c4d01de82c
Reporter is now a collector: checks declare a verdict (OK/Skip/Warn/Fail/ Fatal) plus findings, and a single central render() prints output. Default output is silent on pass/skip — only FAIL/WARN/ERR checks print, followed by one tally line, so a clean run is two lines. --verbose restores full per-check output. All ~30 checks were converted to this API; orphaned guidance/label helpers (printPerTargetOKLines, per-check *Help blocks, colors_format.go) were removed. The any-usage check (2e) now defaults to only the unstaged working-tree diff (changed lines), via a new per-repo git-diff index in changedlines.go; --all-any restores the full scan. Not-a-git-repo / no-diff warns on nothing. Golden fixtures regenerated; integration tests updated to the new format; added unit tests for the diff index. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
14 lines
794 B
Plaintext
14 lines
794 B
Plaintext
check-safety FIXTURE_DIR
|
|
FAIL 1 1 secret env var read(s) outside config.Load() — secrets must flow through Config → DI
|
|
internal/service/handler.go:17 — os.Getenv("JWT_SECRET")
|
|
FAIL 2c 1 CMS backend go.mod violation(s)
|
|
FIXTURE_DIR/go.mod [missing-go-mod] missing go.mod
|
|
FAIL 14 1 raw SQL statement(s) found outside sqlc/Bob
|
|
internal/service/handler.go:22 SELECT id, name FROM users WHERE active = true
|
|
FAIL 15 1 err.Error() leak(s) to HTTP clients — log via slog.Error() and return a user-friendly message
|
|
internal/service/handler.go:27 http.Error(w, err.Error(), ...) — leaks internal error
|
|
FAIL 17 1 TODO marker(s) found — ship explicit behavior, not placeholders
|
|
internal/service/handler.go:14 // TODO: add proper initialisation
|
|
|
|
32 checks: 14 ok 13 skip 5 fail -> FAIL
|