Sanity check clean

[joejstuart]

No description provided.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 38b336be-fbc3-4b71-8f05-f537cbdf8d52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

You can enable review details to help with troubleshooting, context usage and more.

Enable the reviews.review_details setting to include review details such as the model used, the time taken for each step and more in the review comments.

[qodo-code-review]

Review Summary by Qodo

Comprehensive code quality, refactoring, and documentation initiative with automated sanity checks

✨ Enhancement 📝 Documentation

Walkthroughs

Description

  **Code Quality and Refactoring Initiative**
• **Comprehensive refactoring** of 10+ core modules to improve code readability and maintainability
  by extracting large methods into focused helper functions with early returns and reduced nesting
• **Simplified function signatures** by removing unnecessary error returns from 6+ functions that
  cannot fail, reducing error handling complexity
• **Established code quality standards** with new documentation including CODE_STYLE.md,
  PRINCIPLES.md, ARCHITECTURE.md, and REVIEW.md to guide future contributions
• **Created detailed design documentation** for rule filtering, package filtering, and VSA
  architecture subsystems with comprehensive API references and examples
• **Implemented automated quality checks** via new make sanity targets and postconditions
  submodule integration for continuous code quality validation
• **Added baseline metrics and tracking** with quality reports documenting current complexity
  budgets, technical debt, and improvement roadmap
• **Introduced Architecture Decision Records (ADRs)** framework with template and first ADR
  documenting CGO disabled build decision
• **Relaxed test-specific linting rules** to allow pragmatic test code while maintaining strict
  production code standards
• **Enhanced agent/Claude instructions** with mandatory workflow requirements and documentation
  references for consistent code contributions

Diagram

flowchart LR
  A["Code Refactoring<br/>10+ modules"] --> B["Improved Readability<br/>Helper methods<br/>Early returns"]
  C["Simplified Signatures<br/>Remove error returns"] --> B
  D["Documentation<br/>CODE_STYLE<br/>PRINCIPLES<br/>ARCHITECTURE"] --> E["Quality Standards<br/>Established"]
  F["Design Docs<br/>Rule Filtering<br/>VSA Architecture"] --> E
  G["Automated Checks<br/>make sanity<br/>postconditions"] --> H["Continuous<br/>Quality Validation"]
  E --> H
  B --> H
  I["Baseline Metrics<br/>Tech Debt Tracker<br/>ADRs"] --> H

Loading

File Changes

1. cmd/validate/image.go Refactoring +222/-179

Refactor image validation command for improved readability

• Extracted large inline code blocks into focused helper methods (buildPolicyOptions,
 validateVSAConfig, validateComponent, createEvaluators, injectExtraRuleData,
 generateVSAsIfEnabled)
• Simplified error handling with early returns instead of nested if-else blocks
• Refactored VSA upload logic to reduce nesting and improve readability

cmd/validate/image.go

---

2. internal/validate/vsa/rekor_retriever.go Refactoring +221/-145

Decompose Rekor entry classification and signature handling

• Added entry type constants (entryTypeIntoto, entryTypeIntotoV002, entryTypeDSSE,
 entryTypeUnknown)
• Decomposed classifyEntryKind method into smaller focused methods (classifyFromKindField,
 classifyIntotoVersion, classifyFromSpecStructure, classifyFromLegacyFormat,
 classifyFromAttestation)
• Extracted signature conversion logic into helper functions (convertSignatures,
 convertSignature, extractSignatureValue, decodeSignatureBytes)
• Extracted payload validation logging into helper functions (debugLogPayloadValidation,
 logInvalidBase64Payload)

internal/validate/vsa/rekor_retriever.go

---

3. internal/evaluator/conftest_evaluator.go Refactoring +137/-107

Extract policy inspection logic into focused methods

• Added constants for severity and category values (categoryException, categorySkipped)
• Extracted policy source inspection into inspectPolicySources method with helper methods
 (enhanceInspectError, collectRulesFromAnnotations)
• Created inspectionResult struct to hold inspection results
• Refactored Evaluate method to use the new inspection method, reducing complexity
• Simplified maybeRemoveStaleEffectiveOn function with early returns

internal/evaluator/conftest_evaluator.go

---

View more (50)

4. internal/policy/policy.go Refactoring +176/-105

Refactor policy loading and verification setup

• Extracted policy loading logic into loadPolicyFromYAML and loadPolicyFromK8s methods
• Created validateConformance helper method for schema validation
• Decomposed checkOpts into focused methods (setupVerification, setupKeyVerification,
 setupKeylessVerification, setupTrustedMaterial, setupFallbackCerts, setupTlog,
 setupRekorClient, setupRekorPubKeys)
• Improved readability by reducing nesting and using early returns

internal/policy/policy.go

---

5. internal/evaluator/filters.go Refactoring +56/-39

Extract legacy score calculation into helper methods

• Extracted LegacyScore logic into helper methods (legacyScoreNameParts,
 legacyScoreSinglePart, legacyScoreMultipleParts)
• Replaced hardcoded string literals with severity and category constants
• Improved code organization and reduced function complexity

internal/evaluator/filters.go

---

6. internal/validate/vsa/result.go Refactoring +69/-56

Decompose VSA result console output formatting

• Extracted PrintConsole method into focused helper methods (printVSAPhaseResult,
 printImageValidationResult, printSummary, printOverallStatus)
• Simplified status determination logic using switch statements
• Improved readability by breaking down complex output formatting

internal/validate/vsa/result.go

---

7. internal/validate/vsa/vsa.go Refactoring +54/-46

Extract child component collection logic

• Added constant predicateStatusPassed for status value
• Extracted child component collection logic into collectChildComponents and createChildDetail
 methods
• Simplified createDetailedSummary method by delegating to helper functions

internal/validate/vsa/vsa.go

---

8. cmd/test/test.go Refactoring +51/-40

Extract test command output handling logic

• Extracted output handling logic into handleOutput, handleAppstudioOutput, and
 handleConftestOutput methods
• Simplified main command logic by delegating output formatting to helper functions
• Improved code organization and readability

cmd/test/test.go

---

9. internal/policy/source/source.go Refactoring +38/-39

Refactor policy cache symlink handling

• Refactored getPolicyThroughCache to simplify symlink logic
• Extracted symlink/download logic into symlinkOrDownload helper method
• Improved readability by reducing nesting and using early returns

internal/policy/source/source.go

---

10. internal/validate/report.go Refactoring +43/-28

Extract report population logic into helper methods

• Extracted output population logic into populateFromOutput method
• Created buildAttestationResults helper method for attestation processing
• Improved code organization and reduced function complexity

internal/validate/report.go

---

11. internal/validate/vsa/errors.go Refactoring +51/-29

Extract VSA error cause building logic

• Extracted VSA error cause building into populateVSAErrorCause and categorizeVSAError methods
• Created populateVSAResultCause helper method
• Improved error categorization logic with switch statement

internal/validate/vsa/errors.go

---

12. internal/evaluation_target/application_snapshot_image/application_snapshot_image.go Refactoring +27/-21

Extract attestation validation logic

• Extracted attestation validation logic into validateAttestation helper method
• Simplified ValidateAttestationSyntax by delegating to helper function
• Improved error handling with early returns

internal/evaluation_target/application_snapshot_image/application_snapshot_image.go

---

13. internal/output/output.go Refactoring +6/-4

Extract pass status message constant

• Added constant messagePass for pass status message
• Replaced hardcoded "Pass" strings with constant reference
• Improved maintainability by centralizing message definitions

internal/output/output.go

---

14. internal/validate/vsa/storage.go Refactoring +44/-22

Extract storage configuration URL parsing logic

• Extracted URL parsing logic into parseConfigURL, normalizeConfigURL, and extractBaseURL
 helper methods
• Simplified ParseStorageFlag by delegating to helper functions
• Improved code organization and readability

internal/validate/vsa/storage.go

---

15. internal/applicationsnapshot/report.go Refactoring +4/-4

Simplify report generation return types

• Changed generateMarkdownSummary return type from ([]byte, error) to []byte (no error
 possible)
• Changed renderAttestations return type from ([]byte, error) to []byte
• Simplified error handling in toFormat method

internal/applicationsnapshot/report.go

---

16. internal/policy/equivalence/equivalence.go Refactoring +3/-6

Simplify policy comparison return type

• Changed compareNormalizedPoliciesWithDifferences return type from `(bool, []PolicyDifference,
 error) to (bool, []PolicyDifference)` (no error possible)
• Simplified method signature and removed unnecessary error handling

internal/policy/equivalence/equivalence.go

---

17. internal/applicationsnapshot/attestation.go Refactoring +6/-7

Simplify attestation rendering return types

• Changed renderAttestations return type from ([]byte, error) to []byte
• Changed attestations return type from ([]in_toto.Statement, error) to []in_toto.Statement
• Simplified error handling in both methods

internal/applicationsnapshot/attestation.go

---

18. cmd/inspect/inspect_policy.go Refactoring +4/-8

Simplify policy filter return type

• Changed filterResults return type from (map[string][]*ast.AnnotationsRef, error) to
 map[string][]*ast.AnnotationsRef
• Removed unnecessary error handling from filter function

cmd/inspect/inspect_policy.go

---

19. internal/validate/vsa/fallback_test.go 🧪 Tests +1/-9

Simplify fallback validation tests

• Removed unused context.Background() variable from TestGetPolicyConfig
• Removed expectedError field from test cases (no error expected)
• Simplified test assertions

internal/validate/vsa/fallback_test.go

---

20. internal/evaluator/conftest_evaluator_unit_data_test.go 🧪 Tests +1/-5

Remove unused context from data test

• Removed unused context.Background() variable
• Removed unused utils.WithFS call
• Updated prepareDataDirs call to remove context parameter

internal/evaluator/conftest_evaluator_unit_data_test.go

---

21. internal/validate/vsa/fallback.go Refactoring +4/-10

Simplify policy config retrieval

• Changed getPolicyConfig return type from (string, error) to string
• Removed error handling from CreateFallbackValidationContext
• Simplified function signature

internal/validate/vsa/fallback.go

---

22. internal/opa/inspect.go Refactoring +3/-6

Simplify OPA inspection return type

• Changed interestingRulesOnly return type from ([]*ast.AnnotationsRef, error) to
 []*ast.AnnotationsRef
• Removed unnecessary error handling

internal/opa/inspect.go

---

23. internal/kubernetes/client.go 📝 Documentation +4/-0

Add duplication linter directives

• Added //nolint:dupl comments to FetchEnterpriseContractPolicy and FetchSnapshot methods
• Documented similar structure between methods

internal/kubernetes/client.go

---

24. internal/rego/sigstore/sigstore.go 📝 Documentation +2/-0

Add duplication linter directives

• Added //nolint:dupl comments to sigstoreVerifyImage and sigstoreVerifyAttestation functions
• Documented similar structure between verification functions

internal/rego/sigstore/sigstore.go

---

25. internal/image/validate.go Refactoring +2/-2

Remove unused context parameter

• Removed unused ctx parameter from determineAttestationTime function
• Simplified function signature

internal/image/validate.go

---

26. internal/applicationsnapshot/attestation_test.go 🧪 Tests +2/-4

Simplify attestation test assertions

• Removed error assertions from TestAttestationReport and TestAttestations
• Simplified test assertions for methods that no longer return errors

internal/applicationsnapshot/attestation_test.go

---

27. internal/image/validate_test.go 🧪 Tests +1/-1

Update attestation time test

• Updated TestDetermineAttestationTime to call function without context parameter

internal/image/validate_test.go

---

28. internal/evaluator/criteria.go 📝 Documentation +1/-0

Add nesting complexity linter directive

• Added //nolint:nestif comment to acceptable nested if statement
• Documented acceptable complexity for criteria matching

internal/evaluator/criteria.go

---

29. internal/applicationsnapshot/report_test.go 🧪 Tests +1/-2

Simplify markdown summary test

• Removed error assertion from Test_GenerateMarkdownSummary
• Simplified test assertion for method that no longer returns error

internal/applicationsnapshot/report_test.go

---

30. cmd/track/track_bundle.go 📝 Documentation +1/-0

Add nesting complexity linter directive

• Added //nolint:nestif comment to acceptable nested if statement
• Documented acceptable complexity for replace with file/OCI handling

cmd/track/track_bundle.go

---

31. benchmark/offliner/referrers.go 📝 Documentation +1/-0

Add nesting complexity linter directive

• Added //nolint:nestif comment to acceptable nested if statement
• Documented acceptable complexity for type assertion with fallback

benchmark/offliner/referrers.go

---

32. internal/validate/vsa/validator.go Refactoring +1/-1

Use predicate status constant

• Updated predicate status comparison to use predicateStatusPassed constant
• Improved consistency with other VSA validation code

internal/validate/vsa/validator.go

---

33. hack/check-docs-freshness.sh 📝 Documentation +51/-0

Add documentation freshness check script

• New script to check for stale documentation references
• Validates that design docs reference existing files
• Compares modification dates between code and documentation
• Provides warnings for potentially outdated documentation

hack/check-docs-freshness.sh

---

34. docs/CODE_STYLE.md 📝 Documentation +147/-0

Add comprehensive code style guide

• New comprehensive code style guide documenting complexity budgets
• Defines cyclomatic complexity limit of 55 (target 12) and nesting depth limit of 4
• Provides examples of anti-patterns (over-abstraction, unnecessary configuration, preemptive error
 handling)
• Provides examples of best practices (early returns, focused functions, pattern matching)
• References Uber Go Style Guide for general Go conventions

docs/CODE_STYLE.md

---

35. docs/design-docs/rule-filtering.md 📝 Documentation +491/-0

Complete rule filtering process design documentation

• Comprehensive design document explaining the rule filtering process in conftest evaluator with 10+
 stages
• Details pre-evaluation filtering using PolicyResolver, post-evaluation filtering with
 UnifiedPostEvaluationFilter
• Documents term extraction, matching, and scoring system with specific point values for different
 matcher types
• Includes real-world examples of term-based filtering and dependency trimming logic

docs/design-docs/rule-filtering.md

---

36. docs/design-docs/vsa-architecture.md 📝 Documentation +542/-0

VSA functionality and architecture design documentation

• Detailed VSA (Verification Summary Attestation) architecture with 9-layer design
• Documents core data structures, interfaces, service layer API, and attestation workflows
• Covers storage backends (local filesystem, Rekor), retrieval mechanisms, and validation with
 policy comparison
• Includes CLI interface, security considerations, and comprehensive API reference

docs/design-docs/vsa-architecture.md

---

37. AGENTS.md 📝 Documentation +82/-230

Streamlined agent instructions with documentation links

• Condensed from 243 to 95 lines, focusing on essential quick reference information
• Replaced detailed architecture sections with links to dedicated documentation files
• Simplified to quick build/test commands and key constraints
• Added documentation map table pointing to relevant design docs and principles

AGENTS.md

---

38. docs/design-docs/package-filtering.md 📝 Documentation +337/-0

Package filtering system design and architecture guide

• New design document for pluggable rule filtering system architecture
• Explains PolicyResolver interface, ECPolicyResolver, and IncludeExcludePolicyResolver
 implementations
• Documents scoring system, term-based filtering, and integration with conftest evaluator
• Provides guidance on adding new filters and migration from old system

docs/design-docs/package-filtering.md

---

39. docs/ARCHITECTURE.md 📝 Documentation +89/-0

High-level architecture overview and layer dependencies

• New high-level architecture overview document with module structure and layer dependencies
• Defines allowed and forbidden dependencies between packages
• References design docs for policy evaluation and VSA subsystems
• Establishes clear layer boundaries and import rules

docs/ARCHITECTURE.md

---

40. CLAUDE.md 📝 Documentation +61/-12

Enhanced Claude Code guidance with mandatory workflow

• Simplified from 14 lines to 63 lines with mandatory workflow guidance
• Added explicit requirements for reading PRINCIPLES.md, CODE_STYLE.md, and ARCHITECTURE.md before
 coding
• Documented sanity check requirements and code quality constraints
• Added table mapping code areas to documentation that must be updated

CLAUDE.md

---

41. .cursor/rules/rule_filtering_process.mdc 📝 Documentation +6/-26

Corrected rule filtering documentation to match implementation

• Corrected package-level determination logic documentation to match actual implementation
• Removed incorrect notes about packages with only excluded rules being marked as ExcludedPackages
• Clarified that packages are only included if they contain at least one included rule
• Updated explanation of why this logic matters for pre and post-evaluation filtering

.cursor/rules/rule_filtering_process.mdc

---

42. docs/PRINCIPLES.md 📝 Documentation +61/-0

Engineering principles for code contributions

• New document establishing 10 engineering principles guiding code contributions
• Covers simplicity first, boundaries and validation, code organization, and error handling
• Emphasizes preferring duplication over premature abstraction and matching existing patterns
• Provides clear guidance on when to extract functions and how to handle errors

docs/PRINCIPLES.md

---

43. Makefile ⚙️ Configuration changes +32/-0

Added code quality and sanity check make targets

• Added new Code Quality section with sanity check targets
• Introduced sanity, sanity-report, sanity-file, quick, refactor, behavior, and prepr
 targets
• Delegates to make/postconditions/Makefile for quality checks
• Provides multiple validation levels for different change types

Makefile

---

44. docs/quality/baseline-report.md 📝 Documentation +50/-0

Baseline code quality metrics and improvement roadmap

• New baseline quality report documenting current code quality metrics
• Lists linter issues by type (nestif, dupl, goconst, unparam, gocyclo)
• Identifies critical high-complexity functions and duplicate code hotspots
• Establishes current budgets and ratchet schedule for gradual improvement

docs/quality/baseline-report.md

---

45. docs/REVIEW.md 📝 Documentation +51/-0

PR review checklist and approval criteria

• New PR review checklist covering automated checks, complexity, simplicity, and architecture
 compliance
• Includes sections for pattern consistency, test quality, and documentation requirements
• Provides specific guidance on what to check before approving PRs
• References ARCHITECTURE.md for layer boundary validation

docs/REVIEW.md

---

46. docs/decisions/ADR-001-cgo-disabled.md 📝 Documentation +37/-0

ADR for CGO disabled build configuration

• New Architecture Decision Record documenting CGO disabled build decision
• Explains context of portability needs and DNS resolution limitations
• Documents consequences including simplified builds but manual /etc/hosts requirements
• Provides mitigations for DNS resolution limitations in acceptance tests

docs/decisions/ADR-001-cgo-disabled.md

---

47. docs/quality/tech-debt-tracker.md 📝 Documentation +28/-0

Technical debt tracking and complexity improvement schedule

• New technical debt tracker documenting complexity violations and ratchet schedule
• Lists two functions exceeding complexity budgets with current and target values
• Establishes phased improvement timeline from current 55 to target 12 complexity
• Tracks known issues by category with priority levels

docs/quality/tech-debt-tracker.md

---

48. docs/design-docs/index.md 📝 Documentation +15/-0

Design documents index and process guide

• New index document for design documents
• Lists active design docs with status and last updated dates
• Provides process guidance for creating and maintaining design documents

docs/design-docs/index.md

---

49. docs/decisions/index.md 📝 Documentation +13/-0

Architecture Decision Records index and process

• New index for Architecture Decision Records
• Lists ADRs with status and dates
• Provides process for creating new ADRs with template reference

docs/decisions/index.md

---

50. .golangci.yaml ⚙️ Configuration changes +8/-1

Relaxed linting rules for test files

• Added exclude rules for test files to suppress dupl, goconst, nestif, and unparam linters
• Allows test files to have duplicate code, magic strings, and unused parameters without linting
 failures
• Maintains strict linting for production code while being pragmatic about test code

.golangci.yaml

---

51. docs/decisions/ADR-template.md 📝 Documentation +17/-0

ADR template for future decision documentation

• New template for Architecture Decision Records
• Provides standard structure with Status, Context, Decision, and Consequences sections
• Includes status options (Proposed, Accepted, Deprecated, Superseded)

docs/decisions/ADR-template.md

---

52. make/postconditions ⚙️ Configuration changes +1/-0

Added postconditions submodule for quality checks

• Added git submodule reference to go-postconditions repository
• Points to external repository for code quality checking infrastructure
• Enables make sanity and related quality check targets

make/postconditions

---

53. .gitmodules ⚙️ Configuration changes +3/-0

Git submodule configuration for postconditions

• Configured git submodule for make/postconditions pointing to ../go-postconditions
• Enables integration of external code quality checking tools

.gitmodules

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (1) 📎 Requirement gaps (0)

1. Tests excluded from linters 📘 Rule violation ⛯ Reliability

Description

The PR adds an exclude-rules block in .golangci.yaml that disables dupl, goconst, nestif,
and unparam for _test.go files, which is a bypass/relaxation of the enforced sanity checks. This
can allow new duplication, deep nesting, and unused parameters to be introduced without failing
make sanity.

Code

.golangci.yaml[R36-43]

+  exclude-rules:
+    # Test files can have duplicate code, magic strings, unused parameters, and complex nesting
+    - path: _test\.go
+      linters:
+        - dupl
+        - goconst
+        - nestif
+        - unparam

Evidence

PR Compliance ID 1 forbids relaxing or bypassing sanity checks; the change explicitly excludes
multiple sanity-related linters for all Go test files via configuration.

CLAUDE.md; AGENTS.md
.golangci.yaml[36-43]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`.golangci.yaml` disables several sanity-related linters for all `_test.go` files, which is a bypass of the required sanity checks.

## Issue Context
Compliance requires `make sanity` to pass without relaxing budgets or adding configuration workarounds to ignore checks.

## Fix Focus Areas
- .golangci.yaml[36-43]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Submodule URL fork break 🐞 Bug ⛯ Reliability

Description

The new make/postconditions submodule uses a relative URL (../go-postconditions), which resolves
relative to the superproject remote and will fail for forks/remotes that don’t also have a sibling
go-postconditions repository. When the submodule cannot be fetched, any workflows that rely on the
new postconditions Make targets cannot run.

Code

.gitmodules[R1-3]

+[submodule "make/postconditions"]
+	path = make/postconditions
+	url = ../go-postconditions

Evidence

The repo now declares a required submodule at make/postconditions but points it at a relative
sibling path; this couples successful submodule init/update to the naming/layout of the remote
hosting the superproject (e.g., forks commonly won’t have that sibling repo).

.gitmodules[1-3]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The `make/postconditions` submodule URL is relative (`../go-postconditions`), which ties submodule fetching to the superproject remote layout and can break forks/CI where the sibling repo doesn’t exist.

### Issue Context
The Makefile introduces new targets that depend on this submodule being present.

### Fix Focus Areas
- .gitmodules[1-3]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Sanity targets lack submodule guard 🐞 Bug ⛯ Reliability

Description

The new Makefile targets (sanity, quick, refactor, behavior, prepr) unconditionally invoke
make/postconditions/Makefile, so a normal clone without submodules initialized fails with a
missing-file error. This creates a hard-to-diagnose failure mode for contributors and CI unless
every environment explicitly initializes submodules.

Code

Makefile[R238-266]

+POSTCONDITIONS_MK := make/postconditions/Makefile
+
+.PHONY: sanity
+sanity: ## Run sanity checks (complexity, duplication, unused params)
+	@$(MAKE) -f $(POSTCONDITIONS_MK) check-sanity
+
+.PHONY: sanity-report
+sanity-report: ## Generate sanity report with summary
+	@$(MAKE) -f $(POSTCONDITIONS_MK) report-sanity
+
+.PHONY: sanity-file
+sanity-file: ## Run sanity checks on specific files (FILES=./path/to/file.go)
+	@$(MAKE) -f $(POSTCONDITIONS_MK) check-sanity FILES="$(FILES)"
+
+.PHONY: quick
+quick: ## Fast validation for small changes
+	@$(MAKE) -f $(POSTCONDITIONS_MK) quick
+
+.PHONY: refactor
+refactor: ## Validation for structural changes (includes unused function scan)
+	@$(MAKE) -f $(POSTCONDITIONS_MK) refactor
+
+.PHONY: behavior
+behavior: ## Validation for behavior changes (full quality + tests + coverage)
+	@$(MAKE) -f $(POSTCONDITIONS_MK) behavior
+
+.PHONY: prepr
+prepr: ## Pre-PR stabilization checks
+	@$(MAKE) -f $(POSTCONDITIONS_MK) prepr

Evidence

The Makefile directly references make/postconditions/Makefile via -f $(POSTCONDITIONS_MK) with
no existence check or init step; these targets will fail unless the submodule is initialized and
checked out.

Makefile[236-266]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`make sanity`/`quick`/`refactor`/`behavior`/`prepr` fail when the postconditions submodule is not initialized because the Makefile unconditionally calls `make -f make/postconditions/Makefile ...`.

### Issue Context
The repo now depends on a submodule for these targets; a clear guard or initialization step is needed to avoid opaque missing-file errors.

### Fix Focus Areas
- Makefile[236-266]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[qodo-code-review]

1. Tests excluded from linters 📘 Rule violation ⛯ Reliability

The PR adds an exclude-rules block in .golangci.yaml that disables dupl, goconst, nestif,
and unparam for _test.go files, which is a bypass/relaxation of the enforced sanity checks. This
can allow new duplication, deep nesting, and unused parameters to be introduced without failing
make sanity.

Agent Prompt

## Issue description
`.golangci.yaml` disables several sanity-related linters for all `_test.go` files, which is a bypass of the required sanity checks.

## Issue Context
Compliance requires `make sanity` to pass without relaxing budgets or adding configuration workarounds to ignore checks.

## Fix Focus Areas
- .golangci.yaml[36-43]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

2. Submodule url fork break 🐞 Bug ⛯ Reliability

The new make/postconditions submodule uses a relative URL (../go-postconditions), which resolves
relative to the superproject remote and will fail for forks/remotes that don’t also have a sibling
go-postconditions repository. When the submodule cannot be fetched, any workflows that rely on the
new postconditions Make targets cannot run.

Agent Prompt

### Issue description
The `make/postconditions` submodule URL is relative (`../go-postconditions`), which ties submodule fetching to the superproject remote layout and can break forks/CI where the sibling repo doesn’t exist.

### Issue Context
The Makefile introduces new targets that depend on this submodule being present.

### Fix Focus Areas
- .gitmodules[1-3]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[codecov]

Codecov Report

❌ Patch coverage is 80.52288% with 149 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/validate/vsa/rekor_retriever.go	63.90%	48 Missing ⚠️
internal/validate/vsa/vsa.go	36.36%	21 Missing ⚠️
cmd/validate/image.go	87.94%	17 Missing ⚠️
internal/policy/policy.go	84.25%	17 Missing ⚠️
internal/evaluator/conftest_evaluator.go	82.66%	13 Missing ⚠️
internal/evaluator/filters.go	67.56%	12 Missing ⚠️
cmd/test/test.go	83.87%	5 Missing ⚠️
internal/validate/vsa/storage.go	81.48%	5 Missing ⚠️
...ation_snapshot_image/application_snapshot_image.go	76.47%	4 Missing ⚠️
internal/policy/source/source.go	91.66%	2 Missing ⚠️
... and 5 more

Flag	Coverage Δ
acceptance	54.94% <51.76%> (+0.07%)	⬆️
generative	18.42% <25.88%> (+0.27%)	⬆️
integration	27.43% <41.56%> (+0.43%)	⬆️
unit	68.85% <73.59%> (+0.19%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
benchmark/offliner/referrers.go	0.00% <ø> (ø)
cmd/track/track_bundle.go	96.96% <ø> (ø)
internal/evaluator/criteria.go	96.70% <ø> (ø)
internal/image/validate.go	70.80% <100.00%> (ø)
internal/kubernetes/client.go	75.75% <ø> (ø)
internal/opa/inspect.go	90.99% <100.00%> (+0.72%)	⬆️
internal/output/output.go	98.31% <100.00%> (ø)
internal/policy/equivalence/equivalence.go	86.96% <100.00%> (+0.13%)	⬆️
internal/rego/sigstore/sigstore.go	93.62% <ø> (ø)
internal/validate/report.go	97.64% <100.00%> (+0.21%)	⬆️
... and 17 more

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.