gruff-rs 0.4.0

Rust static analyzer and quality linter for CI: dead-code, complexity, security, secrets, and architecture rules with deterministic SARIF/JSON output and baseline support.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

# Configuration

gruff-rs reads YAML configuration and applies it before rule analysis.

## Discovery

Default discovery checks the project root for `.gruff-rs.yaml`.

Use `--config <path>` to load a specific YAML file, or `--no-config` to run
with built-in defaults. Explicit `.json` config paths are rejected; use YAML.

## Root Keys

Every config must declare `schemaVersion: gruff-rs.config.v1` as its first key;
configs without it are rejected at load time (run `gruff-rs init --force` to
regenerate). The supported top-level sections are:

- `schemaVersion` (required) — config schema version; must be `gruff-rs.config.v1`.
- `paths`
- `allowlists`
- `rules`
- `custom_rules`
- `exclude`
- `minimumSeverity` — per-subcommand `--fail-on` defaults for `analyse` and `report`.
- `gate` — count-based quality gate (per-severity and total caps).

Unknown sections are rejected so config mistakes fail early.

## Paths

Use `paths.ignore` for project-specific ignore patterns:

```yaml
paths:
  ignore:
    - target/
```

## Rule Selection

Rust uses `rules.select` and `rules.ignore` for rule selection:

```yaml
rules:
  select:
    - security.process-command
  ignore:
    - sensitive-data.aws-access-key
```

## Custom Rules

`custom_rules` can add deterministic regex-backed checks:

```yaml
custom_rules:
  - id: custom.todo-marker
    pillar: Documentation
    severity: advisory
    message: TODO marker
    scope: text
    pattern: TODO
```

## Exclusions

Use `exclude` for documented suppressions:

```yaml
exclude:
  - rule: security.process-command
    reason: accepted fixture command
```

## Compatibility

The shared cross-language config expectations are documented in the
workspace-level `CONTRACT.md` (at the gruff workspace root, sibling to this
crate). Rust intentionally keeps YAML-only config loading and Rust-specific
`custom_rules` / `exclude` sections.