code-standards
One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
uv tool install --python 3.15 code-standards
Adopt the repository once with code-standards setup. It installs one canonical staged gate that includes semantic lint and repository policy, plus commit-message and pull-request history enforcement. Do not install Repo Standards separately.
code-standards setup
code-standards check
code-standards check --rule python:no-excessive-cognitive-complexity src/
code-standards fix
code-standards doctor
code-standards update
Use repeatable check --rule ENGINE:ID selectors to select native rules, ESLint rules, or managed security audits. Exclusions, baselines, and severities still apply; Ruff selectors are not supported. Native linters and ESLint execute only selected rules. ESLint retains configured parsers, options, severities, and suppression directives.
Terraform, Kubernetes, and GitHub Actions adoption adds isolated Checkov 3.3.20 and zizmor 1.30.1 runtimes. Setup and generated CI prewarm these tools; checks run offline with packaged policy. Use --rule checkov:CKV_GCP_95 or --rule zizmor:template-injection to select upstream audits. Their findings start as warnings, use the canonical diagnostic baseline, and retain upstream IDs. Checkov honors its inline suppression directives; zizmor ignore comments are disabled. Explicit zizmor selectors include auditor-persona checks; online-only audits cannot run offline. Parsing or execution failures leave the analysis incomplete. Image digest evidence for source templates is deferred to their rendered deployment artifacts.
The opt-in jscpd capability runs the jscpd 5.4.0 copy-paste detector, which setup installs through mise. Setup and upgrades list it in [capabilities].disable; remove it there to enable it. Each check scans Python, TypeScript, Swift and Kotlin source outside test directories, because a copy can only be found by comparing it with the whole tree. Every repeated block of at least 50 tokens is a jscpd:duplicate-code warning on its own lines that names the other copies, so the changed-line baseline reports it when either side is edited. The repository's own jscpd configuration is ignored.
The shfmt capability checks shell files, including extensionless shebang entrypoints, with shfmt 3.14.1 using two-space indentation and indented case clauses. Explicit, staged and PR-selected files must be formatted in full; full scans report existing drift as warnings. Formatting errors on selected files cannot be hidden by a diagnostic baseline. code-standards fix formats selected files safely, preserving executable permissions; generated Gradle launchers are excluded. Shebangs determine the shell before filename suffixes, including supported shells at custom absolute paths. Bats files use the upstream Bats formatter dialect. Zsh formatting does not provide ShellCheck coverage: its unsupported dialect remains an explicit coverage failure. Ambient editor settings cannot change the canonical style, and simplification is disabled.
Shell libraries with a shell suffix or no suffix can declare their dialect with a top-level # shellcheck shell=bash header before executable source. Quoted dialect values and preceding directive fields are supported. An executable shebang remains authoritative. Generated Gradle exclusions require the exact generator comment in the source header; mentions in strings, heredocs and ordinary prose do not exempt authored scripts. Automatic fixes refuse native formatter output that removes carriage-return bytes, so literal data and line endings need manual review in those cases.
ShellCheck and shfmt also inspect executable shell fields in workflows, composite actions, Cloud Build, Make and Mise using the same policy as shell files. Analysis follows the configured interpreter, including inherited Actions shells and Cloud Build shebangs, and reports positions in the authored configuration. Actions expressions are masked for native parsing with their quoted string boundaries preserved, and actionlint retains workflow validation while shared ShellCheck supplies shell findings once. Docker shell semantics remain owned by Hadolint. Fixes can format verified literal YAML blocks while preserving scalar headers, newlines and decoded execution source. Folded scalars, aliases, templates, argv, Make and Mise remain check-only; extract complex programs to shell files for independently linted execution.
The shared argv parser records effective errexit and pipefail options in order, including later +e and +o disables. Interpreter option operands and arguments after the script or command payload do not activate runtime checks.
The shared ShellCheck policy enables check-set-e-suppressed alongside the existing check-extra-masked-returns. SC2310 and SC2311 warn when function calls suppress set -e, including conditional calls and command substitutions. Review intentional predicates and use justified native ShellCheck suppressions where appropriate; these findings have no automatic semantic fix. SC2312 remains enabled to detect masked exit status. The repository shell gate prints the new warnings without failing for them and retains its existing blocking checks. The managed .shellcheckrc retains the existing native gate checks; Standards enables these advisory checks explicitly because direct ShellCheck exits nonzero for informational findings.
For concise Bash, preserve arguments with quoted expansions and command arrays, use a literal printf format, and handle fallible commands explicitly. Built-in lookup and parameter expansion can replace external commands when their lookup, output and exit-status contracts agree. These choices use existing upstream checks; intentional stream contracts and predicates require review rather than automatic semantic rewrites.
The opt-in knip capability uses Knip 6.41.0 production mode. Remove it from [capabilities].disable and declare application = true under [knip] to enable advisory knip:files evidence. Version one supports a single private application with entry and project arrays containing production patterns ending in ! in knip.json or .knip.json. Native aliases and framework entries remain authoritative; unresolved imports, configuration diagnostics, workspaces and dynamic configuration make the graph inconclusive. Review runtime and public owners before deleting a module. No automatic fixes or application inference are performed.
Unused private Python test helpers require reportUnusedFunction set to warning in the consumer's existing BasedPyright test execution environments. This bundle preserves native configuration and bounds test warnings to authored, undecorated module-level private helpers in conventional test paths. Decorated fixtures, methods and production callbacks are excluded; no consumer diagnostic setting is enabled automatically. Existing production diagnostics are preserved.
check --jobs 2 overlaps native analysis with the external-tool pipeline. The default is --jobs 1; external tools remain sequential and report ordering is deterministic.
DevOps execution blocks may sequence existing commands without helper scripts. Keep interpreter source, control flow, logical chains, pipelines and substitutions in independently linted files; Python -m and script paths, and jq/awk -f files remain supported. SARJ310 is an error, including short inline programs. Cloud Build SARJ315 checks unique IDs, ordered step dependencies, script/argv exclusivity and rejects untrusted substitutions in shell source; pass substitutions as quoted arguments to external scripts.
The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer [devops].compose_version; its source check does not resolve environment inputs.
Release gates use code-standards analyze --prepared-only --prepared-devops prepared.json --prepared-target TARGET_ID. Declare exact prepared_targets under [devops] with an authored source path. Version-one receipts bind target IDs, authored input hashes, staged chart archives, ordered values, typed set arguments, manifests and a hashed local schema closure. Helm 3.19.0 strict lint and stage-specific rendering feed kubeconform 0.8.0 and kube-linter 0.8.3. Missing tools, schemas, targets and invalid receipts fail the gate. Prepared-only findings bypass source debt baselines; container exceptions require exact target, GVK, namespace, object, check, container kind, container name and a reason, and stale exceptions fail.
Source-only checks report prepared validation as deferred. They do not certify generated manifests or replace Cloud Deploy, Cloud Build or Kubernetes admission validation. Run setup --tools-only in CI after installing the bundle and the pinned mise bootstrap. It requires an existing manifest, installs and attests the applicable native tools, and preserves repository wiring. Release analysis consumes prepared bytes without pulling charts.
1 maintainer
Metadata
1 maintainer
Release files for code-standards 8.50.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| code_standards-8.50.1.tar.gz | 841.6 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| code_standards-8.50.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.8 MB
Release files / code_standards-8.50.1.tar.gz
| Download URL | code_standards-8.50.1.tar.gz |
|---|---|
| Size | 841.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b48933cd02a7840381f58a46ff844bb6f5338a0ba4bde7815fa62ac73623815a
|
|
BLAKE2b-256 checksum How to use checksums |
7c9ab59e4e8778fd554c7da578d9ba39b2d933075ce33a7930f14bb9ab6f68ca
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 12, 2026.
Transparency logRelease files / code_standards-8.50.1-py3-none-any.whl
| Download URL | code_standards-8.50.1-py3-none-any.whl |
|---|---|
| Size | 928.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
fdf2e1b188ca2f2cb7dee48286d4811c59794c5261892a5b70819f17acc9c9b2
|
|
BLAKE2b-256 checksum How to use checksums |
26be67714d8848a34bd3f522b17169153e69a025093b3a38659a8d8dcd5fa155
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 12, 2026.
Transparency log
