Checks

Each check ID is <configuration>/<name>. The stage says when it runs, and the level says which setting of level turns it on. gspot explain <check> shows its state in your repository.

Languages

Check	Stage	Level	What it does
bash/zsh-syntax	commit	recommended	Checks the syntax of Zsh scripts with zsh -n.
bash/shellcheck	commit	recommended	Runs ShellCheck over shell scripts and sourced files, with its stable optional rules at level all.
bash/shfmt	commit	recommended	Checks that every shell script matches the shfmt output.
bash/script-layout	commit	all	Checks each Bash script for a shebang, strict mode, a final main call when it defines functions, declarative libraries, and removed temporary files.
bash/doc-comments	commit	all	Checks that each shell function has a comment above it that says more than its name.
bash/unused-functions	commit	recommended	Finds shell functions no script in the scope calls.
bash/unread-arguments	commit	recommended	Finds shell functions called with arguments they never read.
bash/function-size	commit	all	Checks every shell function against the size ceilings: code lines, branches, nesting, and assignments.
bash/inline-scripts	commit	all	Finds inline Python and Node code, and heredocs piped into an interpreter, in shell scripts.
bash/safety	commit	recommended	Finds broad process kills and recursive deletes, except traps that remove mktemp paths. At level all, also reports discarded failures.
css/stylelint	commit	recommended	Lints every stylesheet with the standard stylelint rules: unknown properties, overridden selectors, and invalid values.
html/html-validate	commit	recommended	Validates HTML files for nesting, required attributes, text alternatives, and one style for void elements.
html/scripts	commit	all	Reports inline scripts, event handler attributes, and executable URLs in HTML files.
javascript/eslint	commit	recommended	Runs the shipped ESLint rules on JavaScript, TypeScript, component files, and package.json.
javascript/tsc	push	recommended	Type-checks plain JavaScript through its JSDoc comments.
javascript/knip	push	recommended	Finds files, exports, and dependencies nothing uses.
markdown/markdownlint	commit	recommended	Checks every Markdown file against markdownlint with the shipped rule set.
markdown/fences	commit	recommended	Checks JSON, JSONC, TOML, YAML, Bash, JavaScript, JSX, TypeScript, TSX, and Python code fences in Markdown (.md) files for syntax errors.
python/ruff	commit	recommended	Lints every Python file with the Ruff rules for the level, security rules included.
python/ruff-format	commit	recommended	Checks the layout of every Python file against the Ruff formatter.
python/basedpyright	push	recommended	Type checks the project. At level all, it also requires annotations.
python/import-linter	commit	recommended	Runs project import contracts from setup.cfg, .importlinter, or pyproject.toml.
python/pydoclint	commit	recommended	Checks that each docstring names the arguments, return value, and exceptions of its function.
python/deptry	push	recommended	Compares the imports of the project with the dependencies it declares: missing, unused, and transitive ones.
python/pip-installs	commit	all	Checks that pyproject.toml lists every dependency, with no hand-kept requirements file and no pip install.
python/placeholder-docstrings	commit	all	Finds docstrings that hold a placeholder word, or the name of the function again.
sql/sqlfluff	commit	recommended	Lints every SQL file for layout, capitalization, aliasing, and ambiguous references, in the dialect the database configuration names.
swift/swiftlint	commit	recommended	Lints Swift files with the SwiftLint files of each scope and nested folder, and treats warnings as errors.
swift/swiftformat	commit	recommended	Checks the layout of every Swift file against the shipped SwiftFormat rules.
swift/build	push	recommended	Builds the package or Xcode scheme incrementally to report compiler errors.
swift/swiftlint-analyze	manual	recommended	Runs the SwiftLint analyzer rules over the compiler log of the build: unused imports and captured variables.
swift/periphery	push	recommended	Scans the built project for declarations nothing uses.
swift/skip-reasons	commit	recommended	Checks that skip calls and disabled traits name a nonempty reason, and unavailable tests carry an explanation.
swift/coverage	push	recommended	Measures each source target in Xcode projects and Swift packages against coverage.lines and its coverage.swift_target floor.
typescript/tsc	push	recommended	Runs tsc with the strict compiler options over every TypeScript file.
typescript/tsconfig	commit	recommended	Requires strict in every tsconfig you write. Level all also requires noUncheckedIndexedAccess, exactOptionalPropertyTypes, noImplicitOverride, noFallthroughCasesInSwitch, noImplicitReturns, and noPropertyAccessFromIndexSignature.

Frameworks

Check	Stage	Level	What it does
astro/astro-check	push	recommended	Runs astro check over the scope: the type errors and warnings of every Astro component.
expo/expo-doctor	push	recommended	Runs Expo Doctor and reports each failed check with its details.
nextjs/tsc	push	recommended	Has Next.js write its types, then type-checks the app with the strict compiler options.
site/build	push	recommended	Runs site.build_command, and fails on an error or a missing output folder.
site/html-validate	push	recommended	Validates every built page with html-validate.
site/purgecss	push	recommended	Finds selectors in the built stylesheets that no page or script uses.
site/linkinator	push	recommended	Serves the built site and follows every link between its pages, stylesheets, and fragments.
site/size	push	recommended	Sums the compressed weight of the built paths each ceiling in site.size_limit names.
site/sitemap	push	recommended	Compares the sitemap with the built pages, and reports a listed route with no page or a page left out.
site/unused-assets	push	all	Finds files under an assets folder that no page, stylesheet, or script names.
svelte/svelte-check	push	recommended	Runs svelte-check over the scope for compiler and accessibility warnings, and the types of every component and TypeScript file.
vue/vue-tsc	push	recommended	Type-checks every Vue component and TypeScript file of the scope with the strict compiler options.

Platforms

Check	Stage	Level	What it does
cloudflare/headers	commit	recommended	Checks that _headers holds only blocks of a path followed by indented name-value lines, and that the block for every path sets the content type, referrer, and framing headers.
cloudflare/redirects	commit	recommended	Checks each redirect source, destination, and optional status: 200, 301, 302, 303, 307, or 308, without a force suffix.
cloudflare/stale-types	push	recommended	Checks that a tracked environment types file matches what wrangler writes.
supabase/storage-policies	commit	recommended	Checks that every storage bucket in the project file has a policy on storage.objects that names it.
supabase/service-role-key	commit	recommended	Checks that only edge functions and test files name a secret or service role key.
supabase/deno-lint	commit	recommended	Runs deno lint over every edge function with its own deno.json.
supabase/deno-check	push	recommended	Runs deno check on the entry file of every edge function.
supabase/stale-types	push	recommended	Compares supabase.types_file with the output the Supabase CLI writes from the local database.

Databases

Check	Stage	Level	What it does
postgres/squawk	commit	recommended	Checks every migration for changes that lock or rewrite a table, or break the running application.
postgres/migration-order	commit	recommended	Checks that every migration has a version, that no two share one, and that a new migration sorts after the committed ones.
postgres/edited-migrations	commit	recommended	Checks that no migration at or before postgres.frozen_through differs from its committed text.
postgres/row-level-security	commit	recommended	Checks that every table in a client schema turns on row level security.
postgres/grants	commit	recommended	Reports a migration that grants all privileges.
postgres/definer-search-path	commit	recommended	Checks that every SECURITY DEFINER function sets its search_path.
postgres/foreign-key-indexes	commit	recommended	Checks that an index, a primary key, or a unique key leads with every foreign key column.

Testing

Check	Stage	Level	What it does
jest/coverage	push	recommended	Runs Jest and checks all four coverage floors.
pytest/coverage	push	recommended	Runs pytest with coverage, and fails on a broken test or a covered share under the floor.
vitest/coverage	push	recommended	Runs the test suite with coverage, and fails when lines, branches, functions, or statements fall under their floors.

Infrastructure

Check	Stage	Level	What it does
ansible/ansible-lint	commit	recommended	Runs the moderate ansible-lint profile at recommended and production at all, beside each ansible.cfg or at the scope root.
docker/hadolint	commit	recommended	Lints every Dockerfile, and runs ShellCheck over its RUN lines.
docker/compose	push	recommended	Parses every Compose file with docker compose config, which needs no running daemon.
docker/dockerignore	commit	recommended	Checks that an ignore file sits beside every Dockerfile and keeps the .git folder, installed dependencies, and environment files out of the build.
docker/trivy-config	push	recommended	Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets.
docker/trivy-image	manual	recommended	Scans every image a Compose file names for known vulnerabilities in its packages.
github-actions/actionlint	commit	recommended	Checks every GitHub Actions workflow with actionlint: syntax, expressions, action inputs, and shell steps.
github-actions/zizmor	commit	recommended	Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers.
nginx/gixy	commit	recommended	Checks every nginx file for mistakes that expose a server: request forgery, path traversal through alias, header injection, and a disclosed version.
nginx/config-test	push	recommended	Runs nginx -t on each main file inside the image, with a throwaway certificate and resolved upstream names. Records every file that nginx parsed.
openapi/spectral	commit	recommended	Lints the file in openapi.document with the Spectral OpenAPI rules.
openapi/stale-document	push	recommended	Runs openapi.generate_command and fails when the document changes.
xcode/plutil	commit	recommended	Parses every property list and entitlements file with plutil.
xcode/xcstrings	commit	recommended	Checks that each string catalog parses and translates every string into all its locales.
xcode/assets	commit	recommended	Checks that each asset Contents.json parses, and that its image set holds each file it names.
xcode/unused-assets	commit	all	Finds asset sets that no source or Xcode build setting names.
xcode/files-without-target	commit	recommended	Finds the Swift files in the tree that no target of the project names.
xcode/entitlements	commit	recommended	Checks each entitlement against xcode.allowed_entitlements, when the settings hold that list.
xcode/app-transport-security	commit	recommended	Refuses a property list that allows arbitrary loads, which turns transport security off for every host.

Libraries

Check	Stage	Level	What it does
drizzle/stale-migrations	push	recommended	Runs drizzle-kit generate and fails when it creates a migration.
translations/messages	push	recommended	Checks the next-intl JSON/ICU files under translations.messages_folder: each message parses, none stays empty, and each locale holds all keys of the base.

General

Check	Stage	Level	What it does
commits/commitlint	message	all	Checks a new commit message for a conventional type, an optional known scope, a first line of 72 characters or fewer, and a wrapped body.
commits/commitlint-pushed	push	all	Checks the message of each commit in a push. A manual run covers every commit from the upstream merge base to HEAD.
dependencies/osv-scanner	push	recommended	Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database.
dependencies/syncpack	push	all	Checks that every workspace package resolves each dependency to one version.
dependencies/lockfiles	commit	recommended	Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts.
docs/lychee	commit	recommended	Checks that local documentation links reach existing files and valid anchor or text fragments.
docs/lychee-external	manual	recommended	Checks every external link over the network.
docs/missing-paths	commit	recommended	Checks that documented paths point to tracked files, and that mise, npm, pnpm, yarn, and bun run commands name a task or script of their project.
docs/required-files	commit	all	Checks that every scope has a README.md and the root has a LICENSE.
duplication/jscpd	push	all	Reports every block of code copied between files, naming both places.
files/taplo-format	commit	recommended	Checks that every TOML file parses and matches the taplo output under the shared settings.
files/yamllint	commit	recommended	Parses every YAML file and checks its indentation, keys, and values with yamllint.
files/v8r	push	recommended	Validates each file that matches a SchemaStore schema, such as package.json, tsconfig.json, mise files, and workflows.
files/xmllint	commit	recommended	Parses every XML file with xmllint.
format/prettier	commit	recommended	Checks each file Prettier handles for unformatted code.
format/editorconfig-checker	commit	recommended	Checks line endings, final newlines, and trailing whitespace in every file against .editorconfig.
gspot/generated-files	commit	recommended	Compares generated files with the settings and reports changed, missing, and stray ones, and any with merge conflict markers.
gspot/unmatched-patterns	commit	recommended	Checks settings path patterns against tracked files.
gspot/suppressions	commit	recommended	Reports suppressions with no reason, any that lift a size or complexity limit, and Semgrep or Vale directives.
licenses/allowed	push	recommended	Compares the license of each installed npm or Python package with the allowed list and package records.
naming/identifiers	commit	all	Checks every identifier against the naming settings: banned words, case, length, and word count.
naming/paths	commit	all	Checks every file stem and folder name against the case rules of its language and the banned words.
naming/allowed-names	commit	all	Reports allowed names that no source file uses.
prose/vale	commit	recommended	Checks ambiguous dates, link text, and alternative text with the shipped Vale styles at level recommended. Level all adds the complete style and upstream packages.
repository/large-files	commit	recommended	Checks that each tracked file over the size limit goes through Git LFS or has a reason.
repository/local-files	commit	recommended	Reports a tracked file at a path that a configuration keeps out of Git.
secrets/gitleaks-staged	commit	recommended	Scans the staged change for keys, tokens, and passwords before the commit exists.
secrets/gitleaks-pushed	push	recommended	Scans every commit about to be pushed for keys, tokens, and passwords.
secrets/trufflehog-pushed	push	recommended	Verifies candidate secrets in the pushed commits against the service that issued them.
secrets/dotenv-linter	commit	recommended	Checks every tracked environment file: key format, duplicates, quoting, ordering, and trailing spaces.
secrets/env-examples	push	recommended	Checks that an existing env example lists each static uppercase key that code reads through process.env, import.meta.env, Bun.env, Deno.env.get, the Python os module, or an environment function.
security/semgrep	push	recommended	Runs the Semgrep packs of each configuration, and the repository rules, over changed files.
security/semgrep-registry	manual	recommended	Downloads and runs the public Semgrep packs in tools.semgrep.registry_packs.
spelling/typos	commit	recommended	Finds misspelled words in code, comments, and documentation.
structure/lone-files	commit	all	Finds a folder that holds one code file and nothing else.
structure/shared-prefixes	commit	all	Finds sibling files that share a name prefix, such as asset-card, asset-list, and asset-row.
structure/file-folder-clashes	commit	all	Finds a file and a folder with one stem in the same place, such as turn.ts beside turn/.
structure/long-files	commit	all	Checks the code line count of each file against the limit for its language.
structure/trivial-functions	commit	all	Finds functions with too few statements and files that only forward to other code.
structure/environment-readers	commit	all	Finds environment reads outside the files listed in structure.environment_readers.