c4d01de82c
Reporter is now a collector: checks declare a verdict (OK/Skip/Warn/Fail/ Fatal) plus findings, and a single central render() prints output. Default output is silent on pass/skip — only FAIL/WARN/ERR checks print, followed by one tally line, so a clean run is two lines. --verbose restores full per-check output. All ~30 checks were converted to this API; orphaned guidance/label helpers (printPerTargetOKLines, per-check *Help blocks, colors_format.go) were removed. The any-usage check (2e) now defaults to only the unstaged working-tree diff (changed lines), via a new per-repo git-diff index in changedlines.go; --all-any restores the full scan. Not-a-git-repo / no-diff warns on nothing. Golden fixtures regenerated; integration tests updated to the new format; added unit tests for the diff index. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.1 KiB
Go
37 lines
1.1 KiB
Go
package main
|
|
|
|
func init() {
|
|
register(Check{
|
|
Seq: 10,
|
|
ID: "1",
|
|
Title: "Secret env var reads outside config.Load()",
|
|
Run: func(ctx *ScanContext, rep *Reporter) {
|
|
var envViolations []envViolation
|
|
for _, target := range ctx.backendTargets {
|
|
for _, v := range checkEnvReads(target.root) {
|
|
v.file = prefixDisplayPath(target.display, v.file)
|
|
envViolations = append(envViolations, v)
|
|
}
|
|
}
|
|
for _, target := range ctx.pluginTargets {
|
|
for _, v := range checkEnvReads(target.root) {
|
|
v.file = prefixDisplayPath(target.display, v.file)
|
|
envViolations = append(envViolations, v)
|
|
}
|
|
}
|
|
if len(envViolations) > 0 {
|
|
rep.Fail("%d secret env var read(s) outside config.Load() — secrets must flow through Config → DI", len(envViolations))
|
|
for _, v := range envViolations {
|
|
rep.Findingf("%s:%d — os.Getenv(%q)", v.file, v.line, v.envVar)
|
|
}
|
|
} else {
|
|
if len(ctx.pluginTargets) > 0 {
|
|
rep.OK("No secret env var reads outside config.Load() (%d plugin roots scanned)", len(ctx.pluginTargets))
|
|
} else {
|
|
rep.OK("No secret env var reads outside config.Load()")
|
|
}
|
|
}
|
|
},
|
|
})
|
|
}
|