code-standards
One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
uv tool install --python 3.15 code-standards
Adopt the repository once with code-standards setup. It installs one canonical staged gate that includes semantic lint and repository policy, plus commit-message and pull-request history enforcement. Do not install Repo Standards separately.
code-standards setup
code-standards check
code-standards check --rule python:no-excessive-cognitive-complexity src/
code-standards fix
code-standards doctor
code-standards update
Use repeatable check --rule ENGINE:ID selectors to select native rules, ESLint rules, or managed security audits. Exclusions, baselines, and severities still apply; Ruff selectors are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
Terraform, Kubernetes, and GitHub Actions adoption adds isolated Checkov 3.3.20 and zizmor 1.30.1 runtimes. Setup and generated CI prewarm these tools; checks run offline with packaged policy. Use --rule checkov:CKV_GCP_95 or --rule zizmor:template-injection to select upstream audits. Their findings start as warnings, use the canonical diagnostic baseline, and retain upstream IDs. Checkov honors its inline suppression directives; zizmor ignore comments are disabled. Explicit zizmor selectors include auditor-persona checks; online-only audits cannot run offline. Parsing or execution failures leave the analysis incomplete. Image digest evidence for source templates is deferred to their rendered deployment artifacts.
check --jobs 2 overlaps native analysis with the external-tool pipeline. The default is --jobs 1; external tools remain sequential and report ordering is deterministic.
DevOps execution blocks must contain one invocation. Move interpreter source, command chains, loops, substitutions and heredocs into independently linted files; Python -m and script paths, and jq/awk -f files remain supported. SARJ310 is an error, including short inline programs. Cloud Build SARJ315 checks unique IDs, ordered step dependencies, script/argv exclusivity and rejects untrusted substitutions in shell source; pass substitutions as quoted arguments to external scripts.
The source gate uses pinned actionlint with ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer [devops].compose_version; its source check does not resolve environment inputs.
Release gates use code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID. Declare exact prepared_targets under [devops] with an authored source path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 3.19.0 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
Source-only checks report prepared validation as deferred. They do not certify generated manifests or replace Cloud Deploy, Cloud Build or Kubernetes admission validation. Run setup --tools-only in CI after installing the bundle and the pinned mise bootstrap. It requires an existing manifest, installs and attests the applicable native tools, and preserves repository wiring. Release analysis consumes prepared bytes without pulling charts.
1 maintainer
Metadata
1 maintainer
Release files for code-standards 8.40.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| code_standards-8.40.0.tar.gz | 773.4 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| code_standards-8.40.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.6 MB
Release files / code_standards-8.40.0.tar.gz
| Download URL | code_standards-8.40.0.tar.gz |
|---|---|
| Size | 773.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e152d1bd0738e478a99009fd45f45f9cfcce84faba7a2d84ce58819ff7abce4f
|
|
BLAKE2b-256 checksum How to use checksums |
ba48975316b97839276496b6d48ffe29cd198b3d194f9b942389dd77ba3e4c3a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 9, 2026.
Transparency logRelease files / code_standards-8.40.0-py3-none-any.whl
| Download URL | code_standards-8.40.0-py3-none-any.whl |
|---|---|
| Size | 853.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
2882b11a8e84f6b08f65b4c87c73337c70ab7b9a8f4056e702898c9faf654483
|
|
BLAKE2b-256 checksum How to use checksums |
b439fe725c69ea533c2f0c78a6e798b8eca1963392694be6f48a431000ffe420
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 9, 2026.
Transparency log
