Rules & Rollout

What gets enforced, what gets suppressed, and how fast a team can be asked to swallow it
Clean as you code

Judge only the diff in front of you. The gate never asks a team to fix a 300-item legacy backlog before it can ship anything.

Active on 4 repositories

Rule catalogue

All Security Correctness Maintainability
RuleCategoryEnforcementTriggeredSuppressed
p/secrets Security Block 1 0
no-eval Security Block 0 0
no-floating-promises Correctness Block 7 2
B006 mutable-default-arg Correctness Warn 4 1
no-unchecked-index-access Correctness Warn 3 0
PTH pathlib-over-os-path Style Warn 12 0
complexity-too-high (>15) Maintainability Info 2 0
duplicate-code Maintainability Info 1 0

Suppressions up for quarterly review

no-floating-promises — src/jobs/sync.ts:88 suppressed 2×
B006 — src/reports/export.py:41 suppressed 1×

A rule suppressed more than 10 times is a signal to relax the rule, not to keep suppressing it.

Branch protection — main

Require status checks — semgrep-scan, run-tests, build
Require 1 approval (2 for critical paths)
Dismiss stale reviews on new commits
Require branch up to date before merge
Include administrators — no bypass, ever

Deliberately not gated on

Subjective rules like “code must be readable” — unmeasurable, becomes an exception factory
Whole-repo coverage targets — punishes new code for old debt
Gates slower than 10 minutes — latency is the #1 reason teams bypass a gate

Phased rollout — enough friction to matter, not enough to cause revolt

Week 1–2 · done
Linter + formatter + pre-commit, warn only
Nothing blocks yet. The goal is familiarity — let the team see what the rules actually catch before any door closes.
Week 3–4 · done
Static analysis + tests in CI
SAST runs on every PR in warn-only mode for two weeks so the team can see what would have blocked, before it does.
Month 2 · in progress
SAST critical/high → real block, secret scanning on
The quality gate starts refusing merges. Branch protection now includes administrators — the rule has to be real for everyone.
Month 2–3 · next
AI review, dependency scanning, post-merge jobs
Fuzzing, mutation testing and full-repo scans move to scheduled jobs; production errors start feeding new static-analysis rules back in.