A flexible JSON/YAML linter for creating automated style guides, with baked in support for OpenAPI (v3.1, v3.0, and v2.0), Arazzo v1.0, as well as AsyncAPI v2.x.
Installations
npm install @stoplight/spectral-ruleset-migrator
Developer
Developer Guide
Module System
CommonJS, UMD
Min. Node Version
^16.20 || ^18.18 || >= 20.17
Typescript Support
Yes
Node Version
20.18.0
NPM Version
8.19.4
Statistics
2,551 Stars
2,098 Commits
240 Forks
34 Watching
22 Branches
157 Contributors
Updated on 28 Nov 2024
Languages
TypeScript (96.98%)
JavaScript (2.68%)
HTML (0.17%)
Shell (0.1%)
Dockerfile (0.07%)
Total Downloads
Cumulative downloads
Total Downloads
29,069,557
Last day
-7.8%
63,619
Compared to previous day
Last week
0.3%
367,458
Compared to previous week
Last month
20.1%
1,440,019
Compared to previous month
Last year
17.7%
13,489,552
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
14
- Custom Rulesets: Create custom rules to lint JSON or YAML objects
- Ready-to-use Rulesets: Validate and lint OpenAPI v2 & v3.x, AsyncAPI, and Arazzo v1 Documents
- API Style Guides: Automated API Style Guides using rulesets improve consistency across all your APIs
- Ready-to-use Functions: Built-in set of functions to help create custom rules. Functions include pattern checks, parameter checks, alphabetical ordering, a specified number of characters, provided keys are present in an object, etc.
- Custom Functions: Create custom functions for advanced use cases
Overview
- 🧰 Installation
- 💻 Usage
- 📖 Documentation
- ℹ️ Support
- 🌎 Real-World Rulesets
- ⚙️ Integrations
- 👏 Contributing
- 🌲 Sponsor Spectral by Planting a Tree
🧰 Installation
The easiest way to install spectral is to use either npm:
1npm install -g @stoplight/spectral-cli
Or yarn:
yarn global add @stoplight/spectral-cli
There are also additional installation options.
💻 Usage
1. Create a local ruleset
Spectral, being a generic YAML/JSON linter, needs a ruleset to lint files. A ruleset is a JSON, YAML, or JavaScript/TypeScript file (often the file is called .spectral.yaml
for a YAML ruleset) that contains a collection of rules, which can be used to lint other JSON or YAML files such as an API description.
To get started, run this command in your terminal to create a .spectral.yaml
file that uses the Spectral predefined rulesets based on OpenAPI, Arazzo or AsyncAPI:
1echo 'extends: ["spectral:oas", "spectral:asyncapi", "spectral:arazzo"]' > .spectral.yaml
If you would like to create your own rules, check out the Custom Rulesets page.
2. Lint
Use this command if you have a ruleset file in the same directory as the documents you are linting:
1spectral lint myapifile.yaml
Use this command to lint with a custom ruleset, or one that's located in a different directory than the documents being linted:
1spectral lint myapifile.yaml --ruleset myruleset.yaml
📖 Documentation
- Documentation
- Getting Started - The basics of Spectral.
- Rulesets - Understand the structure of a ruleset so you can tweak and make your own rules.
Once you've had a look through the getting started material, some of these guides can help you become a power user.
- Different Workflows - When and where should you use Spectral? Editors, Git hooks, continuous integration, GitHub Actions, wherever you like!
- Using the command-line interface - Quickest way to get going with Spectral is in the CLI.
- Using the JavaScript API - Access the raw power of Spectral via the JS, or hey, TypeScript if you want.
- Custom Rulesets - Need something more than the core rulesets provide? Fancy building your own API Style Guide? Learn how to create a custom ruleset.
- Custom Functions - Handle more advanced rules, by writing a little JavaScript/TypeScript and calling it as a function.
ℹ️ Support
If you need help using Spectral or have any questions, you can use GitHub Discussions, or visit the Stoplight Community Discord. These communities are a great place to share your rulesets, or show off tools that use Spectral.
If you have a bug or feature request, create an issue for it.
🌎 Real-World Rulesets
Stoplight has a set of Spectral rulesets that were created to help users get started with Stoplight's Style Guides. You can find them on API Stylebook, and you can download the source Spectral file by selecting a style guide on the project sidebar and selecting Export -> Spectral File(s) on the top-right. A few noteworthy style guides are:
- OWASP Top 10 - Set of rules to enforce OWASP security guidelines.
- URL Style Guidelines - Set of rules to help developers make better and consistent endpoints.
- Documentation - Scan an OpenAPI description to make sure you're leveraging enough of its features to help documentation tools like Stoplight Elements, ReDoc, and Swagger UI build the best quality API Reference Documentation possible.
There are also rulesets created by many companies to improve their APIs. You can use these as is to lint your OpenAPI descriptions, or use these as a reference to learn more about what rules you would want in your own ruleset:
- Adidas - Adidas were one of the first companies to release their API Style Guide in a written guide and a Spectral ruleset. Lots of good rules to try in here.
- APIs You Won't Hate - An opinionated collection of rules based on advice in the APIs You Won't Hate community.
- Azure - Ruleset and complimentary style guide for creating OpenAPI 2 or 3 definitions of Azure services.
- Box - Lots of Custom Functions being used to enforce good practices that the Box API governance folks are interested in.
- DigitalOcean - Keeping their OpenAPI nice and tidy, enforcing use of
$ref
(probably to minimize conflicts), naming conventions for Operation IDs, and all sorts of other handy OpenAPI tips. - Tranascom - Don't even think about using anything other than
application/json
. - Zalando - Based on Zalando's RESTFUL API Guidelines, covers a wide-range of API topics such as versioning standards, property naming standards, the default format for request/response properties, and more.
Check out some additional style guides here:
⚙️ Integrations
- GitHub Action - Lints documents in your repo, built by Vincenzo Chianese.
- JetBrains Plugin - Automatic linting of your OpenAPI specifications and highlighting in your editor.
- Stoplight Studio - Uses Spectral to validate and lint OpenAPI documents.
- VS Code Spectral Extension - All the power of Spectral without leaving VS Code.
🏁 Help Others Utilize Spectral
If you're using Spectral for an interesting use case, create an issue with details on how you're using it. We'll add it to a list here. Spread the goodness 🎉
👏 Contributing
If you are interested in contributing to Spectral, check out CONTRIBUTING.md.
🎉 Thanks
- Mike Ralphson for kicking off the Spectral CLI and his work on Speccy
- Jamund Ferguson for JUnit formatter
- Sindre Sorhus for Stylish formatter
- Ava Thorn for the Pretty formatter
- Julian Laval for HTML formatter
- @nulltoken for a whole bunch of amazing features
📜 License
Spectral is 100% free and open-source, under Apache License 2.0.
🌲 Sponsor Spectral by Planting a Tree
If you would like to thank Stoplight for creating Spectral, buy the world a tree.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
6 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Reason
Found 3/27 approved changesets -- score normalized to 1
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/jira-issue-label-added.yaml:1
- Warn: no topLevel permission defined: .github/workflows/markdown-links.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v6.14.2 not signed: https://api.github.com/repos/stoplightio/spectral/releases/186400741
- Warn: release artifact v6.14.1 not signed: https://api.github.com/repos/stoplightio/spectral/releases/185292905
- Warn: release artifact v6.14.0 not signed: https://api.github.com/repos/stoplightio/spectral/releases/184862357
- Warn: release artifact v6.13.1 not signed: https://api.github.com/repos/stoplightio/spectral/releases/176223306
- Warn: release artifact v6.11.1 not signed: https://api.github.com/repos/stoplightio/spectral/releases/149924554
- Warn: release artifact v6.14.2 does not have provenance: https://api.github.com/repos/stoplightio/spectral/releases/186400741
- Warn: release artifact v6.14.1 does not have provenance: https://api.github.com/repos/stoplightio/spectral/releases/185292905
- Warn: release artifact v6.14.0 does not have provenance: https://api.github.com/repos/stoplightio/spectral/releases/184862357
- Warn: release artifact v6.13.1 does not have provenance: https://api.github.com/repos/stoplightio/spectral/releases/176223306
- Warn: release artifact v6.11.1 does not have provenance: https://api.github.com/repos/stoplightio/spectral/releases/149924554
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/markdown-links.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/stoplightio/spectral/markdown-links.yml/develop?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/markdown-links.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/stoplightio/spectral/markdown-links.yml/develop?enable=pin
- Warn: containerImage not pinned by hash: .devcontainer/Dockerfile:8: pin your Docker image by updating mcr.microsoft.com/vscode/devcontainers/javascript-node:0-12 to mcr.microsoft.com/vscode/devcontainers/javascript-node:0-12@sha256:badcf848a77adb3ad67c8111e1418f2baff2b241be99d17eba5cccc25dc4a2d7
- Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating node:16-alpine to node:16-alpine@sha256:a1f9d027912b58a7c75be7716c97cfbc6d3099f3a97ed84aa490be9dee20e787
- Info: 0 out of 1 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 0 out of 2 containerImage dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 9 are checked with a SAST tool
Score
3.9
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More