Skip to content

feat: add excludedPaths option to no-http-verbs-in-paths rule#2719

Open
tmchow wants to merge 4 commits intoRedocly:mainfrom
tmchow:feat/1501-excluded-paths-no-http-verbs
Open

feat: add excludedPaths option to no-http-verbs-in-paths rule#2719
tmchow wants to merge 4 commits intoRedocly:mainfrom
tmchow:feat/1501-excluded-paths-no-http-verbs

Conversation

@tmchow
Copy link
Copy Markdown

@tmchow tmchow commented Apr 5, 2026

What/Why/How?

Adds an excludedPaths option to the no-http-verbs-in-paths rule. Some paths contain HTTP verb substrings that are false positives (e.g. /foo/profile-options/). This lets users exclude specific paths from evaluation without polluting the ignore file.

Config:

rules:
  no-http-verbs-in-paths:
    severity: error
    splitIntoWords: true
    excludedPaths:
      - /foo/profile-options/

The implementation adds one line to the rule: an early return when the path matches any entry in excludedPaths. Matching is exact (full path string comparison).

Reference

Fixes #1501

Testing

Added a test that verifies /path/post is excluded while /get/path is still reported.

Check yourself

  • This PR follows the contributing guide
  • All new/updated code is covered by tests
  • Core code changed? - Tested with other Redocly products (internal contributions only)
  • New package installed? - Tested in different environments (browser/node)
  • Documentation update has been considered

Security

  • The security impact of the change has been considered

This contribution was developed with AI assistance (Codex).

Compound Engineering

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@tmchow tmchow requested a review from a team as a code owner April 5, 2026 07:36
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Apr 5, 2026

🦋 Changeset detected

Latest commit: 119c7f2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@redocly/openapi-core Minor
@redocly/cli Minor
@redocly/respect-core Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@tmchow tmchow requested a review from a team as a code owner April 5, 2026 07:41
@Daryna-del
Copy link
Copy Markdown
Contributor

Daryna-del commented Apr 6, 2026

Hi @tmchow! Thanks for the contribution!
Could you please also update the documentation to include the new configuration option?

| -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
| severity | string | Possible values: `off`, `warn`, `error`. Default `off` (in `recommended` configuration). |
| splitIntoWords | boolean | Matches http verbs when the string is split into words based on casing. This can reduce false positives. Default **false**. |
| excludedPaths | [string] | List of paths to exclude from the check. Use exact path strings (e.g. `/gettoken`). Default **[]**. |
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| excludedPaths | [string] | List of paths to exclude from the check. Use exact path strings (e.g. `/gettoken`). Default **[]**. |
| excludedPaths | [string] | List of paths to exclude from the check. Use exact path strings (e.g. `/token`). Default **[]**. |

Using verbs in path is generally discouraged, please use nouns in examples.

Comment on lines +77 to +78
- /gettoken
- /oauth/postback
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

outdent`
openapi: 3.1.0
paths:
/path/post:
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And here.

| -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
| severity | string | Possible values: `off`, `warn`, `error`. Default `off` (in `recommended` configuration). |
| splitIntoWords | boolean | Matches http verbs when the string is split into words based on casing. This can reduce false positives. Default **false**. |
| excludedPaths | [string] | List of paths to exclude from the check. Use exact path strings (e.g. `/gettoken`). Default **[]**. |
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like there’s a formatting issue. Could you please run npm run format to fix it?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

enhance no-http-verbs-in-paths with excludedPaths option

4 participants