|
| 1 | +--- |
| 2 | +description: "Code quality governance rules, coverage thresholds, complexity limits, and scan conventions for multi-language code analysis." |
| 3 | +applyTo: "**/*.ts,**/*.js,**/*.py,**/*.cs,**/*.java,**/*.go" |
| 4 | +--- |
| 5 | + |
| 6 | +# Code Quality Governance Rules |
| 7 | + |
| 8 | +## Coverage Thresholds |
| 9 | + |
| 10 | +Every scanned application must meet the following minimum coverage levels: |
| 11 | + |
| 12 | +| Metric | Threshold | Action | |
| 13 | +|--------|-----------|--------| |
| 14 | +| Line coverage | ≥ 80% | Must fix before release | |
| 15 | +| Branch coverage | ≥ 80% | Must fix before release | |
| 16 | +| Function coverage | ≥ 80% | Must fix before release | |
| 17 | +| New code coverage | ≥ 90% | Warn on PR | |
| 18 | + |
| 19 | +## Complexity Limits |
| 20 | + |
| 21 | +Functions exceeding complexity limits are flagged by the Lizard scanner: |
| 22 | + |
| 23 | +| Metric | Threshold | SARIF Level | |
| 24 | +|--------|-----------|-------------| |
| 25 | +| Cyclomatic complexity (CCN) | > 15 | `error` | |
| 26 | +| Cyclomatic complexity (CCN) | > 10 | `warning` | |
| 27 | +| Function length | > 80 lines | `warning` | |
| 28 | +| Parameter count | > 5 | `note` | |
| 29 | + |
| 30 | +## Duplication Rules |
| 31 | + |
| 32 | +Code duplication is detected by jscpd across all languages: |
| 33 | + |
| 34 | +| Metric | Threshold | Action | |
| 35 | +|--------|-----------|--------| |
| 36 | +| Duplication rate | > 5% | Must reduce before release | |
| 37 | +| Minimum clone tokens | 50 | Detection sensitivity | |
| 38 | +| Cross-file duplication | Any | Flag for refactoring | |
| 39 | + |
| 40 | +## Required Scan Coverage |
| 41 | + |
| 42 | +Every demo application must be scanned for the following categories: |
| 43 | + |
| 44 | +| # | Category | Tool | Rule Examples | |
| 45 | +|---|----------|------|---------------| |
| 46 | +| 1 | Linting | MegaLinter (ESLint, Ruff, golangci-lint, .NET Analyzers, Checkstyle) | Style violations, unused variables, error-prone patterns | |
| 47 | +| 2 | Duplication | jscpd | Copy-paste code blocks across files | |
| 48 | +| 3 | Complexity | Lizard | High cyclomatic complexity, long functions | |
| 49 | +| 4 | Coverage | jest, pytest-cov, Coverlet, JaCoCo, go test | Untested functions, low branch coverage | |
| 50 | + |
| 51 | +## Severity Mapping |
| 52 | + |
| 53 | +Code quality findings map to SARIF severity levels: |
| 54 | + |
| 55 | +| Condition | SARIF Level | Description | Action | |
| 56 | +|-----------|-------------|-------------|--------| |
| 57 | +| Coverage < 50% | `error` | Critical coverage gap | Immediate fix required | |
| 58 | +| Coverage 50–70% | `error` | Significant gap | Fix within current sprint | |
| 59 | +| Coverage 70–80% | `warning` | Below threshold | Address before release | |
| 60 | +| CCN > 15 | `error` | Dangerously complex | Refactor immediately | |
| 61 | +| CCN 10–15 | `warning` | Moderately complex | Simplify in current sprint | |
| 62 | +| Duplication > 10% | `error` | Excessive duplication | Refactor immediately | |
| 63 | +| Duplication 5–10% | `warning` | Moderate duplication | Plan refactoring | |
| 64 | +| Lint violation | `note` | Style or minor issue | Fix opportunistically | |
| 65 | + |
| 66 | +## SARIF Output Conventions |
| 67 | + |
| 68 | +- `automationDetails.id` must be prefixed with `code-quality/coverage/` |
| 69 | +- `partialFingerprints` use hash of `ruleId:file:function` |
| 70 | +- `tool.driver.name` is `code-quality-scanner` |
| 71 | +- Include `properties.tags` with `code-quality` plus category tags |
0 commit comments