# Checks > 127 checks declared by shipped configurations. Each check ID is `/`. The [stage](/start/concepts/#stage) says when it runs, and the [level](/start/concepts/#levels) says which setting of `level` turns it on. `gspot explain ` shows its state in your repository. ## Languages | Check | Stage | Level | What it does | | ----------------------------------------------------------------------------------- | -------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`bash/zsh-syntax`](/reference/checks/bash/zsh-syntax/) | `commit` | `recommended` | Checks the syntax of Zsh scripts with `zsh -n`. | | [`bash/shellcheck`](/reference/checks/bash/shellcheck/) | `commit` | `recommended` | Runs ShellCheck over shell scripts and sourced files, with its stable optional rules at level all. | | [`bash/shfmt`](/reference/checks/bash/shfmt/) | `commit` | `recommended` | Checks that every shell script matches the shfmt output. | | [`bash/script-layout`](/reference/checks/bash/script-layout/) | `commit` | `all` | Checks each Bash script for a shebang, strict mode, a final `main` call when it defines functions, declarative libraries, and removed temporary files. | | [`bash/doc-comments`](/reference/checks/bash/doc-comments/) | `commit` | `all` | Checks that each shell function has a comment above it that says more than its name. | | [`bash/unused-functions`](/reference/checks/bash/unused-functions/) | `commit` | `recommended` | Finds shell functions no script in the scope calls. | | [`bash/unread-arguments`](/reference/checks/bash/unread-arguments/) | `commit` | `recommended` | Finds shell functions called with arguments they never read. | | [`bash/function-size`](/reference/checks/bash/function-size/) | `commit` | `all` | Checks every shell function against the size ceilings: code lines, branches, nesting, and assignments. | | [`bash/inline-scripts`](/reference/checks/bash/inline-scripts/) | `commit` | `all` | Finds inline Python and Node code, and heredocs piped into an interpreter, in shell scripts. | | [`bash/safety`](/reference/checks/bash/safety/) | `commit` | `recommended` | Finds broad process kills and recursive deletes, except traps that remove mktemp paths. At level all, also reports discarded failures. | | [`css/stylelint`](/reference/checks/css/stylelint/) | `commit` | `recommended` | Lints every stylesheet with the standard stylelint rules: unknown properties, overridden selectors, and invalid values. | | [`html/html-validate`](/reference/checks/html/html-validate/) | `commit` | `recommended` | Validates HTML files for nesting, required attributes, text alternatives, and one style for void elements. | | [`html/scripts`](/reference/checks/html/scripts/) | `commit` | `all` | Reports inline scripts, event handler attributes, and executable URLs in HTML files. | | [`javascript/eslint`](/reference/checks/javascript/eslint/) | `commit` | `recommended` | Runs the shipped ESLint rules on JavaScript, TypeScript, component files, and package.json. | | [`javascript/tsc`](/reference/checks/javascript/tsc/) | `push` | `recommended` | Type-checks plain JavaScript through its JSDoc comments. | | [`javascript/knip`](/reference/checks/javascript/knip/) | `push` | `recommended` | Finds files, exports, and dependencies nothing uses. | | [`markdown/markdownlint`](/reference/checks/markdown/markdownlint/) | `commit` | `recommended` | Checks every Markdown file against markdownlint with the shipped rule set. | | [`markdown/fences`](/reference/checks/markdown/fences/) | `commit` | `recommended` | Checks JSON, JSONC, TOML, YAML, Bash, JavaScript, JSX, TypeScript, TSX, and Python code fences in Markdown (.md) files for syntax errors. | | [`python/ruff`](/reference/checks/python/ruff/) | `commit` | `recommended` | Lints every Python file with the Ruff rules for the level, security rules included. | | [`python/ruff-format`](/reference/checks/python/ruff-format/) | `commit` | `recommended` | Checks the layout of every Python file against the Ruff formatter. | | [`python/basedpyright`](/reference/checks/python/basedpyright/) | `push` | `recommended` | Type checks the project. At level `all`, it also requires annotations. | | [`python/import-linter`](/reference/checks/python/import-linter/) | `commit` | `recommended` | Runs project import contracts from setup.cfg, .importlinter, or pyproject.toml. | | [`python/pydoclint`](/reference/checks/python/pydoclint/) | `commit` | `recommended` | Checks that each docstring names the arguments, return value, and exceptions of its function. | | [`python/deptry`](/reference/checks/python/deptry/) | `push` | `recommended` | Compares the imports of the project with the dependencies it declares: missing, unused, and transitive ones. | | [`python/pip-installs`](/reference/checks/python/pip-installs/) | `commit` | `all` | Checks that pyproject.toml lists every dependency, with no hand-kept requirements file and no `pip install`. | | [`python/placeholder-docstrings`](/reference/checks/python/placeholder-docstrings/) | `commit` | `all` | Finds docstrings that hold a placeholder word, or the name of the function again. | | [`sql/sqlfluff`](/reference/checks/sql/sqlfluff/) | `commit` | `recommended` | Lints every SQL file for layout, capitalization, aliasing, and ambiguous references, in the dialect the database configuration names. | | [`swift/swiftlint`](/reference/checks/swift/swiftlint/) | `commit` | `recommended` | Lints Swift files with the SwiftLint files of each scope and nested folder, and treats warnings as errors. | | [`swift/swiftformat`](/reference/checks/swift/swiftformat/) | `commit` | `recommended` | Checks the layout of every Swift file against the shipped SwiftFormat rules. | | [`swift/build`](/reference/checks/swift/build/) | `push` | `recommended` | Builds the package or Xcode scheme incrementally to report compiler errors. | | [`swift/swiftlint-analyze`](/reference/checks/swift/swiftlint-analyze/) | `manual` | `recommended` | Runs the SwiftLint analyzer rules over the compiler log of the build: unused imports and captured variables. | | [`swift/periphery`](/reference/checks/swift/periphery/) | `push` | `recommended` | Scans the built project for declarations nothing uses. | | [`swift/skip-reasons`](/reference/checks/swift/skip-reasons/) | `commit` | `recommended` | Checks that skip calls and disabled traits name a nonempty reason, and unavailable tests carry an explanation. | | [`swift/coverage`](/reference/checks/swift/coverage/) | `push` | `recommended` | Measures each source target in Xcode projects and Swift packages against `coverage.lines` and its `coverage.swift_target` floor. | | [`typescript/tsc`](/reference/checks/typescript/tsc/) | `push` | `recommended` | Runs tsc with the strict compiler options over every TypeScript file. | | [`typescript/tsconfig`](/reference/checks/typescript/tsconfig/) | `commit` | `recommended` | Requires strict in every tsconfig you write. Level all also requires noUncheckedIndexedAccess, exactOptionalPropertyTypes, noImplicitOverride, noFallthroughCasesInSwitch, noImplicitReturns, and noPropertyAccessFromIndexSignature. | ## Frameworks | Check | Stage | Level | What it does | | --------------------------------------------------------------- | ------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------- | | [`astro/astro-check`](/reference/checks/astro/astro-check/) | `push` | `recommended` | Runs astro check over the scope: the type errors and warnings of every Astro component. | | [`expo/expo-doctor`](/reference/checks/expo/expo-doctor/) | `push` | `recommended` | Runs Expo Doctor and reports each failed check with its details. | | [`nextjs/tsc`](/reference/checks/nextjs/tsc/) | `push` | `recommended` | Has Next.js write its types, then type-checks the app with the strict compiler options. | | [`site/build`](/reference/checks/site/build/) | `push` | `recommended` | Runs `site.build_command`, and fails on an error or a missing output folder. | | [`site/html-validate`](/reference/checks/site/html-validate/) | `push` | `recommended` | Validates every built page with html-validate. | | [`site/purgecss`](/reference/checks/site/purgecss/) | `push` | `recommended` | Finds selectors in the built stylesheets that no page or script uses. | | [`site/linkinator`](/reference/checks/site/linkinator/) | `push` | `recommended` | Serves the built site and follows every link between its pages, stylesheets, and fragments. | | [`site/size`](/reference/checks/site/size/) | `push` | `recommended` | Sums the compressed weight of the built paths each ceiling in site.size\_limit names. | | [`site/sitemap`](/reference/checks/site/sitemap/) | `push` | `recommended` | Compares the sitemap with the built pages, and reports a listed route with no page or a page left out. | | [`site/unused-assets`](/reference/checks/site/unused-assets/) | `push` | `all` | Finds files under an assets folder that no page, stylesheet, or script names. | | [`svelte/svelte-check`](/reference/checks/svelte/svelte-check/) | `push` | `recommended` | Runs svelte-check over the scope for compiler and accessibility warnings, and the types of every component and TypeScript file. | | [`vue/vue-tsc`](/reference/checks/vue/vue-tsc/) | `push` | `recommended` | Type-checks every Vue component and TypeScript file of the scope with the strict compiler options. | ## Platforms | Check | Stage | Level | What it does | | --------------------------------------------------------------------------- | -------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`cloudflare/headers`](/reference/checks/cloudflare/headers/) | `commit` | `recommended` | Checks that `_headers` holds only blocks of a path followed by indented name-value lines, and that the block for every path sets the content type, referrer, and framing headers. | | [`cloudflare/redirects`](/reference/checks/cloudflare/redirects/) | `commit` | `recommended` | Checks each redirect source, destination, and optional status: 200, 301, 302, 303, 307, or 308, without a force suffix. | | [`cloudflare/stale-types`](/reference/checks/cloudflare/stale-types/) | `push` | `recommended` | Checks that a tracked environment types file matches what wrangler writes. | | [`supabase/storage-policies`](/reference/checks/supabase/storage-policies/) | `commit` | `recommended` | Checks that every storage bucket in the project file has a policy on storage.objects that names it. | | [`supabase/service-role-key`](/reference/checks/supabase/service-role-key/) | `commit` | `recommended` | Checks that only edge functions and test files name a secret or service role key. | | [`supabase/deno-lint`](/reference/checks/supabase/deno-lint/) | `commit` | `recommended` | Runs `deno lint` over every edge function with its own deno.json. | | [`supabase/deno-check`](/reference/checks/supabase/deno-check/) | `push` | `recommended` | Runs `deno check` on the entry file of every edge function. | | [`supabase/stale-types`](/reference/checks/supabase/stale-types/) | `push` | `recommended` | Compares `supabase.types_file` with the output the Supabase CLI writes from the local database. | ## Databases | Check | Stage | Level | What it does | | --------------------------------------------------------------------------------- | -------- | ------------- | -------------------------------------------------------------------------------------------------------------------------- | | [`postgres/squawk`](/reference/checks/postgres/squawk/) | `commit` | `recommended` | Checks every migration for changes that lock or rewrite a table, or break the running application. | | [`postgres/migration-order`](/reference/checks/postgres/migration-order/) | `commit` | `recommended` | Checks that every migration has a version, that no two share one, and that a new migration sorts after the committed ones. | | [`postgres/edited-migrations`](/reference/checks/postgres/edited-migrations/) | `commit` | `recommended` | Checks that no migration at or before postgres.frozen\_through differs from its committed text. | | [`postgres/row-level-security`](/reference/checks/postgres/row-level-security/) | `commit` | `recommended` | Checks that every table in a client schema turns on row level security. | | [`postgres/grants`](/reference/checks/postgres/grants/) | `commit` | `recommended` | Reports a migration that grants all privileges. | | [`postgres/definer-search-path`](/reference/checks/postgres/definer-search-path/) | `commit` | `recommended` | Checks that every SECURITY DEFINER function sets its search\_path. | | [`postgres/foreign-key-indexes`](/reference/checks/postgres/foreign-key-indexes/) | `commit` | `recommended` | Checks that an index, a primary key, or a unique key leads with every foreign key column. | ## Testing | Check | Stage | Level | What it does | | ------------------------------------------------------- | ------ | ------------- | -------------------------------------------------------------------------------------------------------------------- | | [`jest/coverage`](/reference/checks/jest/coverage/) | `push` | `recommended` | Runs Jest and checks all four coverage floors. | | [`pytest/coverage`](/reference/checks/pytest/coverage/) | `push` | `recommended` | Runs pytest with coverage, and fails on a broken test or a covered share under the floor. | | [`vitest/coverage`](/reference/checks/vitest/coverage/) | `push` | `recommended` | Runs the test suite with coverage, and fails when lines, branches, functions, or statements fall under their floors. | ## Infrastructure | Check | Stage | Level | What it does | | --------------------------------------------------------------------------------- | -------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | [`ansible/ansible-lint`](/reference/checks/ansible/ansible-lint/) | `commit` | `recommended` | Runs the moderate ansible-lint profile at recommended and production at all, beside each ansible.cfg or at the scope root. | | [`docker/hadolint`](/reference/checks/docker/hadolint/) | `commit` | `recommended` | Lints every Dockerfile, and runs ShellCheck over its RUN lines. | | [`docker/compose`](/reference/checks/docker/compose/) | `push` | `recommended` | Parses every Compose file with `docker compose config`, which needs no running daemon. | | [`docker/dockerignore`](/reference/checks/docker/dockerignore/) | `commit` | `recommended` | Checks that an ignore file sits beside every Dockerfile and keeps the `.git` folder, installed dependencies, and environment files out of the build. | | [`docker/trivy-config`](/reference/checks/docker/trivy-config/) | `push` | `recommended` | Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets. | | [`docker/trivy-image`](/reference/checks/docker/trivy-image/) | `manual` | `recommended` | Scans every image a Compose file names for known vulnerabilities in its packages. | | [`github-actions/actionlint`](/reference/checks/github-actions/actionlint/) | `commit` | `recommended` | Checks every GitHub Actions workflow with actionlint: syntax, expressions, action inputs, and shell steps. | | [`github-actions/zizmor`](/reference/checks/github-actions/zizmor/) | `commit` | `recommended` | Audits GitHub Actions workflows and composite actions with zizmor for template injection, excessive permissions, and dangerous triggers. | | [`nginx/gixy`](/reference/checks/nginx/gixy/) | `commit` | `recommended` | Checks every nginx file for mistakes that expose a server: request forgery, path traversal through alias, header injection, and a disclosed version. | | [`nginx/config-test`](/reference/checks/nginx/config-test/) | `push` | `recommended` | Runs `nginx -t` on each main file inside the image, with a throwaway certificate and resolved upstream names. Records every file that nginx parsed. | | [`openapi/spectral`](/reference/checks/openapi/spectral/) | `commit` | `recommended` | Lints the file in `openapi.document` with the Spectral OpenAPI rules. | | [`openapi/stale-document`](/reference/checks/openapi/stale-document/) | `push` | `recommended` | Runs `openapi.generate_command` and fails when the document changes. | | [`xcode/plutil`](/reference/checks/xcode/plutil/) | `commit` | `recommended` | Parses every property list and entitlements file with plutil. | | [`xcode/xcstrings`](/reference/checks/xcode/xcstrings/) | `commit` | `recommended` | Checks that each string catalog parses and translates every string into all its locales. | | [`xcode/assets`](/reference/checks/xcode/assets/) | `commit` | `recommended` | Checks that each asset `Contents.json` parses, and that its image set holds each file it names. | | [`xcode/unused-assets`](/reference/checks/xcode/unused-assets/) | `commit` | `all` | Finds asset sets that no source or Xcode build setting names. | | [`xcode/files-without-target`](/reference/checks/xcode/files-without-target/) | `commit` | `recommended` | Finds the Swift files in the tree that no target of the project names. | | [`xcode/entitlements`](/reference/checks/xcode/entitlements/) | `commit` | `recommended` | Checks each entitlement against `xcode.allowed_entitlements`, when the settings hold that list. | | [`xcode/app-transport-security`](/reference/checks/xcode/app-transport-security/) | `commit` | `recommended` | Refuses a property list that allows arbitrary loads, which turns transport security off for every host. | ## Libraries | Check | Stage | Level | What it does | | ------------------------------------------------------------------------- | ------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [`drizzle/stale-migrations`](/reference/checks/drizzle/stale-migrations/) | `push` | `recommended` | Runs `drizzle-kit generate` and fails when it creates a migration. | | [`translations/messages`](/reference/checks/translations/messages/) | `push` | `recommended` | Checks the next-intl JSON/ICU files under `translations.messages_folder`: each message parses, none stays empty, and each locale holds all keys of the base. | ## General | Check | Stage | Level | What it does | | ----------------------------------------------------------------------------------- | --------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`commits/commitlint`](/reference/checks/commits/commitlint/) | `message` | `all` | Checks a new commit message for a conventional type, an optional known scope, a first line of 72 characters or fewer, and a wrapped body. | | [`commits/commitlint-pushed`](/reference/checks/commits/commitlint-pushed/) | `push` | `all` | Checks the message of each commit in a push. A manual run covers every commit from the upstream merge base to HEAD. | | [`dependencies/osv-scanner`](/reference/checks/dependencies/osv-scanner/) | `push` | `recommended` | Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database. | | [`dependencies/syncpack`](/reference/checks/dependencies/syncpack/) | `push` | `all` | Checks that every workspace package resolves each dependency to one version. | | [`dependencies/lockfiles`](/reference/checks/dependencies/lockfiles/) | `commit` | `recommended` | Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts. | | [`docs/lychee`](/reference/checks/docs/lychee/) | `commit` | `recommended` | Checks that local documentation links reach existing files and valid anchor or text fragments. | | [`docs/lychee-external`](/reference/checks/docs/lychee-external/) | `manual` | `recommended` | Checks every external link over the network. | | [`docs/missing-paths`](/reference/checks/docs/missing-paths/) | `commit` | `recommended` | Checks that documented paths point to tracked files, and that mise, npm, pnpm, yarn, and bun run commands name a task or script of their project. | | [`docs/required-files`](/reference/checks/docs/required-files/) | `commit` | `all` | Checks that every scope has a README.md and the root has a LICENSE. | | [`duplication/jscpd`](/reference/checks/duplication/jscpd/) | `push` | `all` | Reports every block of code copied between files, naming both places. | | [`files/taplo-format`](/reference/checks/files/taplo-format/) | `commit` | `recommended` | Checks that every TOML file parses and matches the taplo output under the shared settings. | | [`files/yamllint`](/reference/checks/files/yamllint/) | `commit` | `recommended` | Parses every YAML file and checks its indentation, keys, and values with yamllint. | | [`files/v8r`](/reference/checks/files/v8r/) | `push` | `recommended` | Validates each file that matches a SchemaStore schema, such as package.json, tsconfig.json, mise files, and workflows. | | [`files/xmllint`](/reference/checks/files/xmllint/) | `commit` | `recommended` | Parses every XML file with xmllint. | | [`format/prettier`](/reference/checks/format/prettier/) | `commit` | `recommended` | Checks each file Prettier handles for unformatted code. | | [`format/editorconfig-checker`](/reference/checks/format/editorconfig-checker/) | `commit` | `recommended` | Checks line endings, final newlines, and trailing whitespace in every file against .editorconfig. | | [`gspot/generated-files`](/reference/checks/gspot/generated-files/) | `commit` | `recommended` | Compares generated files with the settings and reports changed, missing, and stray ones, and any with merge conflict markers. | | [`gspot/unmatched-patterns`](/reference/checks/gspot/unmatched-patterns/) | `commit` | `recommended` | Checks settings path patterns against tracked files. | | [`gspot/suppressions`](/reference/checks/gspot/suppressions/) | `commit` | `recommended` | Reports suppressions with no reason, any that lift a size or complexity limit, and Semgrep or Vale directives. | | [`licenses/allowed`](/reference/checks/licenses/allowed/) | `push` | `recommended` | Compares the license of each installed npm or Python package with the allowed list and package records. | | [`naming/identifiers`](/reference/checks/naming/identifiers/) | `commit` | `all` | Checks every identifier against the naming settings: banned words, case, length, and word count. | | [`naming/paths`](/reference/checks/naming/paths/) | `commit` | `all` | Checks every file stem and folder name against the case rules of its language and the banned words. | | [`naming/allowed-names`](/reference/checks/naming/allowed-names/) | `commit` | `all` | Reports allowed names that no source file uses. | | [`prose/vale`](/reference/checks/prose/vale/) | `commit` | `recommended` | Checks ambiguous dates, link text, and alternative text with the shipped Vale styles at level `recommended`. Level `all` adds the complete style and upstream packages. | | [`repository/large-files`](/reference/checks/repository/large-files/) | `commit` | `recommended` | Checks that each tracked file over the size limit goes through Git LFS or has a reason. | | [`repository/local-files`](/reference/checks/repository/local-files/) | `commit` | `recommended` | Reports a tracked file at a path that a configuration keeps out of Git. | | [`secrets/gitleaks-staged`](/reference/checks/secrets/gitleaks-staged/) | `commit` | `recommended` | Scans the staged change for keys, tokens, and passwords before the commit exists. | | [`secrets/gitleaks-pushed`](/reference/checks/secrets/gitleaks-pushed/) | `push` | `recommended` | Scans every commit about to be pushed for keys, tokens, and passwords. | | [`secrets/trufflehog-pushed`](/reference/checks/secrets/trufflehog-pushed/) | `push` | `recommended` | Verifies candidate secrets in the pushed commits against the service that issued them. | | [`secrets/dotenv-linter`](/reference/checks/secrets/dotenv-linter/) | `commit` | `recommended` | Checks every tracked environment file: key format, duplicates, quoting, ordering, and trailing spaces. | | [`secrets/env-examples`](/reference/checks/secrets/env-examples/) | `push` | `recommended` | Checks that an existing env example lists each static uppercase key that code reads through process.env, import.meta.env, Bun.env, Deno.env.get, the Python os module, or an environment function. | | [`security/semgrep`](/reference/checks/security/semgrep/) | `push` | `recommended` | Runs the Semgrep packs of each configuration, and the repository rules, over changed files. | | [`security/semgrep-registry`](/reference/checks/security/semgrep-registry/) | `manual` | `recommended` | Downloads and runs the public Semgrep packs in `tools.semgrep.registry_packs`. | | [`spelling/typos`](/reference/checks/spelling/typos/) | `commit` | `recommended` | Finds misspelled words in code, comments, and documentation. | | [`structure/lone-files`](/reference/checks/structure/lone-files/) | `commit` | `all` | Finds a folder that holds one code file and nothing else. | | [`structure/shared-prefixes`](/reference/checks/structure/shared-prefixes/) | `commit` | `all` | Finds sibling files that share a name prefix, such as `asset-card`, `asset-list`, and `asset-row`. | | [`structure/file-folder-clashes`](/reference/checks/structure/file-folder-clashes/) | `commit` | `all` | Finds a file and a folder with one stem in the same place, such as `turn.ts` beside `turn/`. | | [`structure/long-files`](/reference/checks/structure/long-files/) | `commit` | `all` | Checks the code line count of each file against the limit for its language. | | [`structure/trivial-functions`](/reference/checks/structure/trivial-functions/) | `commit` | `all` | Finds functions with too few statements and files that only forward to other code. | | [`structure/environment-readers`](/reference/checks/structure/environment-readers/) | `commit` | `all` | Finds environment reads outside the files listed in structure.environment\_readers. |