{
  "repository": "gravitational/teleport",
  "ref": "1283425b60ec5f60d509ba4c791183d452923ff7",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "clippy",
      "method": "static_analysis",
      "commands": [
        "cargo clippy --version",
        "cargo clippy --locked --all-targets -- -D warnings"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-rust.steps[2] (Set up Rust)"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-rust.steps[3] (Run Rust linters)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-rust (line 1217)"
        }
      ],
      "upstream": "https://github.com/rust-lang/rust-clippy",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "golangci-lint",
      "method": "static_analysis",
      "commands": [
        "uses golangci/golangci-lint-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[5] (golangci-lint (api))"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[6] (golangci-lint (teleport))"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[7] (golangci-lint (assets/backport))"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[8] (golangci-lint (build.assets/tooling))"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[9] (golangci-lint (integrations/terraform))"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[10] (golangci-lint (integrations/event-handler))"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[11] (golangci-lint (e2e/runner))"
        },
        {
          "path": ".golangci.yml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/golangci/golangci-lint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc --build",
        "tsc --noEmit"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e-tests-base.yaml",
          "locator": "jobs.build.steps[5] (Type-check e2e tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.type-check"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-ui.steps[5] (Run Type Check)"
        },
        {
          "path": "e2e/package.json",
          "locator": "scripts.type-check"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "devDependencies: eslint"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "cargo-test",
      "method": "testing",
      "commands": [
        "cargo test"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/unit-tests-rust.yaml",
          "locator": "jobs.test.steps[1] (Run tests)"
        },
        {
          "path": "Makefile",
          "locator": "target test-rust (line 1101)"
        }
      ],
      "upstream": "https://github.com/rust-lang/cargo",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "go-test",
      "method": "testing",
      "commands": [
        "go test -timeout 30m ./integration/autoupdate/tools -v",
        "gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-integrations-access.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-integrations-access.json ./access/...",
        "gotestsum --junitfile $(TEST_LOG_DIR)/unit-tests-integrations-lib.xml --jsonfile $(TEST_LOG_DIR)/unit-tests-integrations-lib.json ./lib/...",
        "go test -c -tags bpf,pam -o _test/libsrv.test ./lib/srv"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/integration-tests-win.yaml",
          "locator": "jobs.test.steps[2] (Run tests)"
        },
        {
          "path": ".github/workflows/unit-tests-integrations.yaml",
          "locator": "jobs.test.steps[2] (Run access plugin tests)"
        },
        {
          "path": "Makefile",
          "locator": "target test-access-integrations (line 1055)"
        },
        {
          "path": "integrations/Makefile",
          "locator": "target test-access (line 10)"
        },
        {
          "path": ".github/workflows/unit-tests-integrations.yaml",
          "locator": "jobs.test.steps[3] (Run integrations lib tests)"
        },
        {
          "path": "Makefile",
          "locator": "target test-integrations-lib (line 1063)"
        },
        {
          "path": "integrations/Makefile",
          "locator": "target test-lib (line 14)"
        },
        {
          "path": "Makefile",
          "locator": "target test-bpf (line 501)"
        }
      ],
      "upstream": "https://github.com/golang/go",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "jest",
      "method": "testing",
      "commands": [
        "jest --coverage"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.test-coverage"
        },
        {
          "path": "package.json",
          "locator": "devDependencies: jest"
        },
        {
          "path": "jest.config.js",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/jestjs/jest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "node-test",
      "method": "testing",
      "commands": [
        "node --test"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/doc-tests.yaml",
          "locator": "jobs.script-tests.steps[1] (Run docs preview-link script unit tests)"
        }
      ],
      "upstream": "https://github.com/nodejs/node",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "e2e/package.json",
          "locator": "devDependencies: @playwright/test"
        },
        {
          "path": "e2e/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "vitest.config.mts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "rustfmt",
      "method": "formatting",
      "commands": [
        "rustfmt --version",
        "cargo fmt -- --check"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-rust.steps[2] (Set up Rust)"
        },
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-rust.steps[3] (Run Rust linters)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-rust (line 1217)"
        }
      ],
      "upstream": "https://github.com/rust-lang/rustfmt",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "RUNTIME_SECTION := -r $(RUNTIME)"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target chart-ent (line 1615)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "TARBALL_PATH_SECTION := -s $(OSS_TARBALL_PATH)"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target chart-ent (line 1615)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bats $(BATSFLAGS) ./assets/aws/files/tests"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/unit-tests-code.yaml",
          "locator": "jobs.test.steps[3] (Run tests)"
        },
        {
          "path": "Makefile",
          "locator": "target test-sh (line 1111)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "design-system typegen"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "package.json",
          "locator": "scripts.postinstall"
        },
        {
          "path": "package.json",
          "locator": "scripts.generate-theme"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "do if strings $$binary"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target test-env-leakage (line 926)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target test-env-leakage (line 926)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "else echo No environment leak, PASS"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target test-env-leakage (line 926)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "for binary in $(BINARIES)"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target test-env-leakage (line 926)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "gcc ./lib/srv/testdata/bpf_rodata_args.c -o _test/bpf_rodata_args"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target test-bpf (line 501)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "go run . -config config.yaml"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target gen-resource-docs (line 1966)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "go run github.com/gravitational/shared-workflows/tools/changelog@latest --base-branch=$(BASE_BRANCH) --base-tag=$(BASE_TAG) ./"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target changelog (line 1878)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "node web/scripts/run-tests.mjs"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/unit-tests-ui.yaml",
          "locator": "jobs.test.steps[4] (Run tests)"
        },
        {
          "path": "package.json",
          "locator": "scripts.test"
        },
        {
          "path": "Makefile",
          "locator": "target dump-preset-roles (line 1904)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "oxfmt e/**/*.{ts,tsx,js,jsx,mts} web/**/*.{ts,tsx,js,jsx,mts} e2e/**/*.{ts,tsx,js,jsx,mts}"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-ui.steps[7] (Check formatting)"
        },
        {
          "path": "package.json",
          "locator": "scripts.format-check"
        },
        {
          "path": "package.json",
          "locator": "scripts.format"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint-fix"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "oxlint --quiet --report-unused-disable-directives-severity error web/ e/ e2e/"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-ui.steps[6] (Run oxlint)"
        },
        {
          "path": "package.json",
          "locator": "scripts.oxlint"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint"
        },
        {
          "path": "package.json",
          "locator": "scripts.lint-fix"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "sha256sum --check <<<${VALE_SHA256SUM}  ${VALE_FILENAME}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/doc-tests.yaml",
          "locator": "jobs.doc-tests.steps[14] (Download vale)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "storybook dev -p 9002 -c web/.storybook --ci --smoke-test"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-ui.steps[8] (Run Storybook smoke test)"
        },
        {
          "path": "package.json",
          "locator": "scripts.storybook-smoke-test"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tee /dev/stderr"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[15] (Check if test symbols are included in binaries)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-test-symbols (line 1207)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tee test-logs/benchstat.txt"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/benchmark-code-nonroot.yaml",
          "locator": "jobs.benchmark.steps[5] (Generate benchstat output)"
        },
        {
          "path": "Makefile",
          "locator": "target benchstat (line 1974)"
        },
        {
          "path": ".github/workflows/benchmark-code-root.yaml",
          "locator": "jobs.benchmark.steps[5] (Generate benchstat output)"
        },
        {
          "path": ".github/workflows/benchmark-code-smoke-nonroot.yaml",
          "locator": "jobs.test.steps[3] (Generate benchstat output)"
        },
        {
          "path": ".github/workflows/benchmark-code-smoke-root.yaml",
          "locator": "jobs.test.steps[3] (Generate benchstat output)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tr -d  `"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[15] (Check if test symbols are included in binaries)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-test-symbols (line 1207)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tree reach(github.com/gravitational/teleport/tool/...:all, github.com/stretchr/testify/...)"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[15] (Check if test symbols are included in binaries)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-test-symbols (line 1207)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tree reach(github.com/gravitational/teleport/tool/...:all, testing)"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[15] (Check if test symbols are included in binaries)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-test-symbols (line 1207)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "true"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "build.assets/Makefile",
          "locator": "target docsbox (line 560)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tsx scripts/verify-canonical-key.ts"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "e2e/package.json",
          "locator": "scripts.test:canonical-key"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "version $(HELM_UNITTEST_VERSION) or newer is required.\" ''"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target helmunit/installed (line 895)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "wc -l"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/lint.yaml",
          "locator": "jobs.lint-go.steps[15] (Check if test symbols are included in binaries)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-test-symbols (line 1207)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "xargs grep -E \\s+$$"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target docs-test-whitespace (line 861)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "xvfb-run e2e/runner/e2e --no-build ${{ inputs.license-file"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/e2e-tests-base.yaml",
          "locator": "jobs.test.steps[8] (Run tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}