Skip to main content

Fixtures & validation

Every new rule needs two small files: one that must match, one that must not. What you will do: drop fixtures under testdata/rules/<rule-id>/, then run make lint-rules.

Layout

Use the full rule id as the folder name (example: js.crypto.createcipheriv.aes).

What good fixtures look like

Positive: one real call site, nothing else.
Negative: the same text only in a comment, or a lookalike that is not the crypto API.
Same idea for C: a real RSA_generate_key_ex(...) vs the name only in /* ... */.

Commands

Regenerate goldens only on purpose:
Review that diff. Do not accept it blindly.
make lint-rules currently requires fixtures for the flagship Go RSA rule. Still add positive and negative fixtures for every rule you ship. That is what keeps false positives out of other people’s CI.