Gruff
Gruff is an opinionated, deterministic maintainability linter for Python. It complements Ruff with project policies that make agent-assisted code easier to understand and review; it does not infer who or what wrote the code.
Installation
Requires Python 3.10 or later.
pip install gruff
Or with uv:
uv tool install gruff
Verify it works:
gruff --version
Quick start
Enable every Gruff rule in pyproject.toml:
[tool.gruff.lint]
select = ["GR"]
Then check the current directory:
gruff check .
All rules are opt-in. Use an exact code such as GR001 to adopt rules individually; GR enables every Gruff rule. A check with no enabled rules succeeds but warns that it performed no policy analysis.
Rules at a glance
The first release tests eleven theses: inputs are easier to trace when definitions declare how callers pass them, non-public behavior is easier to review when callers supply every value, package initializer manifests are easier to review when every public import path defines __all__, constants are easier to review when uppercase names and Final annotations always appear together, non-public definitions are easier to understand when their names carry their purpose, comments are worth reading when they state more than the code beneath them, tests are worth running when an exception can still fail them, a body is easier to follow when its trailing condition inverts into a guard, a branch is easier to verify when its condition states the positive form, a non-public module binding is easier to find when it lives in the one definition that reads it, and public instance data is easier to review when properties declare its interface.
| Code | Rule | Policy |
|---|---|---|
| GR001 | explicit-non-public-input-conventions |
Every fixed input to a non-public callable has an explicit calling convention. |
| GR002 | required-non-public-inputs |
Callers supply every fixed input to non-public callables. |
| GR003 | package-dunder-all |
Every public package import path defines __all__. |
| GR004 | final-constants |
Uppercase names and Final annotations appear together. |
| GR005 | explicit-public-input-conventions |
Every fixed input to a public callable has an explicit calling convention. |
| GR006 | no-non-public-docstrings |
Non-public definitions carry their purpose in their names instead of docstrings. |
| GR007 | no-subsumed-comments |
One-line comments state something beyond the statements they annotate. |
| GR008 | no-exception-swallowing-tests |
Tests let exceptions propagate instead of swallowing them. |
| GR009 | no-guarded-tails |
Trailing conditions invert into guards instead of nesting the rest of the body. |
| GR010 | positive-branch-conditions |
Branch conditions state the positive form instead of negating around an else. |
| GR011 | no-single-consumer-module-bindings |
Non-public module bindings live in the one definition that reads them. |
| GR012 | explicit-instance-data |
Public instance data is explicit through class-body annotations or properties. |
Each rule links to its rule doc, which states what the rule flags, why, an example, and when to suppress. gruff rule GR004 prints the same document in the terminal, and gruff rule --all --output-format json emits every rule for tooling.
Documentation
The documentation site carries the rule docs, and its configuration page covers pyproject.toml, the command-line reference, suppressing findings, and the recommended Ruff pairing.
Distribution
Gruff releases use PyPI wheels for Linux x86_64 and aarch64, macOS x86_64 and arm64, and Windows x86_64. Gruff is not published to crates.io.
Metadata
Release files for gruff 0.0.10
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Actions Reset | |||
|---|---|---|---|---|
| gruff-0.0.10-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details for gruff-0.0.10-py3-none-win_amd64.whl |
| gruff-0.0.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl | Python 3 | none | Linux glibc 2.17+ x86-64 | Details for gruff-0.0.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
| gruff-0.0.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl | Python 3 | none | Linux glibc 2.17+ ARM64 | Details for gruff-0.0.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
| gruff-0.0.10-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details for gruff-0.0.10-py3-none-macosx_11_0_arm64.whl |
| gruff-0.0.10-py3-none-macosx_10_12_x86_64.whl | Python 3 | none | macOS 10.12+ x86-64 | Details for gruff-0.0.10-py3-none-macosx_10_12_x86_64.whl |
Total release size: 10.0 MB
Release files / gruff-0.0.10-py3-none-win_amd64.whl
| Download URL | gruff-0.0.10-py3-none-win_amd64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
9e2495e84247df4fa5067dabe6272a0037403f3b8fdafc71f25840c282b877af
|
|
BLAKE2b-256 checksum How to use checksums |
ad160f5d14f2bf5518aa261c7896c1c93dec66b1878f8c6a5abbe5f699692c73
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 7, 2026.
Transparency logRelease files / gruff-0.0.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
| Download URL | gruff-0.0.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl |
|---|---|
| Size | 2.1 MB |
| Tags | Linux glibc 2.17+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
2b1889578bb75302bbea5234c39ddde49120344f10634b8333473bc4e2f26213
|
|
BLAKE2b-256 checksum How to use checksums |
46a394d5a30aa8dcc7a0f69e70ef1491b6a263853cea3d6c7fff096deaee79bf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 7, 2026.
Transparency logRelease files / gruff-0.0.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
| Download URL | gruff-0.0.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | Linux glibc 2.17+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
b0c22cfa526a5ff3fc5577cba4dd3b4492f941ccf67b664a7c95ba0516c7a67e
|
|
BLAKE2b-256 checksum How to use checksums |
36337d35bade2093959c4205bb05bb357cdc4d79ebf8463b7f49e8d1e82d992b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 7, 2026.
Transparency logRelease files / gruff-0.0.10-py3-none-macosx_11_0_arm64.whl
| Download URL | gruff-0.0.10-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
de9f7154e371feeebaf6d88282d512dc29eca5e916bac307924b264d754db487
|
|
BLAKE2b-256 checksum How to use checksums |
3b8f8b120b35029b0122b5a695c31d741b3e650fb8bb91a2769a4eb41c9c54c4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 7, 2026.
Transparency logRelease files / gruff-0.0.10-py3-none-macosx_10_12_x86_64.whl
| Download URL | gruff-0.0.10-py3-none-macosx_10_12_x86_64.whl |
|---|---|
| Size | 2.0 MB |
| Tags | Python 3 macOS 10.12+ x86-64 |
|
SHA-256 checksum How to use checksums |
4a6351ef3d046224b856a1b5bad74ff2d7695ea8935d5090bfb182aa6ac78106
|
|
BLAKE2b-256 checksum How to use checksums |
9a3f7e96f6a52854c60308cb5a07c3d4109727347dd8da2e7cd1cab81739c2b3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 7, 2026.
Transparency logSecurity for gruff 0.0.10
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 5 files in this release have been uploaded with provenance metadata.
Attestation for gruff-0.0.10-py3-none-win_amd64.whl
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 7, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.