Static analysis
6 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
actionlint |
CI workflow linting | actionlint -coloractionlint -color github-action/examples/*.yml |
ci | .github/workflows/workflow-quality.yml |
clippy |
Linting | cargo clippy --locked -- -D warningscargo clippy --locked --target $EXPR --lib --example windows-wide-launcher --... |
ci | .github/workflows/native-unix.yml .github/workflows/native-windows.yml |
ruff-check |
Linting | ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security |
ci | .github/workflows/node-ci.yml |
shellcheck |
Linting | shellcheck .github/scripts/*.sh docker/verify-container-compose.sh github-act... |
ci | .github/workflows/workflow-quality.yml |
tsc |
Type checking | tsc --noEmit |
ci, local | .github/workflows/action-ci.yml github-action/package.json |
zizmor |
CI workflow linting | zizmor --offline --strict-collection --min-severity medium --format github --... |
ci | .github/workflows/workflow-quality.yml |
Testing
5 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
cargo-test |
Unit and integration tests | cargo test --locked --lib |
ci | .github/workflows/native-unix.yml |
ci-matrix |
Version and platform matrix | behavior (node: 2)primitives (include: 4)primitives (include: 2) |
ci | .github/workflows/invoice-desk.yml .github/workflows/native-unix.yml .github/workflows/native-windows.yml |
node-test |
Unit and integration tests | node --test examples/invoice-desk/qa/app.test.mjs .github/scripts/invoice-des...node --test windows-files.test.mjsnode --test .github/scripts/test-ci-selection.mjs .github/scripts/test-verify... |
ci | .github/workflows/invoice-desk.yml .github/workflows/native-windows.yml .github/workflows/node-ci.yml .github/workflows/workflow-quality.yml |
pytest |
Unit and integration tests | pytest -q .github/scripts/test_require_native_python_report.pypytest plugins/codex-security/tests -m $PYTEST_MARKERS -q -n 4 --dist workste... |
ci | .github/workflows/node-ci.yml |
strykerconfigured, not run |
Mutation testing | sdk/typescript/stryker.config.json |
Formatting and hygiene
3 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
ruff-format |
Formatting | ruff format --check --config plugins/codex-security/pyproject.toml plugins/co... |
ci | .github/workflows/node-ci.yml |
rustfmt |
Formatting | cargo fmt --check |
ci | .github/workflows/native-unix.yml .github/workflows/native-windows.yml plugins/codex-security/native/rustfmt.toml |
prettierconfigured, not run |
Formatting | github-action/package.json .prettierrc.json |
Supply chain
1 tool
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
npm-audit |
Dependency audit | npm audit --audit-level=highnpm audit --prefix runtime --omit=dev --audit-level=highnpm audit signatures --prefix $consumer --registry=https://registry.npmjs.org... |
ci | .github/workflows/action-ci.yml .github/workflows/node-github-release.yml .github/workflows/node-release.yml |
94 other commands the scanner could not classify
Commands from CI steps and task runners that look like checks but match no known tool. Some are checks, some are not.
Not checkedbash docker/test-container-index.shbash docker/verify-container-sandbox.sh codex-security:release-candidatebash docker/wolfi/verify-npm-release.sh $lock $version $sha $archivebuildx imagetools inspect $reference --raw)bulk-scan requires a repository CSVbun test --timeout 30000 tests-ts/action-release-workflow.test.ts tests-ts/codex-dependency-pins.test.tsbun test --timeout 360000 ./tests-ts/windows-machine-policy.test.tsbun test sdk/typescript/tests-ts/codex-dependency-pins.test.tscase $tag_type incase $type incmp - $RUNNER_TEMP/scanner/base-sources.jsoncompleted = os.environ[SCAN_EXIT_CODE] == 0const provenance = JSON.parse(readFileSync(0, utf8))coverage = json.loads((root / invoice-desk-scan/coverage.json).read_text())coverage = result.get(coverage) or {}inspect --no-creds --raw docker://$IMAGE:$tagln -s ../../plugins/codex-security sdk/typescript/_bundled_pluginlocal type=$1 breaking_marker=$2 scope=$3node $GITHUB_WORKSPACE/automation/github-action/scripts/release.mjs verify $RELEASE_VERSION $RELEASE_SHA $CLI_INTEGRI...node --experimental-strip-types --test --test-reporter=tap tests/test_helper_files.tsnode --experimental-strip-types --test evals/secret-discovery/test_*.mtsnode --experimental-strip-types --test evals/standard-time-budget/test_*.mtsnode --experimental-strip-types --test evals/workflow-routing/test_*.mtsnode --experimental-strip-types --test plugins/codex-security/mcp-app/scripts/test_host_build.mtsnode --experimental-strip-types ../../../sdk/typescript/scripts/run-mcp-test-shard.mts $EXPR $EXPRnode --experimental-strip-types scripts/run-ci-tests.mts $EXPR ${{ runner.os == Linuxnode --experimental-strip-types scripts/run-ci-tests.mts $EXPR/3node --experimental-strip-types scripts/run-ci-tests.mts $EXPR/6 --seed=$EXPR ${{ matrix.os == ubuntu-latestnode --experimental-strip-types sdk/typescript/scripts/check-devcontainer-cooldown.mtsnode --experimental-strip-types sdk/typescript/scripts/compare-test-reports.mts ${baseline_reports[@]} -- ${expanded_...node --experimental-strip-types sdk/typescript/scripts/run-ci-tests.mts $EXPR/14 --seed=$EXPRnode --import tsx --test tests/*.test.*node --import tsx scripts/check-metadata.tsnode --import tsx scripts/cli-integration.tsnode --input-type=module --eval 'node --input-type=module --eval 'const sdk = await import("@openai/codex-security")node --run test:deterministicnode .github/scripts/check-ci-results.mjsnode .github/scripts/check_plugin_source_compatibility.mjs
Review prompts
most discussed first