.hexcheck.yaml RawHistoryFolder
1version: 1
2components:
3 domain:
4 role: core
5 paths:
6 - internal/domain/**
7 usecase:
8 role: usecase
9 paths:
10 - internal/usecase/**
11 ports:
12 role: ports
13 paths:
14 - internal/ports/**
15 adapters:
16 role: adapter
17 paths:
18 - internal/adapters/**
19 clientlimit:
20 # Per-client HTTP rate limiting: infrastructure shared by the HTTP adapters.
21 role: adapter
22 paths:
23 - internal/clientlimit/**
24 httprange:
25 # Byte-range selection: infrastructure shared by the HTTP adapters.
26 role: adapter
27 paths:
28 - internal/httprange/**
29 mediapolicy:
30 # Video host validation and CSP sources: shared HTTP infrastructure.
31 role: adapter
32 paths:
33 - internal/mediapolicy/**
34 entrypoints:
35 # cmd/ermite only calls app.Run.
36 role: entrypoint
37 paths:
38 - cmd/**
39 app:
40 # Composition root and CLI: builds the adapters and wires them to the use
41 # cases. hexcheck has no dedicated bootstrap role; entrypoint is the
42 # closest.
43 role: entrypoint
44 paths:
45 - internal/app/**
46 config:
47 role: entrypoint
48 paths:
49 - internal/config/**
50 generated:
51 role: ignore
52 paths:
53 - gen/**
54 - '**/mocks/**'
55 - '**/*_templ.go'
56 readertest:
57 # Test-only fixtures and conformance suite for ports.RepoReader.
58 role: ignore
59 paths:
60 - internal/readertest/**
61# Cross-layer contracts live in ports: adapters and use cases import ports and
62# domain, never each other. hexcheck has no rule for an adapter importing a use
63# case or internal/app; internal/boundary/boundary_test.go enforces the full
64# import matrix.
65rules:
66 no-adapter-imports-in-core: error
67 no-infra-imports-in-usecase: error
68 no-framework-types-in-core: error
69 no-infra-types-in-ports: error
70 no-adapter-to-adapter-imports: warn
71 suspicious-business-logic-in-adapter: warn
72 no-local-fakes-for-ports: warn
73 missing-generated-mock-for-port: warn
74 prefer-generated-mocks: warn
75mocking:
76 generatedMockPaths:
77 - internal/ports/mocks/**
78 generatedMockNamePatterns:
79 - '{{Interface}}'
80allow:
81 # Secret-source exclusivity and file decoding are configuration validation,
82 # not domain policy; config is intentionally a composition-root helper.
83 - rule: suspicious-business-logic-in-adapter
84 path: internal/config/config.go
85 reason: validates explicit environment and secret-file sources at startup
86 # clientlimit is a shared infrastructure library, not a sibling adapter: the
87 # HTTP adapters that rate-limit clients import it by design.
88 - rule: no-adapter-to-adapter-imports
89 path: internal/adapters/githttp/**
90 reason: rate-limits Git clients with internal/clientlimit
91 - rule: no-adapter-to-adapter-imports
92 path: internal/adapters/githubapi/**
93 reason: rate-limits the clients of the REST subset with internal/clientlimit and selects byte ranges with internal/httprange
94 - rule: no-adapter-to-adapter-imports
95 path: internal/adapters/oidchttp/**
96 reason: rate-limits the clients of the OIDC token endpoint with internal/clientlimit
97 - rule: no-adapter-to-adapter-imports
98 path: internal/adapters/rpc/**
99 reason: rate-limits API clients with internal/clientlimit
100 - rule: no-adapter-to-adapter-imports
101 path: internal/adapters/web/**
102 reason: rate-limits login attempts with internal/clientlimit, selects byte ranges with internal/httprange and shares video hosts with internal/mediapolicy
103
104 - rule: no-adapter-to-adapter-imports
105 path: internal/adapters/httpserver/**
106 reason: shares external video hosts and CSP sources with internal/mediapolicy