check-safety/check_envreads.go

package main

import "fmt"

func init() {
	register(Check{
		Seq:   10,
		ID:    "1",
		Title: "Secret env var reads outside config.Load()",
		Run: func(ctx *ScanContext, rep *Reporter) {
			// Check 1: Secret env var reads
			fmt.Println("=== Check 1: Secret env var reads outside config.Load() ===")
			var envViolations []envViolation
			for _, target := range ctx.backendTargets {
				for _, v := range checkEnvReads(target.root) {
					v.file = prefixDisplayPath(target.display, v.file)
					envViolations = append(envViolations, v)
				}
			}
			for _, target := range ctx.pluginTargets {
				for _, v := range checkEnvReads(target.root) {
					v.file = prefixDisplayPath(target.display, v.file)
					envViolations = append(envViolations, v)
				}
			}
			if len(envViolations) > 0 {
				for _, v := range envViolations {
					fmt.Printf("  FAIL: %s:%d — os.Getenv(%q)\n", v.file, v.line, v.envVar)
				}
				fmt.Printf("\n  %d violation(s). Secrets must flow through Config → DI.\n", len(envViolations))
				rep.Fail()
			} else {
				fmt.Printf("  OK: No secret env var reads outside config.Load()")
				if len(ctx.pluginTargets) > 0 {
					fmt.Printf(" (%d plugin roots scanned)", len(ctx.pluginTargets))
				}
				fmt.Println()
				printPerTargetOKLines(pluginTargetLabels(ctx.pluginTargets))
			}

			fmt.Println()
		},
	})
}