{
  "repository": "cloudflare/workerd",
  "ref": "4b4f2511339105ac614ea60c57d26d5811c5c2d4",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "semgrep",
      "method": "static_analysis",
      "commands": [
        "semgrep ci"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/semgrep.yml",
          "locator": "jobs.semgrep.steps[1]"
        }
      ],
      "upstream": "https://github.com/semgrep/semgrep",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "clippy.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "devDependencies: eslint"
        },
        {
          "path": "src/cloudflare/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "src/node/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "src/pyodide/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "src/pyodide/tools/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "src/wpt/eslint.config.mjs",
          "locator": "config file"
        },
        {
          "path": "types/eslint.config.mjs",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "ruff.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "dependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "dependencies: prettier"
        },
        {
          "path": ".prettierrc.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "rustfmt.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare --config=ci --config=ci-bazelflare --config=ci-download-types"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare --config=ci --config=ci-test --config=ci-download-workerd --config=wpt-report --config=ci-bazelflare"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare --config=lint --config=ci --config=ci-test --config=ci-bazelflare"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare-asan --config=ci --config=ci-test --config=ci-bazelflare"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare-coverage --config=ci --config=ci-bazelflare-coverage"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare-release --config=ci --config=ci-bazelflare --config=ci-download-types"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare-release --config=ci --config=ci-bazelflare --config=ci-download-types-worker"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare-release --config=ci --config=ci-release --config=wpt-report --config=ci-bazelflare"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/check_ci_flags.sh --config=bazelflare-tsan --config=ci --config=ci-test --config=ci-bazelflare-tsan"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-ci-flags.steps[4] (Check CI's flags against a developer's)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/rust_io_graph_check.sh $EXPR --config=ci $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/_bazel.yml",
          "locator": "jobs.bazel.steps[8] (Check I/O backend dependency graph)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash build/rust_io_graph_check.sh {{args}}"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe check-io-backend-graph (line 86)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel coverage $EXPR $EXPR --config=ci $EXPR $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/_bazel.yml",
          "locator": "jobs.bazel.steps[11] (Bazel coverage)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel coverage --config=coverage {{path}}"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe eslint (line 187)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel run //src/workerd/server:workerd -- {{args}} --watch --verbose --experimental"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe test-compile-flags (line 41)"
        },
        {
          "path": "justfile",
          "locator": "recipe _clangd-check (line 54)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel run //src/workerd/tests:bench-{{path}} --config=benchmark"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe bench (line 145)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel run //src/workerd/tests:bench-{{path}} --config=benchmark --run_under=perf record -F max --call-graph lbr"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe profile (line 202)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test $(bazel query attr(tags, gc-stress, kind(\"_wd_test rule\", {{args}})) 2>/dev/null) --config=asan --test_tag_filters=gc-stress,-no-asan --test_timeout=300 --test_env=ASAN_OPTIONS=detect_leaks=0"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe profile (line 202)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test $(bazel query attr(tags, gc-stress, kind(\"_wd_test rule\", {{args}})) 2>/dev/null) --test_tag_filters=gc-stress"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe profile (line 202)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test $EXPR $EXPR --config=ci $EXPR $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/_bazel.yml",
          "locator": "jobs.bazel.steps[10] (Bazel test)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test --config=asan --keep_going --test_timeout=900 --test_env=WORKERD_GC_STRESS_ALLOC=1 --test_env=ASAN_OPTIONS=detect_leaks=0 \\"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe profile (line 202)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test --config=asan --test_timeout=900 --test_env=WORKERD_GC_STRESS_ALLOC=1 --test_env=ASAN_OPTIONS=detect_leaks=0 {{args}}"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe profile (line 202)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test //src/workerd/api/wpt:{{test_name}} --config=asan"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe asan-wpt-test (line 104)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test //src/wpt:{{test_name}}@ --test_env=GEN_TEST_CONFIG=1 --test_output=streamed"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe new-wpt-test (line 107)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test {{args}}"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe test-compile-flags (line 41)"
        },
        {
          "path": "justfile",
          "locator": "recipe _clangd-check (line 54)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bazel test {{args}} --test_output=streamed --nocache_test_results --test_tag_filters= --test_size_filters="
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe stream-test (line 90)"
        },
        {
          "path": "justfile",
          "locator": "recipe node-test (line 94)"
        },
        {
          "path": "justfile",
          "locator": "recipe wpt-test (line 98)"
        },
        {
          "path": "justfile",
          "locator": "recipe eslint (line 187)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "diff -r types/generated-snapshot bazel-bin/types/definitions > types.diff"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-snapshot.steps[5] (Check snapshot diff)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "diff -r types/generated-snapshot/experimental bazel-bin/types/definitions/experimental >> types.diff"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test.yml",
          "locator": "jobs.check-snapshot.steps[5] (Check snapshot diff)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "genhtml --branch-coverage --ignore-errors category --output coverage $(bazel info output_path)/_coverage/_coverage_report.dat"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe eslint (line 187)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "lldb ../workerd/server/workerd -- test {{test_name}}.wd-test --experimental --directory-path=TEST_TMPDIR=/tmp"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe lldb-wpt-test (line 101)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node npm/scripts/build-types-package.mjs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/release.yml",
          "locator": "jobs.build-and-publish-types.steps[5] (Build package)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "open coverage/index.html"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe eslint (line 187)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python ./tools/cross/format.py --check"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yml",
          "locator": "jobs.lint.steps[3] (Lint)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/check-compat-flag-docs.py"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/compat-flag-docs.yml",
          "locator": "jobs.check-compat-flag-docs.steps[1] (Check that new compat flags have documentation)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python tools/cross/format.py git --target HEAD~"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe format-head (line 130)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "true"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "justfile",
          "locator": "recipe generate-types (line 162)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}