ALL-WAIV0001 · waiver_debt
Count quality waivers that lack a current bounded justification.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Count inline lint, typing, coverage, security, architecture, and MCMR suppressions that are
expired, older than the configured age, overly broad, missing a creation date, or missing
configured metadata. The rule judges waiver hygiene rather than repeating the diagnostic. A
waiver justifies itself where it is written, so its age comes from a since field and its
expiry from an expires field, each written as an ISO date on the suppression line itself.
Evidence
Section titled “Evidence”Findings retain the waiver kind, scope, available structured metadata, age problem, and source
location. Metadata is a run of key=value fields written after the marker, each value running
to the next field name, so a reason may hold spaces without being quoted.
Exceptions
Section titled “Exceptions”Permanent third-party compatibility gaps may remain when narrowly scoped and supported by a
current upstream reference. Repository Git ignores decide which source files exist before
this rule runs. required_metadata names the fields a suppression comment has to carry,
defaulting to a reason, and maximum_age_days is how long one may live before it counts as
debt.
Examples
Section titled “Examples”Two blanket ignores and one expired security waiver produce 3. A narrow, dated suppression
with a reason does not count. A permanent compatibility waiver also needs an upstream URL.
References
Section titled “References”- Generalizes Ruff PGH004 blanket-noqa
- Generalizes Ruff PGH003 blanket-type-ignore
- Cites “OpenSSF Scorecard”, dangerous workflow and token permission checks