Improve C6 1

Improve C6.1 — Static Analysis

Current State

Language detection

!ls package.json 2>/dev/null && echo "Node/TypeScript" || true !ls pyproject.toml setup.py requirements.txt 2>/dev/null && echo "Python" || true !ls pom.xml build.gradle 2>/dev/null && echo "Java" || true !ls go.mod 2>/dev/null && echo "Go" || true !ls Cargo.toml 2>/dev/null && echo "Rust" || true

Linting config

!ls .eslintrc .eslintrc.js .eslintrc.cjs .eslintrc.json .eslintrc.yml eslint.config.js eslint.config.mjs .prettierrc .prettierrc.js prettier.config.js 2>/dev/null || echo "(no ESLint/Prettier)" !ls .pylintrc .flake8 ruff.toml .ruff.toml 2>/dev/null || grep "\[tool.ruff\]\|\[tool.flake8\]\|\[tool.pylint\]" pyproject.toml 2>/dev/null | head -3 || echo "(no Python linting)" !ls .golangci.yml .golangci.yaml 2>/dev/null || echo "(no Go linting)" !ls .rubocop.yml 2>/dev/null || echo "(no Ruby linting)"

Type checking

!ls tsconfig.json 2>/dev/null || echo "(no tsconfig)" !cat tsconfig.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); o=d.get('compilerOptions',{}); print('strict:', o.get('strict'), 'noImplicitAny:', o.get('noImplicitAny'))" 2>/dev/null || true !ls mypy.ini .mypy.ini 2>/dev/null || grep "\[tool.mypy\]" pyproject.toml 2>/dev/null | head -2 || echo "(no mypy)"

Security scanning

!ls .snyk sonar-project.properties .semgrep.yml 2>/dev/null || echo "(no SAST config)" !find .github/workflows/ -name "*.yml" 2>/dev/null | xargs grep -l "codeql\|snyk\|semgrep\|trivy\|bandit" 2>/dev/null | head -3 || echo "(no SAST in CI)"

package.json scripts (for adding lint scripts)

!cat package.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print('scripts:', list(d.get('scripts',{}).keys())); print('devDeps:', list(d.get('devDependencies',{}).keys()))" 2>/dev/null || true

Instructions

Step 1 — Determine current level:

• Level 0: No quality tooling
• Level 1: Linting and/or formatting configured
• Level 2: + Type checking enforced
• Level 3: + Security scanning (SAST)

Step 2 — Implement the improvement:

If current level is 0 → raise to 1: Add linting appropriate to the detected language:

• Node.js/TypeScript: Add ESLint + Prettier.

  1. Add to package.json devDependencies: eslint, @eslint/js, prettier, eslint-config-prettier
  2. Create eslint.config.mjs with sensible defaults for the detected framework
  3. Create .prettierrc with standard formatting rules
  4. Add scripts: "lint": "eslint src/" and "format": "prettier --write src/"

• Python: Add Ruff (covers linting + formatting in one tool).

  1. Create ruff.toml or add [tool.ruff] section to pyproject.toml
  2. Configure standard rules (E, F, I at minimum)
  3. Add to Makefile or pyproject.toml scripts: lint: ruff check .

• Go: Add golangci-lint.

  1. Create .golangci.yml with standard linters (errcheck, gosimple, govet, staticcheck)
  2. Add lint step comment to Makefile if present

• Java: Add Checkstyle config if using Maven/Gradle.

If current level is 1 → raise to 2: Add type checking appropriate to the detected language:

• TypeScript (package.json exists, tsconfig.json missing): Create tsconfig.json with:

  { "compilerOptions": { "strict": true, "noImplicitAny": true, ... } }
  

  Add "typecheck": "tsc --noEmit" to package.json scripts.

• TypeScript (tsconfig.json exists but not strict): Edit tsconfig.json to add "strict": true to compilerOptions. Fix any immediate type errors if they are simple. Add "typecheck": "tsc --noEmit" script if missing.

• Python: Create mypy.ini or add [tool.mypy] to pyproject.toml with strict = true or at minimum disallow_untyped_defs = true. Add lint step: mypy src/.

• Go: Go has built-in type checking — note that go vet enforces this. Add a vet step to Makefile if not present.

If current level is 2 → raise to 3: Add security scanning via GitHub Actions CodeQL (works for most languages, requires no external account):

1. Create .github/workflows/codeql.yml:

name: CodeQL
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1'
jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: [detected-language]
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3

Replace [detected-language] with the appropriate CodeQL language identifier (javascript, python, java, go, etc.).

If already at level 3: Report that C6.1 is already at its maximum level (3) and no improvement is needed.

Step 3 — Report: State what files were created or modified, the before and after level.