Static analysis
6 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
cargo-check |
Type checking | cargo check --locked --all-targets |
local | ai-gateway/package.json |
clippy |
Linting | cargo clippy --locked --all-targets -- -D warnings |
ci, local | .github/workflows/pipeline.yml ai-gateway/package.json ai-gateway/clippy.toml |
codeql |
Security scanning | uses github/codeql-action/analyze |
ci | .github/workflows/codeql.yml |
semgrep |
Security scanning | semgrep scan --config p/default --baseline-commit $BASELINE_COMMIT --error |
ci | .github/workflows/semgrep.yml |
tsc |
Type checking | tsctsc --watch |
local | ee/package.json worker/package.json web/package.json |
zizmor |
CI workflow linting | uses zizmorcore/zizmor-action |
ci | .github/workflows/zizmor.yml |
Testing
6 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
cargo-test |
Unit and integration tests | cargo test --locked |
local | ai-gateway/package.json |
ci-matrix |
Version and platform matrix | analyze (include: 1) |
ci | .github/workflows/codeql.yml |
fast-check |
Property-based tests | worker/package.json | ||
node-test |
Unit and integration tests | node --test scripts/model-price-audit/*.test.mjsnode --test scripts/agents/sync-agent-shims.test.mjsnode --test scripts/github/label-cursor-prs.test.mjs |
ci | .github/workflows/model-price-audit.yml .github/workflows/pipeline.yml |
vitest |
Unit and integration tests | vitest run --project clientvitest run --project server --project server-isolated --project server-shared...vitest run --project in-source |
ci, local | .github/workflows/pipeline.yml web/package.json worker/package.json |
playwrightconfigured, not run |
End-to-end browser tests | web/package.json web/playwright.config.ts |
Formatting and hygiene
4 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
codespell |
Spelling | uses codespell-project/actions-codespell |
ci | .github/workflows/codespell.yml .codespellrc |
prettier |
Formatting | prettier --write **/*.{js,jsx,ts,tsx,css} --experimental-cliprettier --check **/*.{js,jsx,ts,tsx,css} --experimental-cli |
ci, local | .github/workflows/sdk-api-spec.yml package.json web/package.json |
ruff-format |
Formatting | ruff format langfuse/api |
ci | .github/workflows/sdk-api-spec.yml |
rustfmt |
Formatting | cargo fmt --all -- --checkcargo fmt --all |
ci, local | .github/workflows/pipeline.yml ai-gateway/package.json |
Supply chain
1 tool
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
cargo-deny |
Dependency audit | cargo deny --locked check licensescargo deny --locked check bans licenses sourcescargo deny --locked check |
ci, local | .github/workflows/licencecheck.yml .github/workflows/pipeline.yml ai-gateway/package.json deny.toml |
53 other commands the scanner could not classify
Commands from CI steps and task runners that look like checks but match no known tool. Some are checks, some are not.
bash ${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.shbash ${RUNNER_TEMP}/gh-aw/actions/check_oauth_tokens.shbash scripts/ci/retry-on-merge-queue.test.shbash scripts/ci/write-web-test-env.sh .env.dev$EXPR.example .env.runtimebash scripts/ci/write-web-test-env.sh .env.dev.example .envbash scripts/openapi/assert-generated-current.shbash scripts/openapi/assert-generated-current.test.shbash scripts/smoke-image.sh langfuse-ai-gateway:testbuildx imagetools inspect "${IMAGE}:${TAG}" --format '{{json .Manifest}}'case $AUDIT_DRY_RUN_MODE indotenv -e ../../.env -- tsc --noEmit --skipLibCheck --incremental --tsBuildInfoFile .tsbuildinfodotenv -e ../.env -- next build --experimental-build-mode compiledotenv -e ../.env -- oxlint --fix .dotenv -e ../.env -- oxlint --max-warnings 0dotenv -e ../.env -- tsc --noEmit --skipLibCheck --incremental --tsBuildInfoFile .tsbuildinfodotenv -e ../.env -- tsc -p tsconfig.json --noEmit --skipLibCheck --incremental --tsBuildInfoFile .tsbuildinfodotenv -e ../.env -- vitest run --project ai-gateway-e2e-serverdotenv -e ../.env.test -e ../.env -- playwright test --reporter=linedotenv -e ../.env.test -e ../.env -- vitest run --project server --project server-isolated --project server-shared-so...elif [ $SECRETS_EXPECTED = true ]elsenode --check $GENERATED_FILEnode --check $MCP_GENERATED_FILEnode --input-type=module <node scripts/agents/sync-agent-shims.mjs --checknode scripts/agents/sync-agent-shims.mjs --check --check-pathsnode scripts/check.mjsnode scripts/model-price-audit/discard-edits-without-model-changes.mjsnode scripts/model-price-audit/discard-formatting-only-pricing-diff.mjs --base $base_pricing_file --current worker/sr...node scripts/model-price-audit/prepare-metadata.mjs > $PR_TITLE_PATHnode scripts/model-price-audit/render-pull-request-body.mjsnode scripts/model-price-audit/validate-and-render-audit-output.mjsnode scripts/scan-client-bundle.mjs web/.next/staticoxlint --fix .oxlint --max-warnings 0read -r answer < /dev/ttyread -r answerreturn 1rev-parse --abbrev-ref HEAD)run_check Formatting pnpm run format:check
Review prompts
most discussed first