CheckScript/doc/checkscript.example.yaml at main · chla28/CheckScript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# check-script configuration example.
#
# Locations read (the first one found):
#   1. --config FILE
#   2. ./.checkscript.yaml
#   3. ${XDG_CONFIG_HOME:-~/.config}/check-script/config.yaml
# All keys are optional: a missing key keeps the profile's value.

profile: default                # strict | default | legacy (--profile takes precedence)
context: []                     # [root, cron, systemd] : dedicated rules and severities
followSource: false             # shellcheck -x (sourced files)
pythonTarget: "3.9"             # minimum Python to support (quoted)
exclude: []                      # .gitignore-style patterns ignored in a folder (see also .checkscriptignore)

tools:
  shellcheck:
    enabled: true
    path: shellcheck            # name in PATH or absolute path
    exclude: [SC1091]           # passed to shellcheck --exclude
  shfmt:
    enabled: true
  bashate:
    enabled: true
    exclude: [E006]             # passed to bashate --ignore
  checkbashisms: true           # short form: enabled / disabled
  gitleaks: true                # secrets (if installed)
  trufflehog: true              # secrets, without network verification (if installed)
  syntax: true                  # bash -n / sh -n / Python compilation check
  builtin: true                 # built-in rules
  # ── Python scripts ──
  ruff:
    exclude: [PLR2004, S603]    # passed to ruff --ignore
  bandit:
    exclude: [B404, B603]       # passed to bandit -s
  semgrep:
    enabled: true
    # Rules: p/python by default (downloaded, cached for one
    # week); on an isolated machine, a local file or folder.
    # config: /opt/regles/python.yml
  mypy: true
  radon: true                   # complexity, maintainability index
  vermin: true                  # minimum Python version required
  pylint: false                 # redundant with ruff (can be enabled)
  pyright: false                # redundant with mypy (can be enabled)

rules:
  # Ignored rules, regardless of tool (SCxxxx, Exxx, SECxxx…).
  disabled: [MNT005]
  # Reclassification of a rule (category and/or severity).
  overrides:
    SC2086: { category: security, severity: medium }

scoring:
  weights: { critical: 4, high: 2, medium: 0.75, low: 0.25 }
  referenceLines: 100           # beyond that, Medium/Low are attenuated (√(100/n))
  categoryWeights:              # weight in the overall score
    security: 1.5
    robustness: 1.25
    maintainability: 1
    portability: 0.75
    performance: 0.5

thresholds:
  maxLineLength: 120            # MNT001 (and bashate --max-line-length)
  maxFunctionLines: 60          # MNT002 (Medium beyond double)
  maxNesting: 4                 # MNT003
  maxLinesWithoutFunction: 150  # MNT008