Built-in Rule Inventory¶
This page is the single source of truth for all built-in rules shipped with Azure Functions Doctor.
Rules are defined in src/azure_functions_doctor/assets/rules/v2.json.
Rule groups¶
Every rule belongs to a functional Group:
- core — checks Azure Functions runtime, hosting-plan, deployment, bindings, Durable Functions, dependency, and security correctness. These apply to any Python v2 Function App.
- integration — checks that only matter when a specific ecosystem library is present (OpenAPI/validation, logging/OpenTelemetry, LangGraph). They warn about misuse of those integrations and are inert when the library is not detected.
The group is metadata only: it does not change how rules run today, but it lets
you tell Azure-correctness findings apart from ecosystem-integration findings.
When a rule omits the field it defaults to core.
Rule Table¶
| Rule ID | Label | Category | Group | Section | Type | Required | Profile |
|---|---|---|---|---|---|---|---|
check_programming_model_v2 |
Programming model v2 | project_structure | core | programming_model | source_code_contains |
No | deploy, full |
check_blueprint_registration |
Blueprint registration | project_structure | core | programming_model | blueprint_registration |
No | deploy, full |
check_python_version |
Python version | environment | core | python_env | compare_version |
Yes | minimal, deploy, full |
check_python_runtime_lifecycle |
Python runtime lifecycle | environment | core | python_env | python_runtime_lifecycle |
No | deploy, full |
check_venv |
Virtual environment | environment | core | python_env | any_of_exists |
No | development, full |
check_functions_runtime_lifecycle |
Functions runtime lifecycle | configuration | core | runtime | functions_runtime_lifecycle |
No | deploy, full |
check_python_executable |
Python executable | environment | core | python_env | path_exists |
No | development, full |
check_hosting_plan_lifecycle |
Hosting plan lifecycle | configuration | core | runtime | hosting_plan_lifecycle |
No | deploy, full |
check_requirements_txt |
requirements.txt | dependencies | core | python_env | dependency_manifest |
Yes | minimal, deploy, full |
check_flex_runtime_config |
Flex Consumption runtime config | configuration | core | runtime | flex_runtime_config |
No | deploy, full |
check_azure_functions_library |
azure-functions package | dependencies | core | python_env | package_declared |
Yes | minimal, deploy, full |
check_flex_deprecated_settings |
Flex Consumption deprecated app settings | configuration | core | runtime | flex_deprecated_settings |
No | deploy, full |
check_native_dependency_risk |
Native dependency risk | dependencies | core | python_env | native_dependency_risk |
No | deploy, full |
check_flex_deployment_storage |
Flex Consumption deployment storage | configuration | core | runtime | flex_deployment_storage |
No | deploy, full |
check_azure_functions_worker |
azure-functions-worker not pinned | dependencies | core | python_env | package_forbidden |
No | deploy, full |
check_host_json |
host.json | structure | core | project_structure | file_exists |
Yes | minimal, deploy, full |
check_binding_connection_resolution |
Binding connection resolution | configuration | core | runtime | binding_connection_resolution |
No | deploy, full |
check_host_json_version |
host.json version | structure | core | project_structure | host_json_version |
Yes | minimal, deploy, full |
check_local_settings |
local.settings.json | structure | core | project_structure | file_exists |
No | development, full |
check_func_cli |
Azure Functions Core Tools (func) | tooling | core | tooling | executable_exists |
No | development, full |
check_func_core_tools_version |
Azure Functions Core Tools version | tooling | core | tooling | compare_version |
No | development, full |
check_durabletask_config |
Durable Functions configuration | configuration | core | durable | conditional_exists |
No | deploy, full |
check_app_insights |
Application Insights configuration | telemetry | core | monitoring | app_insights_connection |
No | deploy, full |
check_extension_bundle |
extensionBundle | configuration | core | extensions | host_json_property |
No | deploy, full |
check_asgi_wsgi_exposure |
ASGI/WSGI compatibility | framework | core | asgi_wsgi | callable_detection |
No | deploy, full |
check_unused_files |
Detect unused or invalid files | project_health | core | cleanup | file_glob_check |
No | deploy, full |
check_funcignore |
.funcignore | project_health | core | cleanup | file_exists |
No | deploy, full |
check_local_settings_git_tracked |
local.settings.json not git-tracked | project_health | core | security | local_settings_security |
No | deploy, full |
check_extension_bundle_v4 |
extensionBundle v4 recommended | configuration | core | extensions | host_json_extension_bundle_version |
No | deploy, full |
check_decorator_order |
Decorator order | framework | core | programming_model | decorator_order |
No | deploy, full |
check_endpoint_metadata |
Endpoint metadata coverage | framework | integration | programming_model | endpoint_metadata |
No | full |
check_openapi_version_mixing |
OpenAPI version consistency | framework | integration | programming_model | openapi_version_mixing |
No | full |
check_scan_before_spec |
Endpoint scan before spec build | framework | integration | programming_model | scan_before_spec |
No | full |
check_langgraph_anonymous_auth |
LangGraph route authentication | configuration | integration | security | langgraph_anonymous_auth |
No | full |
check_durable_nondeterminism |
Orchestrator determinism | framework | core | durable | durable_nondeterminism |
Yes | minimal, deploy, full |
check_otel_trace_context_activation |
OTel trace-context activation | configuration | integration | observability | otel_activation |
No | full |
check_functions_extension_version |
Functions extension version | configuration | core | runtime | functions_extension_version |
No | deploy, full |
check_linux_fx_version |
Linux runtime (linuxFxVersion) | configuration | core | runtime | linux_fx_version |
No | deploy, full |
check_host_json_log_level_conflict |
host.json logLevel conflict | configuration | core | observability | host_json_log_level_conflict |
No | deploy, full |
check_dev_storage_connection |
Dev-storage emulator connection | configuration | core | runtime | dev_storage_connection |
No | deploy, full |
check_unpinned_requirements |
Pinned requirements | dependencies | core | dependencies | unpinned_requirements |
No | deploy, full |
Rule Types¶
| Type | Description |
|---|---|
compare_version |
Compares a runtime version against a minimum threshold. |
file_exists |
Checks whether a file exists at the project root. |
env_var_exists |
Checks whether an environment variable is set. |
path_exists |
Checks whether a filesystem path (e.g. sys.executable) exists. |
package_installed |
Checks whether a Python package is importable in the current environment. |
package_declared |
Checks whether a package name appears in a dependency file. |
package_forbidden |
Checks that a platform-managed package is NOT declared in a dependency file. |
source_code_contains |
Scans Python source files for a keyword or AST pattern. |
conditional_exists |
Checks for a JSON property only when a related condition is detected. |
callable_detection |
Detects whether the project exposes an ASGI or WSGI callable. |
executable_exists |
Checks whether an executable is available on PATH. |
any_of_exists |
Passes if any one of several targets (env vars, JSON properties) is present. |
file_glob_check |
Matches file glob patterns to detect unwanted files in the project tree. |
host_json_property |
Checks for a specific property in host.json via JSONPath. |
host_json_version |
Checks that host.json declares "version": "2.0". |
local_settings_security |
Checks that local.settings.json is not tracked by git. |
host_json_extension_bundle_version |
Checks that extensionBundle in host.json uses the recommended v4 range. |
python_runtime_lifecycle |
Checks the target Python version against its published Azure Functions end-of-support date (WARN when retiring soon, FAIL when past end-of-support), rendered at the catalog's date precision. |
functions_runtime_lifecycle |
Checks the Azure Functions runtime major version (from FUNCTIONS_EXTENSION_VERSION): v1 FAILs as incompatible with Python (with a lifecycle note), v2/v3 FAIL as out of support, v3 on Linux Consumption FAILs (apps stop running on a published date), and v4 PASSes. |
hosting_plan_lifecycle |
Checks the resolved hosting plan against its published retirement date: informational when far off, WARN inside the retiring-soon window, and FAIL once retired (never a FAIL merely for being scheduled). |
flex_runtime_config |
For a Flex Consumption app, validates the runtime declared under functionAppConfig.runtime (name/version) against the supported Python versions, and WARNs when a legacy linuxFxVersion is present (Flex ignores it). Non-Flex apps SKIP. |
flex_deprecated_settings |
For a Flex Consumption app, WARNs (non-gating) when legacy app settings that Flex ignores are declared (worker-runtime selection, Oryx/remote-build toggles, Azure Files content-share settings, run-from-package, and VNet route-all), citing the replacement mechanism for each. linuxFxVersion and FUNCTIONS_EXTENSION_VERSION are owned by flex_runtime_config / functions_extension_version and never double-reported. Non-Flex apps SKIP. |
flex_deployment_storage |
For a Flex Consumption app, validates the deployment storage shape declared under functionAppConfig.deployment.storage: a container URL (value) must be specified and authentication must be configured (managed identity or a named storage account connection string). Obviously wrong shapes WARN (non-gating); the storage account is never contacted. Non-Flex apps SKIP, and apps that declare no deployment storage block in infra SKIP gracefully. |
binding_connection_resolution |
Extracts connection="..." references from v2 trigger/binding decorators (Storage, Service Bus, Event Hub, Cosmos DB, and any binding exposing a connection keyword) and resolves each against local.settings.json Values plus the ingested deploy-config app settings. Unresolved connections WARN (non-gating). Identity-based connection groups (<name>__serviceUri / <name>__accountName) are treated as configured to avoid false positives. Only string-literal connection names are inspected; dynamic expressions are skipped. |
False-positive Risk¶
The following rule types use heuristic inspection and may produce false positives in unusual project layouts:
source_code_contains(check_programming_model_v2): Searches for@app.in Python files. Projects that use@app.for non-Azure-Functions decorators may trigger a false positive.callable_detection(check_asgi_wsgi_exposure): Inspects source for ASGI/WSGI patterns. Non-standard callable exposure may not be detected.file_glob_check(check_unused_files): Matches common unwanted file patterns. Intentionally kept files (e.g.tests/in monorepos) may trigger warnings.
False positives in stable rules are treated as bugs. See the Semver Policy for details.