Static analysis
3 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
semgrep |
Security scanning | semgrep scan --quiet --sarif --config auto --exclude playground --exclude __t... |
ci | .github/workflows/semgrep.yml |
tsc |
Type checking | tsc -p scriptstsc |
ci, local | .github/workflows/ci.yml package.json playground/package.json docs/package.json |
zizmor |
CI workflow linting | uses zizmorcore/zizmor-action |
ci | .github/workflows/zizmor.yml |
Testing
2 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
ci-matrix |
Version and platform matrix | test (os: 1, node_version: 4, include: 2) |
ci | .github/workflows/ci.yml |
vitest |
Unit and integration tests | vitest runvitest run -c vitest.config.e2e.ts |
ci, local | .github/workflows/ci.yml package.json |
5 other commands the scanner could not classify
Commands from CI steps and task runners that look like checks but match no known tool. Some are checks, some are not.
node scripts/detect-release.ts $(git log -1 --format=%s) >> $GITHUB_OUTPUToxfmtoxlint .vitepress devvitepress serve
Review prompts
most discussed first