and baseline support.
use super::*;

pub(crate) const ARCHITECTURE_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "architecture.large-module",
        "Large module",
        Pillar::Design,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        ARCHITECTURE_LARGE_MODULE_THRESHOLD,
        "Flags modules with more indexed items than the configured threshold.",
    ),
    rule_definition!(
        "architecture.module-fan-out",
        "Module fan-out",
        Pillar::Design,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        ARCHITECTURE_MODULE_FAN_OUT_THRESHOLD,
        "Flags files that declare many child modules.",
    ),
    rule_definition!(
        "architecture.public-api-surface",
        "Public API surface",
        Pillar::Design,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        ARCHITECTURE_PUBLIC_API_SURFACE_THRESHOLD,
        "Flags modules with many public exports.",
    ),
];

pub(crate) const COMPLEXITY_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "complexity.cognitive",
        "Cognitive complexity",
        Pillar::Complexity,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        COMPLEXITY_COGNITIVE_THRESHOLD,
        "Flags functions with high cognitive complexity.",
    ),
    rule_definition!(
        "complexity.cyclomatic",
        "Cyclomatic complexity",
        Pillar::Complexity,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        COMPLEXITY_CYCLOMATIC_THRESHOLD,
        "Flags functions with high branch and decision complexity.",
    ),
    rule_definition!(
        "complexity.nesting-depth",
        "Nesting depth",
        Pillar::Complexity,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        COMPLEXITY_NESTING_DEPTH_THRESHOLD,
        "Flags functions with deeply nested control flow.",
    ),
    rule_definition!(
        "complexity.npath",
        "NPath complexity",
        Pillar::Complexity,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::Medium,
        COMPLEXITY_NPATH_THRESHOLD,
        "Flags functions with many approximate execution paths.",
    ),
];

pub(crate) const DEAD_CODE_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "dead-code.unused-private-function",
        "Unused private function",
        Pillar::DeadCode,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::Low,
        None,
        "Flags private functions with no same-file call sites.",
    ),
    rule_definition!(
        "dead-code.unused-private-item-candidate",
        "Unused private item candidate",
        Pillar::DeadCode,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::Medium,
        None,
        "Flags private items whose names are not referenced elsewhere in discovered Rust sources.",
    ),
];

pub(crate) const DEPENDENCY_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "dependency.duplicate-locked-version",
        "Duplicate locked dependency version",
        Pillar::Security,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        DEPENDENCY_DUPLICATE_LOCKED_VERSION_THRESHOLD,
        "Flags packages locked at more versions than the configured threshold.",
    ),
    rule_definition!(
        "dependency.git-source",
        "Git dependency source",
        Pillar::Security,
        RuleKind::Project,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags dependencies sourced directly from git repositories.",
    ),
    rule_definition!(
        "dependency.git-unpinned-revision",
        "Git dependency without fixed revision",
        Pillar::Security,
        RuleKind::Project,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags git dependencies that do not pin a fixed rev.",
    ),
    rule_definition!(
        "dependency.missing-package-metadata",
        "Missing package metadata",
        Pillar::Documentation,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        None,
        "Flags packages missing description or license metadata.",
    ),
    rule_definition!(
        "dependency.path-source",
        "Path dependency source",
        Pillar::Security,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        None,
        "Flags dependencies sourced from local filesystem paths.",
    ),
    rule_definition!(
        "dependency.wildcard-version",
        "Wildcard dependency version",
        Pillar::Security,
        RuleKind::Project,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags dependency requirements that use wildcard versions.",
    ),
];

pub(crate) const DOCUMENTATION_AND_DESIGN_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "design.god-function",
        "God function",
        Pillar::Design,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags functions that are both long and complex.",
    ),
    rule_definition!(
        "docs.missing-public-doc",
        "Missing public documentation",
        Pillar::Documentation,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::Medium,
        None,
        "Flags public Rust API items without doc comments.",
    ),
    rule_definition!(
        "docs.missing-readme",
        "Missing README",
        Pillar::Documentation,
        RuleKind::Project,
        Severity::Advisory,
        Confidence::High,
        None,
        "Flags projects without a root README file.",
    ),
    rule_definition!(
        "docs.stale-todo",
        "Stale TODO marker",
        Pillar::Documentation,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::High,
        None,
        "Flags TODO/FIXME/HACK/XXX comments without an owner, issue reference, or reason.",
    ),
    rule_definition!(
        "docs.commented-out-code",
        "Commented-out code",
        Pillar::Documentation,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::Medium,
        None,
        "Flags comments whose payload looks like a disabled Rust statement or item.",
    ),
    rule_definition!(
        "docs.weak-safety-rationale",
        "Weak SAFETY rationale",
        Pillar::Documentation,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::Medium,
        None,
        "Flags unsafe blocks whose nearby SAFETY: rationale is too short or vague.",
    ),
    rule_definition!(
        "docs.missing-errors-section",
        "Missing # Errors rustdoc section",
        Pillar::Documentation,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::High,
        None,
        "Flags externally public functions returning Result without a # Errors rustdoc section.",
    ),
];

pub(crate) const CONCURRENCY_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "concurrency.blocking-call-in-async",
        "Blocking call in async function",
        Pillar::Waste,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::Medium,
        None,
        "Flags narrow blocking call patterns inside async functions.",
    ),
    rule_definition!(
        "concurrency.lock-across-await",
        "Lock guard across await",
        Pillar::Waste,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::Medium,
        None,
        "Flags lock guard bindings that appear to live across an await point.",
    ),
    rule_definition!(
        "concurrency.unbounded-channel",
        "Unbounded channel",
        Pillar::Waste,
        RuleKind::Rust,
        Severity::Advisory,
        Confidence::Medium,
        None,
        "Flags unbounded channel constructors in production code.",
    ),
];

pub(crate) const ERROR_HANDLING_RULES: &[RuleDefinition] = &[
    rule_definition!(
        "error-handling.production-panic",
        "Production panic",
        Pillar::Waste,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags panic! calls in non-test functions without a local invariant comment.",
    ),
    rule_definition!(
        "error-handling.public-unwrap",
        "Public API unwrap",
        Pillar::Waste,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags unwrap or expect calls in public non-test functions.",
    ),
    rule_definition!(
        "error-handling.unimplemented-placeholder",
        "Unimplemented placeholder",
        Pillar::Waste,
        RuleKind::Rust,
        Severity::Warning,
        Confidence::High,
        None,
        "Flags todo! and unimplemented! placeholders in non-test functions.",
    ),
];