// Validate metadata fields (author, source, category) in opengrep/semgrep YAML rule files. Use when the user wants to lint or check rule quality.
| name | check-rule-metadata |
| description | Validate metadata fields (author, source, category) in opengrep/semgrep YAML rule files. Use when the user wants to lint or check rule quality. |
| argument-hint | [dirs] |
| allowed-tools | Bash(node *) |
Validate metadata fields in opengrep/semgrep YAML rule files to ensure compliance with project standards.
Run from the project root:
# Default directories (assets/opengrep_rules/services + client)
node run.js ./src/checkRuleMetadata.js
# Custom directories
node run.js ./src/checkRuleMetadata.js --dirs="assets/opengrep_rules/services,assets/opengrep_rules/client"
# Non-exit mode (returns result object instead of calling process.exit)
node run.js ./src/checkRuleMetadata.js --exitOnError=false
Or via npm script:
npm run lint-rules
| Parameter | Required | Default | Description |
|---|---|---|---|
--dirs | No | assets/opengrep_rules/services,assets/opengrep_rules/client | Comma-separated directory paths to scan |
--basePath | No | process.cwd() | Base path for relative directory resolution |
--exitOnError | No | true | Call process.exit on completion |
Each YAML rule file is checked for:
metadata.author -- must be presentmetadata.source -- must match the expected GitHub URL patternmetadata.category -- must be one of: security, correctness, privacyWhen exitOnError=false, returns { success: boolean, errors: string[] }. Otherwise calls process.exit(0) or process.exit(1).
run.js entry point automatically loads .env credentials*.test.yaml) are skippedAuto-detect top maintainers for each repo in an org and set the maintainers custom property via the GitHub API. Use when the user wants to populate or update maintainer metadata.
Clean up stale security-action Slack messages based on review signals (reactions, label removal, resolved threads). Use when the user wants to clean old notifications from a Slack channel.
Delete Slack messages from a channel filtered by bot username and repository names. Use when the user wants to bulk-delete bot messages for specific repos.
Auto-dismiss Dependabot alerts matching configurable hotwords (e.g. DoS) or a GHSA/CVE dismiss list. Use when the user wants to bulk-dismiss low-priority Dependabot alerts.
Scan org repos for open Dependabot alerts at or above a severity threshold and build notification messages for maintainers. Use when the user wants to check or nudge about Dependabot vulnerabilities.
Fetch and parse a JSON config file from a GitHub repository. Use when the user wants to read a configuration file from a remote repo.