Clean as you code
Active on 4 repositories
Judge only the diff in front of you. The gate never asks a team to fix a 300-item legacy backlog before it can ship anything.
Rule catalogue
All
Security
Correctness
Maintainability
| Rule | Category | Enforcement | Triggered | Suppressed |
|---|---|---|---|---|
| p/secrets | Security | Block | 1 | 0 |
| no-eval | Security | Block | 0 | 0 |
| no-floating-promises | Correctness | Block | 7 | 2 |
| B006 mutable-default-arg | Correctness | Warn | 4 | 1 |
| no-unchecked-index-access | Correctness | Warn | 3 | 0 |
| PTH pathlib-over-os-path | Style | Warn | 12 | 0 |
| complexity-too-high (>15) | Maintainability | Info | 2 | 0 |
| duplicate-code | Maintainability | Info | 1 | 0 |
Suppressions up for quarterly review
no-floating-promises — src/jobs/sync.ts:88
suppressed 2×
B006 — src/reports/export.py:41
suppressed 1×
A rule suppressed more than 10 times is a signal to relax the rule, not to keep suppressing it.
Branch protection — main
Require status checks — semgrep-scan, run-tests, build
Require 1 approval (2 for critical paths)
Dismiss stale reviews on new commits
Require branch up to date before merge
Include administrators — no bypass, ever
Deliberately not gated on
Subjective rules like “code must be readable” — unmeasurable, becomes an exception factory
Whole-repo coverage targets — punishes new code for old debt
Gates slower than 10 minutes — latency is the #1 reason teams bypass a gate
Phased rollout — enough friction to matter, not enough to cause revolt
Week 1–2 · done
Linter + formatter + pre-commit, warn only
Nothing blocks yet. The goal is familiarity — let the team see what the rules actually catch before any door closes.
Week 3–4 · done
Static analysis + tests in CI
SAST runs on every PR in warn-only mode for two weeks so the team can see what would have blocked, before it does.
Month 2 · in progress
SAST critical/high → real block, secret scanning on
The quality gate starts refusing merges. Branch protection now includes administrators — the rule has to be real for everyone.
Month 2–3 · next
AI review, dependency scanning, post-merge jobs
Fuzzing, mutation testing and full-repo scans move to scheduled jobs; production errors start feeding new static-analysis rules back in.