Skip to content

fix: reduce high-volume precision false positives - #77

Merged
alxxjohn merged 1 commit into
mainfrom
fix/v132-false-positive-hardening-followup
Jul 28, 2026
Merged

fix: reduce high-volume precision false positives#77
alxxjohn merged 1 commit into
mainfrom
fix/v132-false-positive-hardening-followup

Conversation

@alxxjohn

Copy link
Copy Markdown
Contributor

Summary

This PR reduces high-volume false positives from the v1.3.2 CodeGuard report by hardening precision detectors instead of adding waivers. It focuses
on React/React-hook boundaries, command functions that return useful results, duplicated-knowledge noise, persistence-boundary interpretation,
structural smell precision, and noisy TypeScript/JavaScript naming conventions.

What changed

  • Treats React components and named hooks as UI/state boundaries for hidden mutation and hidden side-effect checks.

  • Keeps nested non-hook functions reportable when they hide real persistence/collaborator mutation.

  • Allows command-style functions that write and return useful results, including create*, update*, upload*, notify*, record*, and submit*.

  • Filters duplicated-knowledge noise from small numeric literals and enum/status-style option strings.

  • Preserves duplicated-knowledge findings for stronger domain literals and larger domain-significant numbers.

  • Allows packages/api/src/** as an API/persistence implementation boundary.

  • Ignores persistence vocabulary that appears only in inline comments.

  • Suppresses message-chain noise from optional chaining, API response traversal, config traversal, and row/DTO mapper traversal.

  • Suppresses feature-envy noise for mapper/builder/formatter DTO-style reads from row, args, payload, etc.

  • Adds naming/cardinality allowances for common TypeScript/JavaScript conventions such as opts, message, className, Icon, submit, compare, parser,
    answers, contracts, matters, risks, sections, and columns.

  • Splits duplicated-knowledge precision helpers into a dedicated file to keep quality_precision.go under design-size limits.

Tests

Added regression coverage for:

  • React component and hook boundary false positives.
  • Commands that mutate and return useful results.
  • Small numeric and enum/status duplicated-knowledge suppression.
  • packages/api/src/** persistence-boundary handling.
  • API/config/optional-chain traversal suppression.
  • DTO mapper/builder feature-envy suppression.
  • Expanded naming and cardinality conventions.
  • Positive cases that should still emit for hidden mutation, command/query mix, persistence leak, and structural smells.

Validation

  • go test ./tests/checks -count=1
  • go test ./...
  • golangci-lint run
  • make codeguard-ci

All passed.

@alxxjohn
alxxjohn merged commit 4cdd646 into main Jul 28, 2026
16 checks passed
@alxxjohn
alxxjohn deleted the fix/v132-false-positive-hardening-followup branch July 28, 2026 02:30
alxxjohn added a commit that referenced this pull request Jul 28, 2026
🤖 I have created a release *beep* *boop*
---


##
[1.3.3](v1.3.2...v1.3.3)
(2026-07-28)


### Bug Fixes

* reduce high-volume precision false positives
([cb19b29](cb19b29))
* reduce high-volume precision false positives
([#77](#77))
([4cdd646](4cdd646))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant