{
  "repository": "appwrite/appwrite",
  "ref": "51b1d0c4217f9b9325b71edd8ce72dc14a3bb4f9",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql-analysis.yml",
          "locator": "jobs.analyze.steps[2] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "semgrep",
      "method": "static_analysis",
      "commands": [
        "semgrep test .semgrep",
        "semgrep scan --config .semgrep --metrics=off --exclude .semgrep --json --output semgrep.json src/Appwrite app/controllers app/init",
        "semgrep scan --config .semgrep --metrics=off --exclude .semgrep --sarif --output semgrep.sarif src/Appwrite app/controllers app/init"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.static-rules.steps[2] (Validate rule fixtures)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.static-rules.steps[4] (Run security rules)"
        },
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.static-rules.steps[6] (Write security rules SARIF)"
        },
        {
          "path": ".github/workflows/security-scan.yml",
          "locator": "jobs.scan-rules.steps[2] (Validate rule fixtures)"
        },
        {
          "path": ".github/workflows/security-scan.yml",
          "locator": "jobs.scan-rules.steps[4] (Run security rules)"
        },
        {
          "path": ".github/workflows/security-scan.yml",
          "locator": "jobs.scan-rules.steps[6] (Write security rules SARIF)"
        }
      ],
      "upstream": "https://github.com/semgrep/semgrep",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "zizmor --format github .github"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.workflows.steps[2] (Audit workflows)"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "apps/console/eslint.config.js",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "analyze (language: 1)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql-analysis.yml",
          "locator": "jobs.analyze.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "apps/console/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [
        "prettier --write docker-compose.yml docker-compose.override.yml",
        "prettier --check docker-compose.yml docker-compose.override.yml"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.format:compose"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint:compose"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": "apps/console/prettier.config.js",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash .semgrep/prove.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.static-rules.steps[3] (Prove ERROR classes on scratch snippets)"
        },
        {
          "path": ".github/workflows/security-scan.yml",
          "locator": "jobs.scan-rules.steps[3] (Prove ERROR classes on scratch snippets)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run e2e -- $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.e2e.steps[7] (E2E tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run lint:content"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[5] (Check content for hidden Unicode)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run lint:native-dialogs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[7] (Check for native browser dialogs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run lint:removed-blog-links"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[6] (Check for links to removed blog posts)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run lint:sdk-pins"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[8] (Check for preview SDK pins)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run lint:snippets"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[4] (Check connect snippet line width)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run lint:types --against HEAD^1"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[9] (Check types against the baseline)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bun run test:unit"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console.yml",
          "locator": "jobs.checks.steps[10] (Unit tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "commander test commander.yaml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console-snippets-qa-server.yml",
          "locator": "jobs.qa.steps[17] (Assert the CLI output (commander))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "entry.type = entry.type.replace(/-/g, _)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "hurl --test --variable base_url=http://localhost:$EXPR --error-format long --report-junit artifacts/hurl/report.xml --report-html artifacts/hurl policies.hurl"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console-snippets-qa-server.yml",
          "locator": "jobs.qa.steps[16] (Assert the policy endpoints (Hurl))"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "mise run test $EXPR --headless --debug-output=$PWD/artifacts/maestro --flatten-debug-output --format=junit --output=$PWD/artifacts/maestro/report.xml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console-snippets-qa-web.yml",
          "locator": "jobs.qa.steps[11] (Run Maestro auth flow)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "mise run test --debug-output=$PWD/artifacts/maestro --flatten-debug-output --format=junit --output=$PWD/artifacts/maestro/report.xml"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/console-snippets-qa-ios.yml",
          "locator": "jobs.qa.steps[18] (Install the app and run the Maestro auth flow)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node .semgrep/baseline.js check semgrep.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci.yml",
          "locator": "jobs.static-rules.steps[5] (Fail on new ERROR findings outside the baseline)"
        },
        {
          "path": ".github/workflows/security-scan.yml",
          "locator": "jobs.scan-rules.steps[5] (Fail on new ERROR findings outside the baseline)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "return `${typeof parsed}`"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "return `[${typeof firstItem}] (${parsed.length} items)`"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "typeof branchName !== string"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "typeof method !== string) {"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "typeof name !== string) {"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "typeof req !== object) {"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[8] (Setup Safe Outputs Collector MCP)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}