Built from main at 1d902a0 on 2026-11-14

Support matrix

What project_validator checks for each ecosystem, and the tools it recognises for it, generated from the registry by python -m project_validator --support-matrix. A cell lists the tools the check recognises; ✓ means the check applies without naming tools; — means it does not apply. A tool several ecosystems share (CodeQL, osv-scanner, lizard) is listed once below the table with the ecosystems it reads, and ↓ stands for it in a cell it alone fills.

Check Ansible BEAM C/C++ Clojure Common Lisp Dart Data Docker Documentation site .NET Emacs Lisp Fortran GitHub Action Go GraphQL Haskell JavaScript/TypeScript JSON Schema Julia Jupyter JVM Kubernetes LaTeX Lua Nix OCaml OpenAPI/AsyncAPI Perl PHP Protobuf Python R Racket Ruby Rust Scala Shell SQL Swift Tabular data Terraform Typst XML schemas Zig
ci-build-types — — ✓ — — — — — — — — ✓ — — — — — — — — — — — — — — — — — — — — — — ✓ — — — ✓ — — — — ✓
code-formatting — mix format, erlfmt clang-format cljfmt, cljstyle, zprint — dart format — — — dotnet format, CSharpier, Fantomas — fprettify — gofmt ↓ ormolu, fourmolu, stylish-haskell deno fmt, oxfmt, dprint, biome biome JuliaFormatter, Runic ruff format, nbqa black Spotless, fmt-maven-plugin, google-java-format, ktfmt, ktlint — latexindent StyLua nixfmt, alejandra, nix fmt ocamlformat — perltidy PHP-CS-Fixer, PHP_CodeSniffer, Pint buf format ruff format, black styler, air raco fmt RuboCop, Standard, syntax_tree rustfmt scalafmt shfmt sqlfluff, sqlfmt swift-format, SwiftFormat — terraform fmt typstyle, typstfmt ↓ zig fmt
committed-artifacts — ✓ ✓ ✓ ✓ ✓ — — ✓ ✓ ✓ ✓ — ✓ — ✓ ✓ — ✓ ✓ ✓ — ✓ ✓ ✓ ✓ — ✓ ✓ — ✓ ✓ ✓ ✓ ✓ ✓ — ✓ ✓ — ✓ — — ✓
compile-commands — — ✓ — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —
compiler-warnings — ✓ ✓ ✓ ✓ ✓ — — — ✓ ✓ ✓ — ✓ — ✓ ✓ — ✓ — ✓ — ✓ ✓ ✓ ✓ — ✓ ✓ — ✓ ✓ — ✓ ✓ ✓ ✓ — ✓ — — — — —
coverage — mix test --cover, excoveralls, rebar3 cover gcovr, lcov, gcov, llvm-cov, gcc -fcondition-coverage, gcc -fpath-coverage, clang -fcoverage-mcdc cloverage sb-cover dart test --coverage — — — coverlet, Microsoft code coverage undercover.el gcovr, lcov, gcov — go test -cover — HPC c8, nyc, Jest, Vitest, deno test, node --test, bun test — julia --code-coverage — JaCoCo, Kover — — luacov — bisect_ppx — Devel::Cover PHPUnit — coverage.py, pytest-cov covr raco cover SimpleCov cargo-llvm-cov, cargo-tarpaulin, grcov, rustc MC/DC scoverage, sbt-jacoco kcov, Pester — swift test, Xcode — — — — kcov
cxx-extensions — — ✓ — — — — — — — — ✓ — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —
data-wellformed — — — — — — ✓ ✓ — — — — — — — — — — — ✓ — — — — — — — — — — — — — — — — — — — — — — — —
dependency-audit — mix_audit — nvd-clojure, clj-watson — ↓ — grype, Docker Scout — NuGet audit of every package, dotnet list package --vulnerable — — — govulncheck — cabal-audit npm audit, pnpm audit, yarn npm audit, bun audit, yarn audit — — — OWASP dependency-check — — — — — — cpan-audit composer audit, roave/security-advisories — pip-audit, safety — — bundler-audit cargo audit, cargo deny sbt-dependency-check — — ↓ — — — — —
dependency-management — ✓ ✓ — — ✓ — — — ✓ — ✓ — ✓ — ✓ ✓ — — — ✓ — — — — — — — ✓ — ✓ — — ✓ ✓ — — ✓ ✓ — ✓ — — —
function-limits — ↓ clang-tidy's readability-function-size — — ↓ — — — ↓ — ↓ — golangci-lint's funlen — — eslint's max-lines-per-function — — — Checkstyle's MethodLength, detekt's LongMethod — — ↓ — — — ↓ PHPMD's ExcessiveMethodLength — ↓ ↓ — RuboCop's Metrics/MethodLength ↓ ↓ — — SwiftLint's function_body_length — — — — ↓
fuzz-testing — — libFuzzer, AFL++ — — — — — — SharpFuzz — — — go test -fuzz — — Jazzer.js — — — Jazzer — — — — — — — — — atheris — — — cargo-fuzz — — — libFuzzer — — — — —
hardening — — ✓ — — — — — — — — ✓ — ✓ — — — — — — — — — — — — — — — — — — — — ✓ — — — ✓ — — — — ✓
link-check — — — — — — — — lychee, markdown-link-check, linkinator, muffet, htmltest, HTMLProofer, LinkChecker, sphinx linkcheck, mdbook-linkcheck, mkdocs-htmlproofer-plugin — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —
migration-safety — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — squawk, atlas migrate lint, liquibase checks — — — — — —
mutation-testing — — Mull, dextool mutate — — — — — — Stryker.NET — — — gremlins, go-mutesting — — StrykerJS — — — PIT — — — — — — — Infection — mutmut, cosmic-ray, mutatest — — mutant cargo-mutants — — — Muter — — — — —
out-of-source-build — — ✓ — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —
platform-matrix — ✓ ✓ ✓ ✓ ✓ — — — ✓ ✓ ✓ — ✓ — ✓ ✓ — ✓ — ✓ — — ✓ ✓ ✓ — ✓ ✓ — ✓ ✓ ✓ ✓ ✓ ✓ — ✓ ✓ — ✓ — — ✓
sanitizers — — ✓ — — — — — — — — — — ✓ — — — — — — — — — — — — — — — — — — — — ✓ — — — — — — — — —
schema-compatibility — — — — — — — — — — — — — — graphql-inspector, rover — — json-schema-diff — — — — — — — — oasdiff, openapi-diff — — buf breaking — — — — — — — — — — — — — —
schema-declared — — — — — — — — — — — — — — — — — ✓ — — — — — — — — ✓ — — ✓ — — — — — — — — — ✓ — — ✓ —
schema-examples — — — — — — — — — — — — — — — — — check-jsonschema, ajv, jsonschema, jv — — — — — — — — spectral, redocly, vacuum, schemathesis, dredd — — — — — — — — — — — — — — — xmllint, jing —
schema-validation — — — — — — — — — — — — — — graphql-inspector, graphql-codegen — — check-jsonschema, ajv, jsonschema, jv — — — kubeconform, kubeval, helm lint --strict — — — — spectral, redocly, vacuum, swagger-cli, openapi-generator, asyncapi — — buf build, protoc — — — — — — — — — frictionless, goodtables, csvlint — — xmllint, jing, SchXslt —
security-scanning ansible-lint Sobelow ↓ ↓ — ↓ — hadolint — .NET security analyzers — — zizmor gosec, golangci-lint's gosec — — eslint-plugin-security — ↓ — Find Security Bugs, PMD security rules kube-linter, polaris, kyverno, kube-score — ↓ — ↓ — — Psalm taint analysis, phpcs-security-audit — bandit, ruff's bandit rules — — brakeman, RuboCop Security cops unsafe_code forbidden ↓ — — ↓ — terrascan, tfsec — — —
static-analysis ansible-lint Credo, elvis, rebar3 xref clang-tidy, cppcheck clj-kondo sblint dart analyze, custom_lint, DCM — hadolint markdownlint, vale Roslynator, SonarAnalyzer, StyleCop.Analyzers, Meziantou.Analyzer, FSharpLint package-lint, checkdoc fortitude actionlint golangci-lint graphql-schema-linter, graphql-eslint hlint, weeder, stan eslint, oxlint, deno lint, biome — — ruff check SpotBugs, PMD, Checkstyle, detekt, Error Prone helm lint, chart-testing, kube-linter, polaris, kyverno, kube-score chktex, lacheck luacheck, selene statix, deadnix — spectral, redocly, vacuum, swagger-cli, openapi-generator, asyncapi perlcritic PHPStan, Psalm, PHPMD, Phan buf lint ruff check, pylint, flake8 lintr — RuboCop, Standard, Reek clippy scalafix shellcheck, PSScriptAnalyzer sqlfluff, squawk, sqlc vet, tsqllint, dbt parse SwiftLint — terraform validate, tflint, terrascan, tfsec — — —
tests-run molecule, ansible-test mix test, rebar3 eunit or rebar3 ct ctest, meson test clojure.test asdf:test-system dart test — — MkDocs build, Sphinx build, Docusaurus build, mdBook build, Hugo build, Jekyll build dotnet test ERT ctest, meson test, fpm test the action's own workflow go test — cabal test a JavaScript test runner — Pkg.test notebook execution mvn test or gradle test helm-unittest, helm test latexmk busted nix flake check dune test — prove phpunit, pest or composer test — pytest, unittest, nox R CMD check raco test rspec, rake test or rails test cargo test sbt test, mill __.test, scala-cli test bats, shellspec, shunit2, Pester dbt test, pg_prove swift test or xcodebuild test — terraform test typst compile XSpec zig build test
top-level-guard — — ✓ — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —
type-checking — Dialyzer, eqWAlizer — — — — — — — — — — — — — — tsc, deno check — JET.jl — — — — lua-language-server, luau-analyze — — — — PHPStan, Psalm — mypy, pyright, pyrefly, ty — — Sorbet, Steep — — — — — — — — — —
vcs-ignore — ✓ ✓ ✓ ✓ ✓ — — ✓ ✓ ✓ ✓ — ✓ — ✓ ✓ — ✓ ✓ ✓ — ✓ ✓ ✓ ✓ — ✓ ✓ — ✓ ✓ ✓ ✓ ✓ ✓ — ✓ ✓ — ✓ — — ✓
warnings-as-errors — ✓ ✓ ✓ ✓ ✓ — — ✓ ✓ ✓ ✓ — — — ✓ ✓ — ✓ — ✓ — — — ✓ ✓ — ✓ ✓ — — ✓ — — — ✓ ✓ — ✓ — — — — —

Tools of several ecosystems, once for all the cells they fill:

Checks of every project, whatever its languages: action-pinning, ci-lint, ci-present, copy-paste-detection, dependency-updates, large-files, license, secret-scanning, security-policy, status-badges.