patterns

type AnonInterfaceDegradationRule ¶ added in v1.4.2

type AnonInterfaceDegradationRule struct {
	*rules.BaseRule
}

AnonInterfaceDegradationRule detects type assertions on anonymous interfaces followed by silent degradation returns. This pattern often indicates dead delegation code.

Catches patterns like:

if x.(interface{ Method() Type }); ok {
    return x.Method()
}
return zeroValue // Problem: silently degrades

This violates "Fail explicitly, never degrade silently"

func NewAnonInterfaceDegradationRule() *AnonInterfaceDegradationRule

func (r *AnonInterfaceDegradationRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type AppendAssignRule ¶

type AppendAssignRule struct {
	*rules.BaseRule
}

AppendAssignRule detects append() calls without assignment

func NewAppendAssignRule() *AppendAssignRule

func (r *AppendAssignRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type AuditActorPropagationRule ¶ added in v1.4.2

type AuditActorPropagationRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

AuditActorPropagationRule detects loss of human actor and audit source attribution before typed audit sinks.

func NewAuditActorPropagationRule() *AuditActorPropagationRule

func (r *AuditActorPropagationRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *AuditActorPropagationRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *AuditActorPropagationRule) Configure(settings map[string]any) error

func (r *AuditActorPropagationRule) RequiresSSA() bool

type BoolCompareRule ¶

type BoolCompareRule struct {
	*rules.BaseRule
}

BoolCompareRule detects redundant boolean comparisons

func NewBoolCompareRule() *BoolCompareRule

func (r *BoolCompareRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ConstructorNilReturnRule ¶ added in v1.4.2

type ConstructorNilReturnRule struct {
	*rules.BaseRule
}

ConstructorNilReturnRule detects constructors (New*) without an error result that can return nil:

func NewWalletRepository(userRepo interface{}) WalletRepository {
    repo, ok := userRepo.(*UserRepository)
    if !ok {
        return nil // callers silently receive a nil dependency
    }
    ...
}

Callers rarely nil-check constructor results, so the failure surfaces much later as a panic far from its cause. CLAUDE.md: initialization failures must be explicit — change the signature to (T, error).

Scope is kept narrow for precision: plain functions named New* with a single non-error result. Comma-ok contracts (T, bool), methods on factories, and closures are out of scope.

func NewConstructorNilReturnRule() *ConstructorNilReturnRule

func (r *ConstructorNilReturnRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ConstructorSwallowsNilDepRule ¶ added in v1.4.2

type ConstructorSwallowsNilDepRule struct {
	*rules.BaseRule
}

ConstructorSwallowsNilDepRule detects constructors that notice a nil dependency, log it — and build the object anyway:

func NewPermissionManager(repo Repository) *PermissionManager {
    if repo == nil {
        logger.Error("Critical: repo is nil") // and continues!
    }
    return &PermissionManager{repo: repo}
}

This is the "graceful degradation" anti-pattern forbidden by CLAUDE.md: the caller receives a half-alive object and the failure surfaces far from its cause. A nil dependency must abort construction with an error.

Not flagged: returning an error, panicking, or assigning a default to the parameter (options-defaulting), and Debug/Info-level notes.

func NewConstructorSwallowsNilDepRule() *ConstructorSwallowsNilDepRule

func (r *ConstructorSwallowsNilDepRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ContextBackgroundRule ¶

type ContextBackgroundRule struct {
	*rules.BaseRule
}

ContextBackgroundRule detects context.Background/TODO usage in functions that receive context

func NewContextBackgroundRule() *ContextBackgroundRule

func (r *ContextBackgroundRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ContextFirstRule ¶ added in v1.4.2

type ContextFirstRule struct {
	*rules.BaseRule
}

ContextFirstRule detects a function that needs a context, does not accept one, and therefore invents its own:

func (s *Service) SyncWallet(address string) error {
    ctx := context.Background()          // the caller's deadline is gone
    return s.repo.Save(ctx, address)
}

The call chain silently stops being cancellable at this function: a request the user aborted keeps running, a shutdown waits for work nobody needs, and a deadline set three frames up applies to nothing below.

The rule looks at what the function does, not at what it is called: a function that hands no context to anything needs none, whatever its name. Functions that already accept a context are the business of context-background, which reports the same misuse from the other side.

Not flagged: package main and the entry points init/TestMain, where the root context of the program has to come from somewhere; contexts created for a goroutine that outlives the call; and contexts whose cancel function is stored rather than deferred, which belong to something started here and stopped elsewhere.

func NewContextFirstRule() *ContextFirstRule

func (r *ContextFirstRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type DeferInLoopRule ¶

type DeferInLoopRule struct {
	*rules.BaseRule
}

DeferInLoopRule detects defer statements inside loops

func NewDeferInLoopRule() *DeferInLoopRule

func (r *DeferInLoopRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type DeprecatedIoutilRule ¶

type DeprecatedIoutilRule struct {
	*rules.BaseRule
}

DeprecatedIoutilRule detects usage of deprecated io/ioutil package

func NewDeprecatedIoutilRule() *DeprecatedIoutilRule

func (r *DeprecatedIoutilRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type DeprecatedNginxHTTP2ListenRule ¶ added in v1.4.2

type DeprecatedNginxHTTP2ListenRule struct {
	*rules.BaseRule
}

DeprecatedNginxHTTP2ListenRule detects syntax deprecated by Nginx 1.25.1.

func NewDeprecatedNginxHTTP2ListenRule() *DeprecatedNginxHTTP2ListenRule

func (r *DeprecatedNginxHTTP2ListenRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type DeterministicUUIDRule ¶ added in v1.4.2

type DeterministicUUIDRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

DeterministicUUIDRule detects patterns where UUIDs are generated from strings (email, namespace) instead of using real UUIDs from the database. Principle: "ID always comes from DB, never computed"

func NewDeterministicUUIDRule() *DeterministicUUIDRule

func (r *DeterministicUUIDRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type E2EBlindWaitRule ¶ added in v1.4.2

type E2EBlindWaitRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

E2EBlindWaitRule detects browser-test waits that are not tied to the fact under test: `waitForLoadState('networkidle')`, `goto(..., { waitUntil: 'networkidle' })` and `waitForTimeout(N)`.

Такое ожидание врёт в обе стороны. На странице с фоновыми запросами тишина в сети не наступает вовсе, и тест падает по таймауту, ничего не проверив; на странице, которая рисует данные вторым кадром, тишина наступает раньше отрисовки, и тест читает пустую разметку. Слепая пауза `waitForTimeout` добавляет к этому зависимость от скорости машины.

Проверяемый факт всегда конкретен: появился локатор, сменился URL, пришло значение. На него и надо ждать — тогда ожидание и есть проверка.

Третий случай того же семейства — проверка нового URL сразу после действия, которое этот переход запускает. Клиентский роутер уводит со страницы асинхронно, поэтому `expect(page.url()).toContain('/onboarding')` читает ещё старый адрес; ждать надо сам переход через waitForURL.

networkidle внутри try/catch не флагуется: там это мягкая синхронизация с явным запасным путём, а не единственное условие готовности.

func NewE2EBlindWaitRule() *E2EBlindWaitRule

func (r *E2EBlindWaitRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type EmptyBlockRule ¶

type EmptyBlockRule struct {
	*rules.BaseRule
}

EmptyBlockRule detects empty if/for/switch blocks

func NewEmptyBlockRule() *EmptyBlockRule

func (r *EmptyBlockRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type EmptyStructReturnRule ¶ added in v1.4.2

type EmptyStructReturnRule struct {
	*rules.BaseRule
}

EmptyStructReturnRule detects functions that return empty structs with nil error instead of returning explicit error. This violates "Fail explicitly, never degrade silently" Catches: return SafeDecimal{}, nil (in error context) Catches: return Config{} (without error, in error context)

func NewEmptyStructReturnRule() *EmptyStructReturnRule

func (r *EmptyStructReturnRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ErrorLengthCheckRule ¶ added in v1.4.2

type ErrorLengthCheckRule struct {
	*rules.BaseRule
}

ErrorLengthCheckRule detects dangerous patterns where error type is determined by string length This is an anti-pattern because: - Any error message of certain length will be misclassified - Error message length depends on driver version, locale, etc. - Real errors get masked as different error types

func NewErrorLengthCheckRule() *ErrorLengthCheckRule

func (r *ErrorLengthCheckRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ErrorMaskedAsFalseBoolRule ¶ added in v1.4.2

type ErrorMaskedAsFalseBoolRule struct {
	*rules.BaseRule
}

ErrorMaskedAsFalseBoolRule detects `if err != nil { return false }` patterns inside non-predicate bool-returning functions.

The existing `error-masking` rule requires the function to return `error`. That misses a class of security-sensitive bugs where a `(...) bool` function internally calls an error-returning API, then conflates "error" with "not allowed":

func ValidateUserPermission(user, perm string) bool {
    permissions, err := c.GetRolePermissions(user)
    if err != nil {
        return false  // ← user gets denied for reasons they can't debug;
                      //   ops can't see that lookup is broken
    }
    ...
}

Pure predicates (IsEnabled, HasRole, CanWrite, ShouldRetry) are exempt — returning false on lookup miss is their whole contract.

Detects:

• `if err != nil { ... return false ... }` without any logging call
• Function's return type contains `bool` (any position, not just last)
• Function name does NOT start with Is/Has/Can/Should

Skips:

• Test files
• Pure predicate functions (Is/Has/Can/Should prefix)
• Blocks that log the error before returning false

func NewErrorMaskedAsFalseBoolRule() *ErrorMaskedAsFalseBoolRule

func (r *ErrorMaskedAsFalseBoolRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ErrorMaskingRule ¶

type ErrorMaskingRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

ErrorMaskingRule detects patterns that mask errors instead of handling them properly This implements CLAUDE.md principle: "Fail explicitly, never degrade silently"

func NewErrorMaskingRule() *ErrorMaskingRule

func (r *ErrorMaskingRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ErrorStringCompareRule ¶ added in v1.3.0

type ErrorStringCompareRule struct {
	*rules.BaseRule
}

ErrorStringCompareRule detects error comparisons using string matching

func NewErrorStringCompareRule() *ErrorStringCompareRule

func (r *ErrorStringCompareRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ErrorStringRule ¶

type ErrorStringRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

ErrorStringRule detects error strings that don't follow Go conventions

func NewErrorStringRule() *ErrorStringRule

func (r *ErrorStringRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ErrorWrapRule ¶ added in v1.3.0

type ErrorWrapRule struct {
	*rules.BaseRule
}

ErrorWrapRule detects errors returned without context wrapping

func NewErrorWrapRule() *ErrorWrapRule

func (r *ErrorWrapRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FallbackReturnRule ¶ added in v1.4.2

type FallbackReturnRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

FallbackReturnRule detects fallback patterns that silently degrade instead of failing explicitly This implements CLAUDE.md principle: "Fail explicitly, never degrade silently" Catches: return testProvider, return mockService on errors Excludes: functions with "OrDefault" in name, parse* functions, singleton getters, middleware defensive code

func NewFallbackReturnRule() *FallbackReturnRule

func (r *FallbackReturnRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FinancialConstantsRule ¶ added in v1.4.2

type FinancialConstantsRule struct {
	*rules.BaseRule
}

FinancialConstantsRule detects hardcoded financial constants that should be in config Examples: fees, commissions, rates, percentages in financial context

func NewFinancialConstantsRule() *FinancialConstantsRule

func (r *FinancialConstantsRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FinancialDecimalFloatRule ¶ added in v1.4.2

type FinancialDecimalFloatRule struct {
	*rules.BaseRule
}

FinancialDecimalFloatRule detects discarded exactness from financial decimal conversions.

func NewFinancialDecimalFloatRule() *FinancialDecimalFloatRule

func (r *FinancialDecimalFloatRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FinancialFPRoundingRule ¶ added in v1.4.2

type FinancialFPRoundingRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

FinancialFPRoundingRule detects unsafe floor/ceil/trunc rounding of money values multiplied by 100 (or by an explicit percentage). Pattern `Math.floor(value * 100) / 100` looks like "round down to cent" but JavaScript IEEE-754 makes `5055.19 * 100 = 505518.99999999994`, which floors to `505518` and yields `5055.18` — silently losing one cent.

The same shimmer hits `Math.floor(money * pct) / 100` for percentage buttons (e.g. 100% of max → 5055.18 instead of 5055.19).

Safe alternatives:

• `Math.round(value * 100) / 100` — half-even, no shimmer for cent grid
• `Math.floor(value * 100 + 1e-9) / 100` — explicit epsilon
• `value.toFixed(2)` when half-up rounding is acceptable
• In Go: use `decimal.Decimal` arithmetic, never float64

func NewFinancialFPRoundingRule() *FinancialFPRoundingRule

func (r *FinancialFPRoundingRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FinancialJSONFloatRule ¶ added in v1.4.2

type FinancialJSONFloatRule struct {
	*rules.BaseRule
}

FinancialJSONFloatRule detects precision-losing floats in monetary JSON contracts.

func NewFinancialJSONFloatRule() *FinancialJSONFloatRule

func (r *FinancialJSONFloatRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FinancialRoundedDeltaRule ¶ added in v1.4.2

type FinancialRoundedDeltaRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

FinancialRoundedDeltaRule detects financial deltas derived by subtracting parsed cumulative money fields. Financial deltas should be calculated in the canonical backend/domain layer from full-precision decimals and exposed as a first-class field, not reconstructed from rounded API/display values.

func NewFinancialRoundedDeltaRule() *FinancialRoundedDeltaRule

func (r *FinancialRoundedDeltaRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FrontendEnvFallbackRule ¶ added in v1.4.2

type FrontendEnvFallbackRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

FrontendEnvFallbackRule detects frontend public-env patterns that silently degrade at build/runtime instead of failing explicitly.

func NewFrontendEnvFallbackRule() *FrontendEnvFallbackRule

func (r *FrontendEnvFallbackRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type FrontendMoneyArithmeticRule ¶ added in v1.4.2

type FrontendMoneyArithmeticRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

FrontendMoneyArithmeticRule detects client-side arithmetic over money values in TS/JS:

investedAmount += parseFloat(inv.amount)
pending.reduce((sum, w) => sum + parseFloat(w.amount || '0'), 0)

Financial aggregates must be computed on the backend (single canonical calculation logic); parseFloat over decimal strings silently loses precision, and duplicated client math diverges from the server.

Not flagged: pure formatting (formatAmount(parseFloat(x))), comparisons, non-money numerics, tests.

func NewFrontendMoneyArithmeticRule() *FrontendMoneyArithmeticRule

func (r *FrontendMoneyArithmeticRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

func (r *FrontendMoneyArithmeticRule) Configure(settings map[string]any) error

type FrontendSilentCatchRule ¶ added in v1.4.2

type FrontendSilentCatchRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

FrontendSilentCatchRule detects frontend catch blocks that only log errors. UI code must either surface the failure to the user or rethrow it to a caller that can do so.

func NewFrontendSilentCatchRule() *FrontendSilentCatchRule

func (r *FrontendSilentCatchRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type GoModernRule ¶ added in v1.4.0

type GoModernRule struct {
	*rules.BaseRule
}

GoModernRule detects patterns that could use modern Go features

func NewGoModernRule() *GoModernRule

func (r *GoModernRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type HTTPBodyCloseRule ¶

type HTTPBodyCloseRule struct {
	*rules.BaseRule
}

HTTPBodyCloseRule detects HTTP response body not being closed

func NewHTTPBodyCloseRule() *HTTPBodyCloseRule

func (r *HTTPBodyCloseRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type IdempotencyCheckThenCreateRule ¶ added in v1.4.2

type IdempotencyCheckThenCreateRule struct {
	*rules.BaseRule
}

IdempotencyCheckThenCreateRule detects non-atomic idempotency checks followed by a create on the same repository.

func NewIdempotencyCheckThenCreateRule() *IdempotencyCheckThenCreateRule

func (r *IdempotencyCheckThenCreateRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type IgnoredErrorRule ¶

type IgnoredErrorRule struct {
	*rules.BaseRule
}

IgnoredErrorRule detects error values thrown away with the blank identifier.

Whether a returned value is an error is decided by its type, not by the name of the function returning it. The name-based version of this rule matched a fixed list of verbs (Read, Parse, Query, Marshal…) and therefore stayed silent on every domain method — the shape `items, _ = repo.List(ctx)` reads as "no data" downstream while the query may well have failed (REF-462).

Closing a resource stays exempt: `_ = conn.Close()` and the print family cannot report anything useful to the caller, and writing the blank there is the documented way to say "checked and deliberately dropped".

func NewIgnoredErrorRule() *IgnoredErrorRule

func (r *IgnoredErrorRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *IgnoredErrorRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *IgnoredErrorRule) RequiresSSA() bool

type LegacyCommentMarkerRule ¶ added in v1.4.2

type LegacyCommentMarkerRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

LegacyCommentMarkerRule detects inline comments that document a runtime legacy code path — "Legacy mode", "Legacy compatibility", "legacy SSE auth", "(legacy)" — as distinct from identifier names (covered by legacy-identifier) and godoc-level Deprecated comments (covered by deprecated-comment).

Why inline: composite_router.go:831 has `// 2. Legacy mode: separate admin/ user path handling` — not a symbol name, not a godoc. The comment itself admits a runtime legacy branch exists, which CLAUDE.md's "No legacy, only current code" forbids.

Detects in Go and TypeScript/TSX files:

• `// Legacy mode`, `// Legacy compatibility`, `// Legacy:`
• `// legacy foo`, `// (legacy)`, `// SMTP_* (legacy)`
• multiline /* Legacy ... */ / /** Legacy ... */ prefix

Skips:

• Test files and generated code
• Comments that quote CLAUDE.md policy (contain "CLAUDE.md", "No legacy", "policy", "запрет", "запрещ") — self-references to the rule itself
• //nolint:legacy-comment-marker on the line
• The legacy-identifier rule's own file (which prints "Legacy" as a string literal for diagnostic messages — it's the rule implementation, not a legacy code path)

func NewLegacyCommentMarkerRule() *LegacyCommentMarkerRule

func (r *LegacyCommentMarkerRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type LegacyIdentifierRule ¶ added in v1.4.2

type LegacyIdentifierRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

LegacyIdentifierRule detects identifiers (func/method/type/const/var) whose name contains "Legacy" / "legacy_". Comments are covered by the separate `deprecated-comment` rule; this one exists because renaming a symbol to include "Legacy" is a common way to ship a parallel implementation that never actually gets removed — the mirror of what CLAUDE.md forbids under "No legacy, only current code".

Detects:

• func (Foo) RegisterLegacyRoutes(...) — method with Legacy in name
• func buildLegacyPayload(...) — function with Legacy in name
• type LegacyUser struct{} — type with Legacy prefix/suffix
• var/const LegacyTimeout = ... — value identifier

Skips:

• Test files
• Generated files (*.gen.go, *_gen.go, /generated/)
• //nolint:legacy-identifier opt-outs on the declaration line

func NewLegacyIdentifierRule() *LegacyIdentifierRule

func (r *LegacyIdentifierRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type LogAndReturnZeroRule ¶ added in v1.4.2

type LogAndReturnZeroRule struct {
	*rules.BaseRule
}

LogAndReturnZeroRule detects functions without an error result that log at Error/Warn level and immediately return a zero value:

func (m *TokenManager) getJWTIssuer() string {
    if m.config == nil {
        m.logger.Error("Configuration not available")
        return "" // empty issuer breaks validation much later
    }
    ...
}

The log acknowledges a failure, but the caller receives a sentinel ("" / 0 / nil) indistinguishable from a valid value. CLAUDE.md: a function that can fail must return (T, error).

Not flagged: Info/Debug logs, `return false` (see error-masked-as-false-bool), computed recovery values, and HTTP handlers (they report the failure via ResponseWriter).

func NewLogAndReturnZeroRule() *LogAndReturnZeroRule

func (r *LogAndReturnZeroRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type MagicNumberRule ¶

type MagicNumberRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

MagicNumberRule detects hardcoded numbers that should be named constants

func NewMagicNumberRule() *MagicNumberRule

func (r *MagicNumberRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

func (r *MagicNumberRule) Configure(settings map[string]any) error

type MainReturnAfterErrorRule ¶ added in v1.4.2

type MainReturnAfterErrorRule struct {
	*rules.BaseRule
}

MainReturnAfterErrorRule detects func main returning normally from an error branch:

func main() {
    if err := run(); err != nil {
        log.Printf("Error: %v", err)
        return // the process exits 0 — scripts and CI see success
    }
}

A bare return in main ends the process with exit code 0, so every caller — shell scripts, CI, cron — treats the failed run as successful. The honest endings are os.Exit(1), log.Fatal or panic; those forms are not flagged.

Родилось из ревью projectD 2026-08 (№27): шесть cmd-утилит логировали ошибку и выходили из main обычным return, отчитываясь кодом 0.

func NewMainReturnAfterErrorRule() *MainReturnAfterErrorRule

func (r *MainReturnAfterErrorRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type MapIterationOrderRule ¶ added in v1.4.2

type MapIterationOrderRule struct {
	*rules.BaseRule
}

MapIterationOrderRule detects values whose order comes from walking a map and then leaves the function:

for area := range detected {
    areas = append(areas, area)   // order is random
}
return areas

Go randomizes map iteration deliberately, so the same input produces a different order on every run. Once such a slice or string reaches a message, a report or a caller, the output stops being reproducible: golden tests flap, CI diffs show phantom changes, and findings swap places between runs.

Not flagged: order-independent aggregation (sums, counters), collecting into another map, values that never leave the function, and slices sorted before they are used.

func NewMapIterationOrderRule() *MapIterationOrderRule

func (r *MapIterationOrderRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *MapIterationOrderRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *MapIterationOrderRule) RequiresSSA() bool

type MaskedErrorOrConditionRule ¶ added in v1.4.2

type MaskedErrorOrConditionRule struct {
	*rules.BaseRule
}

MaskedErrorOrConditionRule detects branches that conflate a real error with a legitimate "no data" case via ||, then swallow the error:

if err != nil || latest == nil {
    return SafeDecimal{}, nil   // DB failure masked as valid zero value
}

The caller cannot distinguish a storage failure from an honest zero. CLAUDE.md: "Fail explicitly, never degrade silently".

Functions WITHOUT an error result are covered too, and there any return from such a branch masks the failure — the error cannot even be handed back:

func (s *S) dayYield(id string) Decimal {
    share, err := s.share(id)
    if err != nil || share.LessThanOrEqual(zero) {
        return s.cumulative        // DB failure silently yields "no growth"
    }

Not flagged: branches that propagate/wrap the error, branches that handle the error in a nested if, branches that panic, &&-narrowing (errors.Is style), and branches without a return.

For functions WITHOUT an error result the log IS the only error channel, so a branch that mentions the error variable anywhere (logs it, hands it to a collector) or calls an Error/Warn/Fatal-level logger is treated as handled. Functions taking http.ResponseWriter are skipped entirely: an HTTP handler reports failures through the response, not through return values. Functions WITH an error result get no such exemption — logging and then returning nil error still hides the failure from the caller.

func NewMaskedErrorOrConditionRule() *MaskedErrorOrConditionRule

func (r *MaskedErrorOrConditionRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type MigrationDuplicateVersionRule ¶ added in v1.4.2

type MigrationDuplicateVersionRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

MigrationDuplicateVersionRule detects two different migrations sharing one version number in the same directory:

000029_client_number.up.sql
000029_support_conversations.up.sql   // same version, different migration!

Version-keyed migrators (maps, golang-migrate) silently keep only one of them — a fresh database ends up missing the other migration's schema. Every migration must own a unique version number, and the migrator itself should fail on duplicates (defense-in-depth: this rule catches the problem at lint time).

func NewMigrationDuplicateVersionRule() *MigrationDuplicateVersionRule

func (r *MigrationDuplicateVersionRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

func (r *MigrationDuplicateVersionRule) ResetState()

type MockIdentifierRule ¶ added in v1.4.2

type MockIdentifierRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

MockIdentifierRule detects identifiers (func/method/type/const/var) whose name contains a Mock/Fake/Stub/Dummy segment in non-test code. Such a name in production either mislabels a real code path (a "mock" quote that is in fact the live path for one execution mode — readers skip it as test-only and it silently drifts from the implementation it mirrors) or marks test scaffolding that leaked out of _test.go files. Deliberate simulation surfaces (a config-gated sandbox mode) stay, renamed to say what they do or opted out with //nolint:mock-identifier and a reason.

Detects:

• func (a *Admin) createMockQuote(...) — method with Mock in name
• func buildFakePayload(...) — function with Fake in name
• type StubNotifier struct{} — type with Stub prefix
• var dummy_response = ... — snake_case value identifier

Skips:

• Test files
• Generated files (*.gen.go, *_gen.go, /generated/)
• //nolint:mock-identifier opt-outs on the declaration line

func NewMockIdentifierRule() *MockIdentifierRule

func (r *MockIdentifierRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type MultiWriteNoTransactionRule ¶ added in v1.4.2

type MultiWriteNoTransactionRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

MultiWriteNoTransactionRule detects a function that changes persistent state more than once without a transaction around the changes.

The failure is not hypothetical and it is not loud. Each write succeeds on its own, so nothing in the logs says "half of this operation happened". The record simply disagrees with itself from then on, and the disagreement is found later, by a human, in money.

Real case (ProjectA, 2026-07-31). Completing a withdrawal wrote four rows in sequence: the transaction hash onto the request, a posting into `transactions`, the request's status to `completed`, and finally the ledger entries in `fund_transfers`. The last step was allowed to fail — the code even carried a comment saying rollback was impossible at that point. A failure there left the withdrawal marked completed, with a posting under it, and no ledger entry: the money was recorded as gone and unaccounted for at the same time. The four writes are now one transaction, and the regression test asserts that a failing last step leaves the request in its previous status.

What is reported: two or more calls, with distinct method names, that mutate a store (a receiver whose type name reads as a repository, store or DAO) and that can both run in the same pass through the function. What is not reported:

• Calls in mutually exclusive arms of the same if or switch — only one of them runs.
• A retry of the same call: the same method name twice is one write attempted twice.
• Writes inside a goroutine body: that work outlives the function and cannot share its transaction. Project spawners that hide the `go` inside a helper, and telemetry that must survive precisely when the business operation fails, are listed in independent_calls.
• Writes already inside a transaction runner's callback, and functions that are only ever reached from inside one — the wrapper does not have to sit in the same function as the writes, and requiring that would push every helper back into one long method.

Deliberately separate steps do exist: crediting a deposit and auto-investing it are two operations, and rolling back the credit because the investment failed would be worse than leaving them apart. Such a pair is exempted by naming the runner in transaction_functions only if it truly runs under one, so the honest way to silence this rule for a deliberate split is a comment on the function and a rule exclusion, not a fake transaction.

func NewMultiWriteNoTransactionRule() *MultiWriteNoTransactionRule

func (r *MultiWriteNoTransactionRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *MultiWriteNoTransactionRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *MultiWriteNoTransactionRule) Configure(settings map[string]any) error

func (r *MultiWriteNoTransactionRule) RequiresSSA() bool

type MutexLockRule ¶

type MutexLockRule struct {
	*rules.BaseRule
}

MutexLockRule detects mutex Lock() without corresponding Unlock()

func NewMutexLockRule() *MutexLockRule

func (r *MutexLockRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type NilDIRule ¶ added in v1.4.2

type NilDIRule struct {
	*rules.BaseRule
}

NilDIRule detects nil arguments passed to constructor functions (New*) which often indicates missing dependency injection configuration. Focuses on high-risk parameters: logger, service, repo, storage, handler.

func NewNilDIRule() *NilDIRule

func (r *NilDIRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type NilSliceRule ¶

type NilSliceRule struct {
	*rules.BaseRule
}

NilSliceRule detects nil slice comparisons and returns

func NewNilSliceRule() *NilSliceRule

func (r *NilSliceRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type NonAtomicStatusHistoryRule ¶ added in v1.4.2

type NonAtomicStatusHistoryRule struct {
	*rules.BaseRule
}

NonAtomicStatusHistoryRule detects status mutations followed by a separate history write on the same repository in one function.

func NewNonAtomicStatusHistoryRule() *NonAtomicStatusHistoryRule

func (r *NonAtomicStatusHistoryRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type NonCanonicalLoggerRule ¶ added in v1.4.2

type NonCanonicalLoggerRule struct {
	*rules.BaseRule
}

NonCanonicalLoggerRule detects usage of non-canonical logging in production code.

Rationale: projects that standardize on a single logger (slog, zerolog, or a project-local canonical_logger) need every production code path to route diagnostics through that logger so that formatting, sampling and destinations stay consistent. Ad-hoc calls to log.Printf, fmt.Print* or parallel logger libraries (zap, logrus) bypass that pipeline.

Detects:

• Calls to log.Printf/Println/Print/Fatal/Panic and their formatted variants
• fmt.Print/Println/Printf used as diagnostic output (not as error construction)
• Imports of known parallel logger libraries (zap, logrus, glog, zerolog) in projects where they are not the canonical choice

Skips:

• Test files (*_test.go, /tests/, /testdata/)
• cmd/**/main.go (CLI entry points can use bare fmt/log)
• Files explicitly configured as exceptions in .glint.yaml

func NewNonCanonicalLoggerRule() *NonCanonicalLoggerRule

func (r *NonCanonicalLoggerRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type NullableObjectCallRule ¶ added in v1.4.2

type NullableObjectCallRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

NullableObjectCallRule detects Object.* calls on nested values that may be null/undefined in API responses. These calls throw at runtime when the target is not an object.

func NewNullableObjectCallRule() *NullableObjectCallRule

func (r *NullableObjectCallRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type OrphanedInterfaceRule ¶ added in v1.4.2

type OrphanedInterfaceRule struct {
	*rules.BaseRule
}

OrphanedInterfaceRule detects interfaces with no implementations or usages These are "dead code" interfaces that can be safely removed

func NewOrphanedInterfaceRule() *OrphanedInterfaceRule

func (r *OrphanedInterfaceRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type PaginationBoundaryTruncationRule ¶ added in v1.4.2

type PaginationBoundaryTruncationRule struct {
	*rules.BaseRule
}

PaginationBoundaryTruncationRule detects silent page caps on time-bounded history walks.

func NewPaginationBoundaryTruncationRule() *PaginationBoundaryTruncationRule

func (r *PaginationBoundaryTruncationRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ProviderCommandBeforeIntentPersistRule ¶ added in v1.4.2

type ProviderCommandBeforeIntentPersistRule struct {
	*rules.BaseRule
}

ProviderCommandBeforeIntentPersistRule detects financial provider commands executed before their durable request or intent is recorded.

func NewProviderCommandBeforeIntentPersistRule() *ProviderCommandBeforeIntentPersistRule

func (r *ProviderCommandBeforeIntentPersistRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ProviderCommandRetryRule ¶ added in v1.4.2

type ProviderCommandRetryRule struct {
	*rules.BaseRule
}

ProviderCommandRetryRule detects automatic retries of destructive provider commands.

func NewProviderCommandRetryRule() *ProviderCommandRetryRule

func (r *ProviderCommandRetryRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type QuadraticLoopRule ¶ added in v1.4.2

type QuadraticLoopRule struct {
	*rules.BaseRule
}

QuadraticLoopRule detects work that grows with the square of the input:

for i := range windows {          // every window…
    for j := range windows {      // …compared with every other one

for strings.Contains(line, "  ") {         // scan the whole string…
    line = strings.ReplaceAll(line, "  ", " ")  // …after each replacement

Both shapes are correct and stay fast on the examples they were written against; they turn into minutes once the input grows. Both cost glint itself dearly: the nested window comparison made a 900-file project take over two minutes, and the rescanning replace was the hot spot of line normalization.

Not flagged: loops over two different collections (O(n*m) is what the code asks for), an inner loop over a field of the outer element, and a body that does nothing but count.

func NewQuadraticLoopRule() *QuadraticLoopRule

func (r *QuadraticLoopRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type QueryInLoopRule ¶ added in v1.4.2

type QueryInLoopRule struct {
	*rules.BaseRule
}

QueryInLoopRule detects repository/DB method calls inside loops (N+1 query anti-pattern). Это правило родилось из REF-312: per-итерационные SQL-вызовы (config_timeline.Resolve, GetNetFundTransfersToVault) давали ~9000 запросов и 9.5s на список клиентов.

func NewQueryInLoopRule() *QueryInLoopRule

func (r *QueryInLoopRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type RangeValPointerRule ¶

type RangeValPointerRule struct {
	*rules.BaseRule
}

RangeValPointerRule detects taking address of range loop variable

func NewRangeValPointerRule() *RangeValPointerRule

func (r *RangeValPointerRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ReactRemountKeyRule ¶ added in v1.4.2

type ReactRemountKeyRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

ReactRemountKeyRule detects a JSX key built from a value that a controlled input inside the same element edits. React treats a changed key as a new element: every keystroke unmounts the subtree, the fresh input mounts empty of focus, and the user can type exactly one character at a time.

Real case (projectB, 2026-08-05): a wallet row used key={`${wallet.walletAddress}-${index}`} while its <input value={wallet.walletAddress} onChange=.../> edited that very address.

Precision over recall: the rule fires only when the key expression and the input's value= provably reference the same dotted path (x.field) and the input has an onChange/onInput handler in the same tag.

func NewReactRemountKeyRule() *ReactRemountKeyRule

func (r *ReactRemountKeyRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type RedundantCompatibilityRule ¶ added in v1.4.2

type RedundantCompatibilityRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

RedundantCompatibilityRule detects false backward compatibility patterns This implements CLAUDE.md principles: - "Delete cleanly, git remembers" - no fake compatibility - SRP - one way to do one thing Catches: - Multiple context key fallbacks (GetAdminIDFromContext checking 3 different keys) - False "backward compatibility" comments without external API consumers - Duplicate key definitions (AdminIDKey vs AdminIDKeyAlt)

func NewRedundantCompatibilityRule() *RedundantCompatibilityRule

func (r *RedundantCompatibilityRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ReimplementedStdlibRule ¶ added in v1.4.2

type ReimplementedStdlibRule struct {
	*rules.BaseRule
}

ReimplementedStdlibRule detects small helpers that redo what the standard library already does:

func itoa(i int) string {          // strconv.Itoa
    s := ""
    for i > 0 { s = string(rune('0'+i%10)) + s; i /= 10 }
    return s
}

The copy is not merely redundant: it is the version nobody tested. glint carried four such itoa helpers, and they all shared the same bug — a negative number came back as the empty string.

The rule recognizes the shapes it can name with certainty: digit-by-digit integer formatting and parsing, a linear search for an element, absolute value, the smaller/larger of two values, and reversing a slice in place.

func NewReimplementedStdlibRule() *ReimplementedStdlibRule

func (r *ReimplementedStdlibRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ResponseTypeInFunctionRule ¶ added in v1.4.2

type ResponseTypeInFunctionRule struct {
	*rules.BaseRule
}

ResponseTypeInFunctionRule detects a wire contract declared inside a function body.

A struct with json tags that a function builds and hands to a response writer is an API contract, but declaring it in function scope hides it from every consumer: type generators cannot emit it, other handlers cannot reuse it, and clients end up hand-copying the field list. Each hand-made copy then drifts on its own.

Real case (ProjectA, 2026-07-29): the dashboard response type lived inside the handler, so the Go→TypeScript generator never saw it and the frontend grew three hand-written copies with different field sets. Two screens read different copies and showed different balances under the same label.

Only produced contracts are reported. A local struct used to decode a request body is a normal Go idiom: it is filled by the decoder, never composed field by field, so it does not match.

func NewResponseTypeInFunctionRule() *ResponseTypeInFunctionRule

func (r *ResponseTypeInFunctionRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ReturnNilErrorRule ¶

type ReturnNilErrorRule struct {
	*rules.BaseRule
}

ReturnNilErrorRule detects functions returning (nil, nil) which is often a bug

func NewReturnNilErrorRule() *ReturnNilErrorRule

func (r *ReturnNilErrorRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type SQLRowsCloseRule ¶

type SQLRowsCloseRule struct {
	*rules.BaseRule
}

SQLRowsCloseRule detects SQL rows not being closed

func NewSQLRowsCloseRule() *SQLRowsCloseRule

func (r *SQLRowsCloseRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ScatteredConstructionRule ¶ added in v1.4.2

type ScatteredConstructionRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

ScatteredConstructionRule detects struct types that are constructed via struct literals in too many different functions. Each construction site is a potential point of failure when a new field is added — the field will be silently missing in all but the updated sites.

Principle: "One conversion function per type pair, not scattered literals"

func NewScatteredConstructionRule() *ScatteredConstructionRule

func (r *ScatteredConstructionRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

func (r *ScatteredConstructionRule) Configure(settings map[string]any) error

func (r *ScatteredConstructionRule) ResetState()

type SelectStarStructScanRule ¶ added in v1.4.2

type SelectStarStructScanRule struct {
	*rules.BaseRule
}

SelectStarStructScanRule detects `SELECT *` against a real table in Go SQL literals.

Родилось из REF-410. sqlx без Unsafe() требует, чтобы каждой колонке ответа нашлось поле в структуре назначения. Поэтому `SELECT *` привязывает чтение к текущему набору колонок: миграция, добавляющая колонку, ломает выборку на рантайме с "missing destination name", хотя Go-код не менялся и сборка прошла. Явный список колонок снимает эту связь.

Производные таблицы (`SELECT * FROM (...) t`) правилом не считаются нарушением: там звёздочка берёт колонки подзапроса, а их набор задан тут же в коде.

func NewSelectStarStructScanRule() *SelectStarStructScanRule

func (r *SelectStarStructScanRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type SelectThenWriteRaceRule ¶ added in v1.4.2

type SelectThenWriteRaceRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

SelectThenWriteRaceRule detects a read-validate-write race inside one function: a SELECT of a column without FOR UPDATE followed by an UPDATE of the same column of the same table. Two concurrent calls read the same value, both pass the validation performed between the queries, and the second one silently overwrites the first.

Real case (projectB, 2026-08-05): status transitions read `status`, ran a state-machine check on the value, then wrote `status` back. Concurrent sync-materializer and manual close both read the same status and both passed the transition validation.

The rule is silent when the SELECT locks the row (FOR UPDATE / FOR NO KEY UPDATE / FOR SHARE) — that is exactly the fix.

func NewSelectThenWriteRaceRule() *SelectThenWriteRaceRule

func (r *SelectThenWriteRaceRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type ShadowVariableRule ¶

type ShadowVariableRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

ShadowVariableRule detects variable shadowing

func NewShadowVariableRule() *ShadowVariableRule

func (r *ShadowVariableRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type SilentConfigErrorRule ¶ added in v1.4.2

type SilentConfigErrorRule struct {
	*rules.BaseRule
}

SilentConfigErrorRule detects silent error ignoring in config/bootstrap code. CLAUDE.md: "Fail explicitly, never degrade silently" — absolute rule; in config/env-loading paths it is critical because misconfiguration stays invisible until a much later failure.

Unlike the generic `ignored-error` rule, this one intentionally does NOT honor `//nolint:errcheck` — policy forbids the pattern regardless of the linter suppression.

Detects in files whose path contains `/config/` OR matches `**/bootstrap_environment_loader.go` / `**/unified_config*.go`:

• `_ = X()` where X is an env/config-loading call (ReadEnv, Load, loadEnvFileDirectly, godotenv.Load, cleanenv.ReadConfig, etc.)
• Bare call `X()` whose error return is dropped entirely (no assignment) for the same set of env/config functions.

Skips:

• Test files / test utility files
• Generated files

func NewSilentConfigErrorRule() *SilentConfigErrorRule

func (r *SilentConfigErrorRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

func (r *SilentConfigErrorRule) SuppressionExempt() bool

type SilentErrorHandlingRule ¶ added in v1.4.2

type SilentErrorHandlingRule struct {
	*rules.BaseRule
}

SilentErrorHandlingRule detects error checks that don't log or propagate the error This implements CLAUDE.md principle: "Log all errors, never ignore silently" Catches: if err != nil { return X } without logging or returning the error

func NewSilentErrorHandlingRule() *SilentErrorHandlingRule

func (r *SilentErrorHandlingRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type SilentlyOptionalDependencyRule ¶ added in v1.4.2

type SilentlyOptionalDependencyRule struct {
	*rules.BaseRule
}

SilentlyOptionalDependencyRule detects a dependency that is injected by a setter, whose absence silently switches a feature off, and which at least one construction site cannot have received.

Родилось из реального инцидента (REF-446). У сервиса расчёта доходности был метод SetAnomalyAlerter, а в детекторе аномалий стояло `if s.anomalyAlerter == nil { return }`. Сервис собирался в девяти местах, сеттер звали в восьми — и алерты по аномалиям доходности не ушли ни разу за всю историю прода. Ничего не падало и не логировалось: фича просто отсутствовала на том экземпляре, который считал ночной пересчёт.

Признаков нужно три сразу, и по отдельности ни один из них не проблема:

1. зависимость приходит сеттером, а не в конструктор — её можно не задать;
2. её отсутствие проверяется молчаливым `return` — никто не узнает, что не задали;
3. точек сборки больше, чем вызовов сеттера — значит хотя бы одна осталась без него.

Третий признак и делает правило точным: сервис с единственной точкой сборки собран правильно, и трогать его незачем. Считается по всему проекту, тестовые файлы не в счёт — там конструируют без зависимостей намеренно.

func NewSilentlyOptionalDependencyRule() *SilentlyOptionalDependencyRule

func (r *SilentlyOptionalDependencyRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *SilentlyOptionalDependencyRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *SilentlyOptionalDependencyRule) RequiresSSA() bool

type SleepWithoutContextRule ¶ added in v1.4.2

type SleepWithoutContextRule struct {
	*rules.BaseRule
}

SleepWithoutContextRule detects time.Sleep inside a function that has a context.Context available (as a parameter or captured from the enclosing function). Cancelling the context does not interrupt the pause: a sync loop sleeping 250ms per item keeps running long after the caller gave up, and a graceful shutdown waits out every pending sleep.

Real case (projectB, 2026-08-05): wallet sync slept 200ms between provider APIs and 250ms per Solana transaction with a live ctx in scope; stopping the sync had to wait for the whole backlog of pauses.

func NewSleepWithoutContextRule() *SleepWithoutContextRule

func (r *SleepWithoutContextRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type StringConcatRule ¶

type StringConcatRule struct {
	*rules.BaseRule
}

StringConcatRule detects string concatenation in loops

func NewStringConcatRule() *StringConcatRule

func (r *StringConcatRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TautologicalAssertionRule ¶ added in v1.4.2

type TautologicalAssertionRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

TautologicalAssertionRule detects tests that cannot fail.

A green suite is trusted, so an assertion that holds no matter what the code does is worse than no test at all: it claims coverage of exactly the behaviour nobody is watching.

Three shapes, all seen in production repositories:

• both sides of an equality assertion are the same expression;
• the asserted value is a literal constant (expect(true).toBe(true));
• the assertion sits inside a condition derived from the same value, so it skips itself precisely when the value would have been interesting.

Real case (ProjectA, 2026-07-29): a regression test named "withdrawal and analytics headline numbers stay in lockstep" compared displayedBalance with displayedBalance and documented a contract the code did not have. It stayed green while the two screens drifted apart and started showing different balances.

func NewTautologicalAssertionRule() *TautologicalAssertionRule

func (r *TautologicalAssertionRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TechDebtRule ¶

type TechDebtRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

TechDebtRule detects technical debt patterns beyond simple TODO comments

func NewTechDebtRule() *TechDebtRule

func (r *TechDebtRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TerminalAfterFailedCheckpointRule ¶ added in v1.4.2

type TerminalAfterFailedCheckpointRule struct {
	*rules.BaseRule
}

TerminalAfterFailedCheckpointRule detects terminal success after a durable checkpoint failure was ignored.

func NewTerminalAfterFailedCheckpointRule() *TerminalAfterFailedCheckpointRule

func (r *TerminalAfterFailedCheckpointRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TestExternalServiceRule ¶ added in v1.4.2

type TestExternalServiceRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

TestExternalServiceRule detects tests that reach a live third-party service.

A test exists to check our own code. Calling someone else's API from a test buys nothing — the vendor is not under our control and their behaviour is not our contract — and it costs three things: the suite starts failing on their outages and quotas, the vendor's rate limits turn into flaky red builds, and, worst, the test changes the outside world.

Real case (ProjectA, 2026-07-30). Four tests talked to production APIs on every `make test-all`: two of them took real deposit requisites from the payment provider cryptoprov, two burned paid ExtVault Pro credits. Over one week the suite consumed 537 provider addresses. The failures looked like flaky parallelism — the provider starts answering 451 after roughly ten allocations per window, so the more workers, the more red.

Two shapes are reported.

• outbound_client: a test calls into a package that both talks HTTP and carries a literal third-party URL. Packages that merely hold configuration, or clients aimed at localhost, do not qualify — the package must actually make outbound requests.

• credential_gate: a test guards itself with "skip unless the credential is present". That is not a guard at all. Credentials live in .env, and test runners export it (`set -a && source .env`), so the gate is open in exactly the environment where the test runs. Both ProjectA vault tests carried `if os.Getenv("EXTVAULT_ACCESS_KEY") == "" { t.Skip() }` and were documented as manual; they ran every single time. An opt-in must be a switch nobody sets by accident, not a secret everybody has.

A test that genuinely needs the live service stays possible: name its opt-in helper in the guard_functions setting, and calls guarded by it are not reported.

func NewTestExternalServiceRule() *TestExternalServiceRule

func (r *TestExternalServiceRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *TestExternalServiceRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *TestExternalServiceRule) Configure(settings map[string]any) error

func (r *TestExternalServiceRule) RequiresSSA() bool

type TestSchemaMutationWithoutCleanupRule ¶ added in v1.4.2

type TestSchemaMutationWithoutCleanupRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

TestSchemaMutationWithoutCleanupRule detects a test that changes the database schema and leaves the change behind.

Тестовые базы обычно переиспользуются между прогонами (пул с TRUNCATE, шаблонная база, общий контейнер). Строки такой тест за собой чистит, а колонку или таблицу — нет: TRUNCATE структуру не трогает. Дальше своя же колонка ломает следующий прогон («column already exists»), а чужие тесты получают базу, не совпадающую со схемой из миграций, и падают в стороне от причины.

Правило требует, чтобы рядом с DDL стояла отмена: t.Cleanup или defer. Что именно там написано, правило не проверяет — важно, что автор про возврат схемы подумал.

func NewTestSchemaMutationWithoutCleanupRule() *TestSchemaMutationWithoutCleanupRule

func (r *TestSchemaMutationWithoutCleanupRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TestWithoutAssertionRule ¶ added in v1.4.2

type TestWithoutAssertionRule struct {
	*rules.BaseRule
}

TestWithoutAssertionRule detects Go test functions that cannot fail because they never assert anything — typically "documentation" tests that print a finding and stay green forever:

func TestOverflowProtection(t *testing.T) {
    result := maxInt64.Mul(million)
    t.Logf("VULNERABILITY: No overflow detection on Mul()")
}

Such a test claims coverage of behaviour nobody verifies. Either assert what the code must do, or delete the test.

The give-away is t.Log/t.Logf standing where an assertion belongs: the test states a finding instead of checking it. A test that merely exercises code without logging is a different, legitimate thing — it fails if that code panics — and is not reported.

Not flagged: tests that assert via testify/t.Error/t.Fatal, tests that hand *testing.T to a helper (the helper asserts), tests whose only statement is a compile-time assertion (`var _ Iface = (*Impl)(nil)` — the compiler enforces it), smoke calls without logging, skipped tests (see skipped-tests), TestMain, benchmarks and fuzz targets.

Companion rules: unfalsifiable-test-case covers TS/JS tests whose assertions hold regardless of behaviour; tautological-assertion covers `require.True(t, true)`. This one covers the "no assertion at all" case in Go.

func NewTestWithoutAssertionRule() *TestWithoutAssertionRule

func (r *TestWithoutAssertionRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TimeEqualRule ¶

type TimeEqualRule struct {
	*rules.BaseRule
}

TimeEqualRule detects time.Time comparisons using == instead of .Equal()

func NewTimeEqualRule() *TimeEqualRule

func (r *TimeEqualRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TodoCommentRule ¶

type TodoCommentRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

TodoCommentRule finds actionable TODO/FIXME/HACK/XXX comments in code

func NewTodoCommentRule() *TodoCommentRule

func (r *TodoCommentRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TombstoneCommentRule ¶ added in v1.4.2

type TombstoneCommentRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

TombstoneCommentRule detects "tombstone" comments describing code that was deleted:

// GetDB removed — architectural boundary violation eliminated
// УДАЛЕНО: processed статус (дубликат approved)
_ = disableFixes // CryptoProv fixes removed

CLAUDE.md: "Delete cleanly, git remembers" — history lives in git, not in comments. A tombstone is noise the moment the commit lands.

Not flagged: behavior descriptions ("entries are removed after TTL"), godoc deprecation markers (owned by the deprecated-comment rule), policy quotes.

func NewTombstoneCommentRule() *TombstoneCommentRule

func (r *TombstoneCommentRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type TypeInferrer ¶

type TypeInferrer struct {
	// contains filtered or unexported fields
}

TypeInferrer infers types from AST declarations within a file

func NewTypeInferrer(file *ast.File) *TypeInferrer

func NewTypeInferrerFromNode(node ast.Node) *TypeInferrer

func (ti *TypeInferrer) GetType(name string) (TypeInfo, bool)

func (ti *TypeInferrer) IsAmbiguous(name string) bool

func (ti *TypeInferrer) IsAny(name string) bool

func (ti *TypeInferrer) IsDeclared(name string) bool

type TypeInfo ¶

type TypeInfo struct {
	IsSlice         bool
	IsMap           bool
	IsTime          bool
	IsError         bool
	IsChan          bool
	TypeName        string // e.g., "[]string", "time.Time", "error"
	ElementTypeName string
}

TypeInfo holds inferred type information for a variable

type TypedNilIntoInterfaceRule ¶ added in v1.4.2

type TypedNilIntoInterfaceRule struct {
	*rules.BaseRule
}

TypedNilIntoInterfaceRule detects a nil-able concrete pointer handed to an interface.

Указатель, равный nil, уложенный в интерфейс, интерфейсом nil не является: у значения есть тип, поэтому `iface == nil` даёт false. Получатель, который отличает отсутствие зависимости именно этой проверкой, пропускает её и вызывает метод на nil-получателе.

Реальный случай (projectA, REF-446): сервис доходности принял алертер параметром конструктора, и точки сборки стали передавать *email.Service напрямую. Без SMTP это nil-указатель. Проверка `if s.anomalyAlerter == nil { return }` его не поймала, и первый же аномальный день в истории vault уронил пользовательский график баланса паникой вместо того, чтобы просто не отправить письмо.

Правило намеренно узкое, иначе тонет в шуме:

• указатель должен где-то в этом же файле сравниваться с nil — иначе считать его пустым нет оснований;
• получатель должен зависимость сохранять: конструктор, сеттер или присваивание в интерфейсную переменную. Передача в обходчик вроде ast.Inspect не в счёт;
• проверка на nil в Cleanup/Close доказательством не считается: teardown по замыслу переживает частично собранный объект;
• присваивание внутри `if ptr != nil { ... }` и код после `if ptr == nil { return }` признаются правильными — это и есть нужная нормализация.

func NewTypedNilIntoInterfaceRule() *TypedNilIntoInterfaceRule

func (r *TypedNilIntoInterfaceRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *TypedNilIntoInterfaceRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *TypedNilIntoInterfaceRule) RequiresSSA() bool

type UnboundedResponseReadRule ¶ added in v1.4.2

type UnboundedResponseReadRule struct {
	*rules.BaseRule
}

UnboundedResponseReadRule detects unbounded reads of HTTP response bodies.

func NewUnboundedResponseReadRule() *UnboundedResponseReadRule

func (r *UnboundedResponseReadRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type UnboundedSyncMapRule ¶ added in v1.4.2

type UnboundedSyncMapRule struct {
	*rules.BaseRule
}

UnboundedSyncMapRule detects package-level sync.Map variables that production code grows (Store/LoadOrStore) but never shrinks (Delete/CompareAndDelete/ Clear). In a long-running process such a map is a slow leak: every new key stays forever.

Родилось из ревью projectD 2026-08 (№22): пакетные sync.Map доменных расписаний, Crawl-delay и состояний robots.txt копили по записи на каждый встреченный домен. Демон работает месяцами — набор доменов только растёт, вытеснения не было ни в одном файле пакета.

Не считаются: локальные sync.Map (живут не дольше функции), карты без записей и карты, у которых есть хоть одно не-методное использование (передача указателя наружу — судьбу записей отсюда не видно). Delete только в _test.go не спасает: production-рост он не ограничивает.

func NewUnboundedSyncMapRule() *UnboundedSyncMapRule

func (r *UnboundedSyncMapRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *UnboundedSyncMapRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *UnboundedSyncMapRule) RequiresSSA() bool

type UnfalsifiableTestCaseRule ¶ added in v1.4.2

type UnfalsifiableTestCaseRule struct {
	*rules.BaseRule
	// contains filtered or unexported fields
}

UnfalsifiableTestCaseRule detects a browser/API test whose every assertion holds no matter what the code under test does.

Родилось из разбора e2e-набора projectA (REF-410/REF-468). Два спека «проверяли» показ балансов так: мокали два адреса, которых на бэкенде не существует, шли на страницу, которой в приложении нет, и утверждали «URL содержит deposits, body виден, элементов больше нуля». Они годами проходили против страницы 404 и считались покрытием. Ещё несколько спеков писали expect([200, 404]).toContain(status) — при таком наборе одинаково засчитываются и рабочий эндпоинт, и удалённый.

Каждое из таких утверждений по отдельности бывает уместно как разогрев. Признак проблемы в том, что в тесте нет ни одного другого: тогда тест не может упасть и сообщает только о том, что фронтенд отдал HTML.

Правило работает по TypeScript и JavaScript тестам. Go-тесты закрывает tautological-assertion.

func NewUnfalsifiableTestCaseRule() *UnfalsifiableTestCaseRule

func (r *UnfalsifiableTestCaseRule) AnalyzeFile(ctx *core.FileContext) []*core.Violation

type UnguardedSharedFieldRule ¶ added in v1.4.2

type UnguardedSharedFieldRule struct {
	*rules.BaseRule
}

UnguardedSharedFieldRule detects a field that some methods protect with a mutex and others touch without it:

func (c *Counter) Add(n int) { c.mu.Lock(); defer c.mu.Unlock(); c.value += n }
func (c *Counter) Reset()    { c.value = 0 }   // same field, no lock

The lock proves the field is shared between goroutines; the method that skips it is a data race. Unlike a missing Unlock it breaks nothing locally, and the race detector only reports it when two goroutines happen to collide during a test — so it survives review and CI and fails in production.

A lock covers the object that owns it, at any depth: s.metrics.mu.Lock() guards s.metrics.total, not s.other.

Not flagged: fields no lock ever covers (they may be set once and only read afterwards), helpers called from inside a critical section, methods whose name promises the caller holds the lock (…Locked, …NoLock, …Unsafe), and plain functions such as constructors, where the value is not shared yet.

func NewUnguardedSharedFieldRule() *UnguardedSharedFieldRule

func (r *UnguardedSharedFieldRule) AnalyzeFile(_ *core.FileContext) []*core.Violation

func (r *UnguardedSharedFieldRule) AnalyzeGoProject(ctx *core.GoProjectContext) ([]*core.Violation, error)

func (r *UnguardedSharedFieldRule) RequiresSSA() bool