# Verifying JSON and TOML changes Files: `.json`, `.toml`. Derived from 8 scanned source repositories and 251 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/config/ How to use this: run every check under *Run on every change*. Then, for each section under *Add when the change touches* that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt's raw URL). Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts. ## Run on every change - **Formatting**: `prettier` (75% of repos). Command seen: `prettier --check docker-compose.yml docker-compose.override.yml`. Autofixes. Exit codes: `0` everything formatted; `1` something was not formatted (--check); `2` prettier error. Docs: https://prettier.io/docs/cli#exit-codes - **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover. - **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules. - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. Review prompts (37 in total, most discussed first): - [Consistent naming standards](https://awesomereviewers.com/raw/core-consistent-naming-standards.md) — home-assistant/core, Naming Conventions - [Identifier Naming Rules](https://awesomereviewers.com/raw/azure-sentinel-identifier-naming-rules.md) — Azure/Azure-Sentinel, Naming Conventions - [Maintain consistent terminology patterns](https://awesomereviewers.com/raw/roo-code-maintain-consistent-terminology-patterns.md) — RooCodeInc/Roo-Code, Naming Conventions - [Consistent placeholder conventions](https://awesomereviewers.com/raw/appwrite-consistent-placeholder-conventions.md) — appwrite/appwrite, Naming Conventions - [Consistent localization formatting](https://awesomereviewers.com/raw/roo-code-consistent-localization-formatting.md) — RooCodeInc/Roo-Code, Code Style - [Deterministic Resource Naming](https://awesomereviewers.com/raw/azure-quickstart-templates-deterministic-resource-naming.md) — Azure/azure-quickstart-templates, Naming Conventions - [arm escaping and diff hygiene](https://awesomereviewers.com/raw/azure-sentinel-arm-escaping-and-diff-hygiene.md) — Azure/Azure-Sentinel, Code Style - [Follow established conventions](https://awesomereviewers.com/raw/helix-follow-established-conventions.md) — helix-editor/helix, Code Style - [Consistent naming patterns](https://awesomereviewers.com/raw/n8n-consistent-naming-patterns.md) — n8n-io/n8n, Naming Conventions - [Consistent technical term translation](https://awesomereviewers.com/raw/airflow-consistent-technical-term-translation.md) — apache/airflow, Naming Conventions - [Consistent ARM Json Formatting](https://awesomereviewers.com/raw/azure-quickstart-templates-consistent-arm-json-formatting.md) — Azure/azure-quickstart-templates, Code Style - [consistent naming conventions](https://awesomereviewers.com/raw/helix-consistent-naming-conventions.md) — helix-editor/helix, Naming Conventions ## Add when the change touches ### Authentication, input handling, secrets, permissions - **Security scanning**: `codeql` (50% of repos). Runs via GitHub Action github/codeql-action/analyze. Alternatives: semgrep (12%). Docs: https://github.com/github/codeql - **Secret scanning** — no tool detected in the sample. Catches: Credentials and tokens committed to the repository. - **Dependency audit**: `dependency-review` (25% of repos). Runs via GitHub Action actions/dependency-review-action. Docs: https://github.com/actions/dependency-review-action Review prompts (23 in total, most discussed first): - [Parameterize security commands](https://awesomereviewers.com/raw/prowler-parameterize-security-commands.md) — prowler-cloud/prowler, Security - [Align RBAC and Identity](https://awesomereviewers.com/raw/azure-sentinel-align-rbac-and-identity.md) — Azure/Azure-Sentinel, Security - [Strict auth schema validation](https://awesomereviewers.com/raw/bifrost-strict-auth-schema-validation.md) — maximhq/bifrost, Security - [Azure encryption property names](https://awesomereviewers.com/raw/checkov-azure-encryption-property-names.md) — bridgecrewio/checkov, Security - [Use correct encryption properties](https://awesomereviewers.com/raw/checkov-use-correct-encryption-properties.md) — bridgecrewio/checkov, Security - [Audit dependency lifecycle scripts](https://awesomereviewers.com/raw/oh-my-pi-audit-dependency-lifecycle-scripts.md) — can1357/oh-my-pi, Security - [Secure-by-default integrations](https://awesomereviewers.com/raw/aidlc-workflows-secure-by-default-integrations.md) — awslabs/aidlc-workflows, Security - [File-Based Command Safety](https://awesomereviewers.com/raw/bmad-method-file-based-command-safety.md) — bmad-code-org/bmad-method, Security - [Secure extension install](https://awesomereviewers.com/raw/goose-secure-extension-install.md) — aaif-goose/goose, Security - [Narrow secret allowlists](https://awesomereviewers.com/raw/cline-narrow-secret-allowlists.md) — CLINE/CLINE, Security - [Scope secret-scan allowlists narrowly](https://awesomereviewers.com/raw/cline-scope-secret-scan-allowlists-narrowly.md) — cline/cline, Security - [trust server-side validation](https://awesomereviewers.com/raw/core-trust-server-side-validation.md) — home-assistant/core, Security ### Public APIs, signatures, error paths, nullability - **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules. - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. Review prompts (17 in total, most discussed first): - [Use Stable API Versions](https://awesomereviewers.com/raw/azure-sentinel-use-stable-api-versions.md) — Azure/Azure-Sentinel, API - [Null Safety Patterns](https://awesomereviewers.com/raw/azure-sentinel-null-safety-patterns.md) — Azure/Azure-Sentinel, Null Handling - [Explicit API Contracts](https://awesomereviewers.com/raw/azure-quickstart-templates-explicit-api-contracts.md) — Azure/azure-quickstart-templates, API - [Null and Omission Safety](https://awesomereviewers.com/raw/bifrost-null-and-omission-safety.md) — maximhq/bifrost, Null Handling - [API documentation consistency](https://awesomereviewers.com/raw/core-api-documentation-consistency.md) — home-assistant/core, API - [Avoid empty placeholders](https://awesomereviewers.com/raw/azure-quickstart-templates-avoid-empty-placeholders.md) — Azure/azure-quickstart-templates, Null Handling - [API identifier consistency](https://awesomereviewers.com/raw/hyperswitch-api-identifier-consistency.md) — juspay/hyperswitch, API - [OpenAPI spec compliance](https://awesomereviewers.com/raw/appwrite-openapi-spec-compliance.md) — appwrite/appwrite, API - [API Config Consistency](https://awesomereviewers.com/raw/goose-api-config-consistency.md) — aaif-goose/goose, API - [Graceful config validation](https://awesomereviewers.com/raw/bifrost-graceful-config-validation.md) — maximhq/bifrost, Error Handling - [Config Contract Validation](https://awesomereviewers.com/raw/bifrost-config-contract-validation.md) — maximhq/bifrost, API - [API Contract Verification](https://awesomereviewers.com/raw/ragflow-api-contract-verification.md) — infiniflow/ragflow, API ### Service and framework code - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Version and platform matrix**: `ci-matrix` (38% of repos). Command seen: `analyze (language: 1)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations ### Algorithms, parsers, data transforms - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. - **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders. - **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does. - **Proofs and specifications** — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification. Review prompts (2 in total, most discussed first): - [Constrain UI Rule Matching](https://awesomereviewers.com/raw/herdr-constrain-ui-rule-matching.md) — ogulcancelik/herdr, Algorithms - [Regex Guardrails for Filters](https://awesomereviewers.com/raw/omniroute-regex-guardrails-for-filters.md) — diegosouzapw/OmniRoute, Algorithms ### Threads, async code, locks, shared state - **Concurrency model checking** — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings. - **Undefined-behaviour detection** — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code. - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. ### Network calls, retries, timeouts, protocols - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders. Review prompts (1 in total, most discussed first): - [Single Source Network Definitions](https://awesomereviewers.com/raw/azure-quickstart-templates-single-source-network-definitions.md) — Azure/azure-quickstart-templates, Networking ### UI components and pages - **End-to-end browser tests** — no tool detected in the sample. Catches: User flows broken across components, routing and the network. - **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover. Review prompts (1 in total, most discussed first): - [Use Angular v19+ Strictness](https://awesomereviewers.com/raw/query-use-angular-v19-strictness.md) — tanstack/query, Angular ### Databases, migrations, caching - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Version and platform matrix**: `ci-matrix` (38% of repos). Command seen: `analyze (language: 1)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations Review prompts (5 in total, most discussed first): - [Schema-First DCR KQL](https://awesomereviewers.com/raw/azure-sentinel-schema-first-dcr-kql.md) — Azure/Azure-Sentinel, Database - [Backcompatible Migration Contract](https://awesomereviewers.com/raw/azure-sentinel-backcompatible-migration-contract.md) — Azure/Azure-Sentinel, Migrations - [Version migration dependencies carefully](https://awesomereviewers.com/raw/appwrite-version-migration-dependencies-carefully.md) — appwrite/appwrite, Migrations - [Cache keys drive rebuilds](https://awesomereviewers.com/raw/nanochat-cache-keys-drive-rebuilds.md) — karpathy/nanochat, Caching - [Enable database resilience](https://awesomereviewers.com/raw/prowler-enable-database-resilience.md) — prowler-cloud/prowler, Database ### Model, prompt and LLM code - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. Review prompts (9 in total, most discussed first): - [AI model data validation](https://awesomereviewers.com/raw/litellm-ai-model-data-validation.md) — BerriAI/litellm, AI - [Bound LLM Budgets](https://awesomereviewers.com/raw/pr-agent-bound-llm-budgets.md) — the-pr-agent/pr-agent, AI - [model description accuracy](https://awesomereviewers.com/raw/jan-model-description-accuracy.md) — menloresearch/jan, AI - [AI dependency management](https://awesomereviewers.com/raw/langchainjs-ai-dependency-management.md) — langchain-ai/langchainjs, AI - [Validate model limits](https://awesomereviewers.com/raw/goose-validate-model-limits.md) — aaif-goose/goose, AI - [AI dependency management](https://awesomereviewers.com/raw/sdk-python-ai-dependency-management.md) — strands-agents/sdk-python, AI - [AI dependency justification](https://awesomereviewers.com/raw/sglang-ai-dependency-justification.md) — sgl-project/sglang, AI - [AI dependency classification](https://awesomereviewers.com/raw/stagehand-ai-dependency-classification.md) — browserbase/stagehand, AI - [Version AI dependencies appropriately](https://awesomereviewers.com/raw/tokenizers-version-ai-dependencies-appropriately.md) — huggingface/tokenizers, AI ### CI workflows and configuration files - **CI workflow linting** — no tool detected in the sample. Catches: Broken GitHub Actions syntax, script injection, over-broad token permissions. - **File hygiene**: `pre-commit-hooks` (25% of repos). Runs via pre-commit hook check-json. Autofixes. Docs: https://github.com/pre-commit/pre-commit-hooks Review prompts (135 in total, most discussed first): - [Dependency version ranges](https://awesomereviewers.com/raw/express-dependency-version-ranges.md) — Expressjs/Express, Configurations - [Consistent dependency config](https://awesomereviewers.com/raw/query-consistent-dependency-config.md) — tanstack/query, Configurations - [Validate Block JSON](https://awesomereviewers.com/raw/freecodecamp-validate-block-json.md) — freeCodeCamp/freeCodeCamp, CI/CD - [Environment-Driven Parameters](https://awesomereviewers.com/raw/azure-quickstart-templates-environment-driven-parameters.md) — Azure/azure-quickstart-templates, Configurations - [Config schema conventions](https://awesomereviewers.com/raw/heretic-config-schema-conventions.md) — p-e-w/heretic, Configurations - [Dependency version specification](https://awesomereviewers.com/raw/router-dependency-version-specification.md) — TanStack/router, Configurations - [dependency classification standards](https://awesomereviewers.com/raw/prisma-dependency-classification-standards.md) — prisma/prisma, Configurations - [dependency version constraints](https://awesomereviewers.com/raw/workers-sdk-dependency-version-constraints.md) — cloudflare/workers-sdk, Configurations - [Config Scope And Hygiene](https://awesomereviewers.com/raw/pr-agent-config-scope-and-hygiene.md) — the-pr-agent/pr-agent, Configurations - [Stable dependency version management](https://awesomereviewers.com/raw/appwrite-stable-dependency-version-management.md) — appwrite/appwrite, Configurations - [Standardize dependency version notation](https://awesomereviewers.com/raw/express-standardize-dependency-version-notation.md) — expressjs/express, Configurations - [dependency constraint consistency](https://awesomereviewers.com/raw/poetry-dependency-constraint-consistency.md) — python-poetry/poetry, Configurations ### Dependencies and lockfiles - **Dependency audit**: `dependency-review` (25% of repos). Runs via GitHub Action actions/dependency-review-action. Docs: https://github.com/actions/dependency-review-action - **Lockfile consistency** — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest. - **Version and platform matrix**: `ci-matrix` (38% of repos). Command seen: `analyze (language: 1)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations ### The tests themselves - **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does. - **Version and platform matrix**: `ci-matrix` (38% of repos). Command seen: `analyze (language: 1)`. Docs: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations Review prompts (13 in total, most discussed first): - [Type-Safe, Scripted Tests](https://awesomereviewers.com/raw/query-type-safe-scripted-tests.md) — tanstack/query, Testing - [manage testing dependencies](https://awesomereviewers.com/raw/poetry-manage-testing-dependencies.md) — python-poetry/poetry, Testing - [document test configurations](https://awesomereviewers.com/raw/jj-document-test-configurations.md) — jj-vcs/jj, Testing - [Avoid skipping e2e tests](https://awesomereviewers.com/raw/vitess-avoid-skipping-e2e-tests.md) — vitessio/vitess, Testing - [Precise testing dependency versioning](https://awesomereviewers.com/raw/framework-precise-testing-dependency-versioning.md) — laravel/framework, Testing - [comprehensive test validation](https://awesomereviewers.com/raw/router-comprehensive-test-validation.md) — TanStack/router, Testing - [organize test scripts properly](https://awesomereviewers.com/raw/react-router-organize-test-scripts-properly.md) — remix-run/react-router, Testing - [Cross-platform test management](https://awesomereviewers.com/raw/maplibre-native-cross-platform-test-management.md) — maplibre/maplibre-native, Testing - [Use descriptive testing names](https://awesomereviewers.com/raw/cypress-use-descriptive-testing-names.md) — cypress-io/cypress, Testing - [Test template defaults](https://awesomereviewers.com/raw/azure-quickstart-templates-test-template-defaults.md) — Azure/azure-quickstart-templates, Testing - [Manage testing dependencies](https://awesomereviewers.com/raw/nest-manage-testing-dependencies.md) — nestjs/nest, Testing - [Test dependency management](https://awesomereviewers.com/raw/nest-test-dependency-management.md) — nestjs/nest, Testing ### Documentation and comments - **Docs build** — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation. - **Spelling**: `codespell` (12% of repos). Runs via pre-commit hook codespell. Docs: https://github.com/codespell-project/codespell Review prompts (8 in total, most discussed first): - [Complete locale translations](https://awesomereviewers.com/raw/roo-code-complete-locale-translations.md) — RooCodeInc/Roo-Code, Documentation - [Document Packaging Conventions](https://awesomereviewers.com/raw/azure-sentinel-document-packaging-conventions.md) — Azure/Azure-Sentinel, Documentation - [In-code Documentation Consistency](https://awesomereviewers.com/raw/azure-quickstart-templates-in-code-documentation-consistency.md) — Azure/azure-quickstart-templates, Documentation - [Consistent documentation language](https://awesomereviewers.com/raw/core-consistent-documentation-language.md) — home-assistant/core, Documentation - [Complete accurate documentation](https://awesomereviewers.com/raw/react-router-complete-accurate-documentation.md) — remix-run/react-router, Documentation - [Natural language translations](https://awesomereviewers.com/raw/airflow-natural-language-translations.md) — apache/airflow, Documentation - [Prevent API documentation duplication](https://awesomereviewers.com/raw/appwrite-prevent-api-documentation-duplication.md) — appwrite/appwrite, Documentation - [Update documentation configuration](https://awesomereviewers.com/raw/langchainjs-update-documentation-configuration.md) — langchain-ai/langchainjs, Documentation ## Source repositories [home-assistant/core](https://awesomereviewers.com/sources/home-assistant-core/), [zed-industries/zed](https://awesomereviewers.com/sources/zed-industries-zed/), [appwrite/appwrite](https://awesomereviewers.com/sources/appwrite-appwrite/), [juspay/hyperswitch](https://awesomereviewers.com/sources/juspay-hyperswitch/), [bytedance/UI-TARS-desktop](https://awesomereviewers.com/sources/bytedance-ui-tars-desktop/), [Azure/azure-quickstart-templates](https://awesomereviewers.com/sources/azure-azure-quickstart-templates/), [the-pr-agent/pr-agent](https://awesomereviewers.com/sources/the-pr-agent-pr-agent/), [Azure/Azure-Sentinel](https://awesomereviewers.com/sources/azure-azure-sentinel/)