.hexcheck.yaml RawHistoryFolder

1version: 1
2components:
3  domain:
4    role: core
5    paths:
6      - internal/domain/**
7  usecase:
8    role: usecase
9    paths:
10      - internal/usecase/**
11  ports:
12    role: ports
13    paths:
14      - internal/ports/**
15  adapters:
16    role: adapter
17    paths:
18      - internal/adapters/**
19  clientlimit:
20    # Per-client HTTP rate limiting: infrastructure shared by the HTTP adapters.
21    role: adapter
22    paths:
23      - internal/clientlimit/**
24  httprange:
25    # Byte-range selection: infrastructure shared by the HTTP adapters.
26    role: adapter
27    paths:
28      - internal/httprange/**
29  entrypoints:
30    # cmd/ermite only calls app.Run.
31    role: entrypoint
32    paths:
33      - cmd/**
34  app:
35    # Composition root and CLI: builds the adapters and wires them to the use
36    # cases. hexcheck has no dedicated bootstrap role; entrypoint is the
37    # closest.
38    role: entrypoint
39    paths:
40      - internal/app/**
41  config:
42    role: entrypoint
43    paths:
44      - internal/config/**
45  generated:
46    role: ignore
47    paths:
48      - gen/**
49      - '**/mocks/**'
50      - '**/*_templ.go'
51  readertest:
52    # Test-only fixtures and conformance suite for ports.RepoReader.
53    role: ignore
54    paths:
55      - internal/readertest/**
56# Cross-layer contracts live in ports: adapters and use cases import ports and
57# domain, never each other. hexcheck has no rule for an adapter importing a use
58# case or internal/app; internal/boundary/boundary_test.go enforces the full
59# import matrix.
60rules:
61  no-adapter-imports-in-core: error
62  no-infra-imports-in-usecase: error
63  no-framework-types-in-core: error
64  no-infra-types-in-ports: error
65  no-adapter-to-adapter-imports: warn
66  suspicious-business-logic-in-adapter: warn
67  no-local-fakes-for-ports: warn
68  missing-generated-mock-for-port: warn
69  prefer-generated-mocks: warn
70mocking:
71  generatedMockPaths:
72    - internal/ports/mocks/**
73  generatedMockNamePatterns:
74    - '{{Interface}}'
75allow:
76  # Secret-source exclusivity and file decoding are configuration validation,
77  # not domain policy; config is intentionally a composition-root helper.
78  - rule: suspicious-business-logic-in-adapter
79    path: internal/config/config.go
80    reason: validates explicit environment and secret-file sources at startup
81  # clientlimit is a shared infrastructure library, not a sibling adapter: the
82  # HTTP adapters that rate-limit clients import it by design.
83  - rule: no-adapter-to-adapter-imports
84    path: internal/adapters/githttp/**
85    reason: rate-limits Git clients with internal/clientlimit
86  - rule: no-adapter-to-adapter-imports
87    path: internal/adapters/githubapi/**
88    reason: rate-limits the clients of the REST subset with internal/clientlimit and selects byte ranges with internal/httprange
89  - rule: no-adapter-to-adapter-imports
90    path: internal/adapters/oidchttp/**
91    reason: rate-limits the clients of the OIDC token endpoint with internal/clientlimit
92  - rule: no-adapter-to-adapter-imports
93    path: internal/adapters/rpc/**
94    reason: rate-limits API clients with internal/clientlimit
95  - rule: no-adapter-to-adapter-imports
96    path: internal/adapters/web/**
97    reason: rate-limits login attempts with internal/clientlimit and selects byte ranges with internal/httprange