openvox-lint 1.3.1 → 1.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c93dcb31a47e58c1ff171d798789c1bfdc202cf9d0f950c6eb35c0942eeaa8ca
-  data.tar.gz: 3bf2d9f13f3bc7e39f651626f1c4dcb22b628d45e5a330e146a14d2c3ec9e138
+  metadata.gz: c0c7d920c8af64b11f92c5b9c4937d1f767c45d544a78156f301de78e9512927
+  data.tar.gz: cf78162f1b74d6f748e809850f7650df7f556a47489417659f27611ca349b8b3
 SHA512:
-  metadata.gz: e685e7c01d060ae7d1235ebb8d3164e0eac81a72ec0e4cb63f214aca7acde911ad16cc79c5fcbd0f5994d796a6ce8be13f62a43aba92e4c8c1e9d6126dc172e0
-  data.tar.gz: 0b789ecf9210c095ab2c5abb128583e3fd7717aede849a45b0cf5ffc5419fc59d7b62a6ad4fc79495841fce369581fb67ad657a04bc60cdf666e105e3ad0259d
+  metadata.gz: e86b7d896d60e813091baa30e69b08422b4f48e0557610c06fabf0d296d05095b87ae5ca76131f6ad23952f528311248883ebd2072d0145f35e4c589a9fc6877
+  data.tar.gz: 4d4779b6164be6bf252527a8ad970e3ef8af117fab5c6315fba89bfac935bee6e1770d9a179e68c2fb3982542c87981c1accd21d0567825c7bd4130ca7f0b012

data/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 All notable changes to openvox-lint will be documented in this file.
 
+## [Unreleased]
+
+## [1.3.4] - 2026-09-21
+
+Patch release so the published gem matches tip. Resource indexes now see capitalized resource defaults. No new checks.
+
+### Fixed
+- Resource indexes treat capitalized resource defaults (`File {`, `Notify {`) via CLASSREF.
+- Class, define, and node bodies are still skipped using the previous semantic token. There is no formatting walk.
+- Specs cover resource defaults against capitalized class and define names.
+
+## [1.3.3] - 2026-09-21
+
+Patch release since 1.3.2. Safer CI and auto-fix, clearer checks and CLI, and an honest story for custom checks. No new checks.
+
+### Security
+- Safer CI output. GitHub annotation format (`-f github`) can no longer let crafted lint messages inject extra commands into the Actions log.
+- Safer config. An `.openvox-lint.rc` can no longer quietly enable rewrite/fix mode. `--fix` must be passed on the CLI.
+- Safer auto-fix. `--fix` refuses to write if the path is a symlink or goes through one.
+- CSV output escapes fields that contain commas, quotes, or newlines.
+
+### Architect
+- Honest extension story. Docs say require your file and register the check. There is no gem auto-load plugin ecosystem.
+- A duplicate check name always warns when it is overwritten.
+- Dead-API cleanup, and the lexer comment no longer claims EPP tag scanning. See [docs/ARCHITECTURE_REVIEW.md](docs/ARCHITECTURE_REVIEW.md).
+
+### Quality
+- `$::` topscope names no longer false-positive on `variable_is_lowercase` (#2).
+- Broken heredocs (unterminated, or a junk end tag such as a comma after `END`) now fail with a clear error (#5).
+
+### CLI
+- `--relative` rewrites paths in all output formats.
+- An unknown `-f` fails closed and prints the allowlist.
+- `--list-checks` shows name, severity, and description.
+- `--help` documents `--no-<check>-check`.
+- RC `--log-format` and `--format` behave like the CLI.
+
+### Systems
+- The Ruby floor is now ≥ 2.6. Ruby 2.5 is no longer claimed, because CI cannot honestly test it.
+- Missing or empty input paths fail closed instead of exiting 0 with a clean run (#7).
+- The README CI badge and the release checklist keep the git tag, the RubyGems publish, and the GitHub Release in sync.
+
+## [1.3.2] - 2026-05-24
+
+### Fixed
+- Strengthened resource detection logic in `compute_resource_indexes` to reliably exclude `class`/`define`/`node` bodies. This prevents multiple checks (especially `trailing_comma`) from incorrectly treating statements inside classes as resource attributes.
+
 ## [1.3.1] - 2026-05-23
 
 ### Fixed
@@ -244,7 +291,7 @@ All notable changes to openvox-lint will be documented in this file.
   - Token-based check plugin architecture with `OpenvoxLint.new_check` DSL
   - Doubly-linked token list for efficient navigation
   - Support for all Puppet 8 / OpenVox 8.x language constructs
-  - Heredoc, EPP tag, regex, and string interpolation tokenization
+  - Heredoc, regex, and string interpolation tokenization (EPP tags were never scanned)
 
 - **38 Built-in Checks**
   - **Whitespace**: `trailing_whitespace`, `hard_tabs`, `line_length`, `space_before_arrow`, `strict_indent`

data/DOCUMENTATION.md

@@ -10,8 +10,8 @@ reported in multiple output formats suitable for humans, CI systems, and IDEs.
 This document covers the architecture, every public API, every built-in check,
 the lexer token types, the plugin system, and integration guidance.
 
-**Version:** 1.3.1  
-**Checks:** 37 built-in (with real --fix support for 5+ checks)  
+**Version:** 1.3.4  
+**Checks:** 37 built-in (with real --fix support for 5 checks)  
 **License:** Apache 2.0  
 **Compatibility:** OpenVox 8.x, Puppet 8.x, Puppet 7.x (with deprecation warnings)
 
@@ -45,6 +45,7 @@ the lexer token types, the plugin system, and integration guidance.
 - [Plugin Development](#plugin-development)
 - [Migration from puppet-lint](#migration-from-puppet-lint)
 - [File Inventory](#file-inventory)
+- [Architecture Review](docs/ARCHITECTURE_REVIEW.md)
 
 ---
 
@@ -79,7 +80,7 @@ the lexer token types, the plugin system, and integration guidance.
 - **Zero runtime dependencies** — only Ruby standard library
 - **Token-based analysis** — works on token stream, not AST
 - **Puppet/OpenVox agnostic** — identical language support for both
-- **Extensible** — plugin system for custom checks
+- **Extensible** — `OpenvoxLint.new_check` DSL for custom checks (require-your-file; see Plugin Development)
 - **CI-friendly** — multiple output formats, proper exit codes
 
 ---
@@ -94,7 +95,7 @@ The top-level namespace for all openvox-lint classes.
 
 | Constant | Value | Description |
 |----------|-------|-------------|
-| `VERSION` | `'1.3.1'` | Gem version string |
+| `VERSION` | `'1.3.4'` | Gem version string |
 
 #### Class Methods
 
@@ -104,7 +105,7 @@ The top-level namespace for all openvox-lint classes.
 | `.configure { \|c\| }` | `Configuration` | Yields configuration for block-style setup |
 | `.reset_configuration!` | `Configuration` | Reset configuration to defaults (called by CLI) |
 | `.checks` | `Hash{Symbol => Class}` | Registry of loaded check classes |
-| `.new_check(name, &block)` | `Class` | Register a new check plugin (warns on duplicates) |
+| `.new_check(name, &block)` | `Class` | Register a new check plugin (always warns on stderr if the name is already registered, then overwrites) |
 
 #### Exceptions
 
@@ -1490,10 +1491,19 @@ Use the module autoloader by placing files in the correct location:
 
 ## Plugin Development
 
+openvox-lint auto-loads **only** the 37 built-in files under this gem's
+`lib/openvox-lint/plugins/checks/*.rb` (see `lib/openvox-lint.rb`). There is
+no `--load FILE` CLI flag and no RubyGems plugin discovery comparable to
+`PuppetLint::Plugins.load_from_gems`. Custom checks are visible only after
+the process `require`s or `load`s the file that calls `OpenvoxLint.new_check`.
+
+Registering a check name that is already present always prints a warning on
+stderr and overwrites the previous class.
+
 ### Creating a Check Plugin
 
 ```ruby
-# lib/openvox-lint/plugins/checks/my_custom_check.rb
+# my_custom_check.rb  (any path; you must require this file yourself)
 OpenvoxLint.new_check(:my_custom_check) do
   def check
     tokens.each do |tok|
@@ -1508,13 +1518,23 @@ OpenvoxLint.new_check(:my_custom_check) do
 
   # Optional: implement auto-fix
   def fix(problem)
-    # Find and modify the problematic token
-    # Or raise NoFix if this instance can't be fixed
+    # Mutate manifest_lines in place, or raise NoFix if this instance
+    # cannot be fixed. Only five built-in checks currently implement #fix.
     raise OpenvoxLint::NoFix
   end
 end
 ```
 
+Load the file after `require 'openvox-lint'` and before `Linter#run`:
+
+```ruby
+require 'openvox-lint'
+require_relative 'my_custom_check'
+```
+
+To contribute a **built-in** check to this repository, place the file in
+`lib/openvox-lint/plugins/checks/` so the gem auto-loader picks it up.
+
 ### Using Helper Methods
 
 ```ruby
@@ -1553,22 +1573,44 @@ end
 
 ### Distributing as a Gem
 
+A companion gem can depend on `openvox-lint` and ship check files, but
+**openvox-lint will not auto-discover them**. Consumers must require the
+entry point of your gem (or each check file) themselves.
+
 ```ruby
 # openvox-lint-my_checks.gemspec
 Gem::Specification.new do |spec|
   spec.name = 'openvox-lint-my_checks'
   spec.version = '1.0.0'
   spec.summary = 'Custom checks for openvox-lint'
-  
+
   spec.add_runtime_dependency 'openvox-lint', '~> 1.0'
-  
+
   spec.files = Dir['lib/**/*']
   spec.require_paths = ['lib']
 end
 ```
 
-Place check files in `lib/openvox-lint/plugins/checks/` and they will
-be auto-loaded when the gem is required.
+```ruby
+# lib/openvox-lint-my_checks.rb  (your gem's require path)
+require 'openvox-lint'
+require_relative 'openvox-lint-my_checks/no_eval'
+```
+
+```ruby
+# In a Rake task or wrapper script
+require 'openvox-lint'
+require 'openvox-lint-my_checks'
+
+linter = OpenvoxLint::Linter.new
+linter.run('manifests/')
+```
+
+Putting files under `lib/openvox-lint/plugins/checks/` inside *your* gem
+does not register them. That glob is evaluated only against this gem's
+`__dir__` in `lib/openvox-lint.rb`. There is also no `--load` flag for
+`openvox-lint` CLI invocations; wrap the CLI or call `Linter` from Ruby
+after requiring your checks.
 
 ---
 
@@ -1579,22 +1621,24 @@ broader compatibility and additional checks.
 
 ### Key Differences
 
-| Feature | puppet-lint 5.x | openvox-lint 1.x |
-|---------|-----------------|------------------|
-| Ruby requirement | ≥ 3.1 | ≥ 2.5 (works on RHEL 8, macOS system Ruby) |
+Snapshot as of 2026-09-18 against [puppetlabs/puppet-lint `main`](https://github.com/puppetlabs/puppet-lint) (README plus `lib/puppet-lint/plugins.rb`). See [docs/ARCHITECTURE_REVIEW.md](docs/ARCHITECTURE_REVIEW.md) for cites.
+
+| Feature | puppet-lint (current `main`) | openvox-lint 1.x |
+|---------|------------------------------|------------------|
+| Ruby requirement | Documented for Puppet 7/8 environments (typically ≥ 3.1 in 5.x) | ≥ 2.6 as declared in this gemspec |
 | Runtime dependencies | None | None |
-| Built-in checks | ~25 | 37 |
-| Legacy facts detection | Via plugin | Built-in |
-| Top-scope facts detection | Via plugin | Built-in |
-| Deprecated Hiera 3 function detection | No | Built-in (ERROR) |
-| Import statement detection | No | Built-in (ERROR) |
-| Strict indent check | Via plugin | Built-in |
-| GitHub Actions output | No | Built-in (`-f github`) |
-| Code Climate output | No | Built-in (`-f codeclimate`) |
-| CSV output | No | Built-in (`-f csv`) |
+| Built-in checks | Core style set plus built-in fact checks (including YAML) | 37 `.pp` checks |
+| Legacy facts detection | Built-in | Built-in |
+| Top-scope facts detection | Built-in | Built-in |
+| Deprecated Hiera 3 function detection | Not in the published core check list | Built-in (ERROR) |
+| Import statement detection | Not in the published core check list | Built-in (ERROR) |
+| Strict indent | 2-space / hard-tab rules in core | Built-in `strict_indent` |
+| GitHub Actions | `--sarif`, puppet-lint-action, env-based annotations | Built-in `-f github` |
+| Code Climate | `--codeclimate-report-file` | Built-in `-f codeclimate` |
+| CSV output | No native CSV formatter | Built-in (`-f csv`) |
 | OpenVox awareness | No | Yes |
-| `--fix` support | Yes | Yes |
-| Plugin system | Yes | Yes (compatible API) |
+| `--fix` support | Yes (token-rewriting; many core checks) | Yes, line-based, for five named checks |
+| Plugin system | `--load`, `--load-from-puppet`, gem auto-discovery | `new_check` DSL; require-your-file only (not drop-in compatible) |
 
 ### Command-Line Compatibility
 
@@ -1625,10 +1669,14 @@ Rename `.puppet-lint.rc` to `.openvox-lint.rc`.  The format is identical:
 
 ### Plugin Migration
 
-Plugin APIs are similar.  Main differences:
+The `new_check` / `#check` / `#fix` / `notify` surface looks familiar, but
+the plugin **loading** model is not compatible:
 
 1. Module name: `OpenvoxLint` instead of `PuppetLint`
 2. Check registration: `OpenvoxLint.new_check(:name)` instead of `PuppetLint.new_check(:name)`
+3. No `PuppetLint::Data` singleton — helpers live on `CheckPlugin`
+4. No gem auto-discovery and no `--load` — `require` the check file yourself
+5. `#fix` should mutate `manifest_lines`, not rewrite the token list
 
 ---
 
@@ -1660,6 +1708,7 @@ Plugin APIs are similar.  Main differences:
 | `spec/spec_helper.rb` | RSpec test helper |
 | `spec/unit/lexer_spec.rb` | Lexer unit tests |
 | `spec/unit/checks_spec.rb` | Check unit tests |
+| `spec/unit/architecture_spec.rb` | Registry, resource-index, and lexer-honesty contracts |
 | `openvox-lint.gemspec` | Gem specification |
 | `Gemfile` | Development dependencies |
 | `Rakefile` | Rake tasks |
@@ -1667,3 +1716,4 @@ Plugin APIs are similar.  Main differences:
 | `README.md` | User documentation |
 | `CHANGELOG.md` | Version history |
 | `DOCUMENTATION.md` | This file |
+| `docs/ARCHITECTURE_REVIEW.md` | Evidence-based architecture review |

data/README.md

@@ -2,7 +2,8 @@
 
 [![Gem Version](https://img.shields.io/gem/v/openvox-lint)](https://rubygems.org/gems/openvox-lint)
 [![Gem Downloads](https://img.shields.io/gem/dt/openvox-lint)](https://rubygems.org/gems/openvox-lint)
-![Ruby](https://img.shields.io/badge/ruby-%E2%89%A5%202.5-red)
+[![CI](https://github.com/cvquesty/openvox-lint/actions/workflows/ci.yml/badge.svg?branch=development)](https://github.com/cvquesty/openvox-lint/actions/workflows/ci.yml)
+![Ruby](https://img.shields.io/badge/ruby-%E2%89%A5%202.6-red)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
 ![Checks](https://img.shields.io/badge/built--in%20checks-37-brightgreen)
 ![Status](https://img.shields.io/badge/status-stable-brightgreen)
@@ -42,8 +43,8 @@ Fully compatible with:
 
 | Requirement | Version | Notes |
 |------------|---------|-------|
-| **Ruby** | ≥ 2.5.0 | Required; check with `ruby --version`. Works with macOS system Ruby (2.6), RHEL 8 system Ruby (2.5), and all newer versions. |
-| **RubyGems** | ≥ 2.0 | Included with Ruby 2.5+ |
+| **Ruby** | ≥ 2.6.0 | Required; check with `ruby --version`. Works with macOS system Ruby (2.6) and all newer versions. Ruby 2.5 is no longer claimed (dev dependency `rubocop ~> 1.50` needs ≥ 2.6). |
+| **RubyGems** | ≥ 2.0 | Included with Ruby 2.6+ |
 | **Bundler** | ≥ 2.0 | `gem install bundler` if not present |
 | **OpenVox or Puppet** | 8.x | Optional; openvox-lint works standalone without an agent |
 | **Git** | ≥ 2.0 | For installation from source |
@@ -130,10 +131,11 @@ Options:
     -f, --format FORMAT          Output format: text, json, csv, github, codeclimate
     --log-format FORMAT          Custom log format string
     --fix                        Automatically fix problems where possible
+    --no-fix                     Do not automatically fix problems (overrides --fix)
     --fail-on-warnings           Exit with error code on warnings
     --no-filename                Suppress filename in output
     --no-column                  Suppress column number in output
-    --relative                   Display relative file paths
+    --relative                   Display file paths relative to the current working directory
     --only-checks CHECKS         Comma-separated list of checks to run
     --ignore-paths PATHS         Comma-separated list of glob patterns to ignore
     --list-checks                List all available checks
@@ -162,7 +164,7 @@ openvox-lint --fail-on-warnings manifests/
 
 ### Fix mode (`--fix`)
 
-`--fix` automatically corrects problems for the checks that implement fix logic. Fixes are applied in-place and are safe for the supported cases.
+`--fix` automatically corrects problems for the checks that implement fix logic. Fixes are applied in-place and are safe for the supported cases. `--fix` must be passed on the command line; an RC file cannot enable it. `--no-fix` disables fix mode. Writes are refused when the target path is a symbolic link.
 
 Currently supported checks:
 - `trailing_whitespace` — removes trailing spaces/tabs
@@ -254,7 +256,7 @@ To see every check that openvox-lint can run:
 openvox-lint --list-checks
 ```
 
-This shows the check name, severity (warning or error), and description for all 37 built-in checks.
+This lists every built-in check name and whether it is currently enabled. Severity and description live in this README and in [DOCUMENTATION.md](DOCUMENTATION.md).
 
 ---
 
@@ -295,12 +297,13 @@ openvox-lint ships with **37 built-in checks** organized into categories:
 | `variable_is_lowercase` | warning | All variables must be lowercase |
 | `variable_contains_dash` | warning | Variables must not contain dashes |
 
-### Resources (7 checks)
+### Resources (8 checks)
 
 | Check | Severity | Description |
 |-------|----------|-------------|
 | `ensure_first_param` | warning | `ensure` must be the first attribute |
 | `ensure_not_symlink_target` | warning | Use `ensure => link` with `target` |
+| `unquoted_ensure_value` | warning | `ensure` parameter values must be single-quoted strings |
 | `file_mode` | warning | File modes as 4-digit quoted octal or symbolic |
 | `unquoted_file_mode` | warning | File modes must be quoted strings |
 | `unquoted_resource_title` | warning | Resource titles must be quoted |
@@ -365,7 +368,20 @@ openvox-lint ships with **37 built-in checks** organized into categories:
 
 ### RC File
 
-Create `.openvox-lint.rc` in your project root or `~/.openvox-lint.rc`:
+Create `.openvox-lint.rc` in your project root or `~/.openvox-lint.rc`.
+Each line is a flag (with an optional value). Only the following flags are
+read from the RC file; other CLI options (`--fix`, `--relative`,
+`--no-filename`, `--no-column`) must be passed on the command line.
+An RC file cannot enable `--fix` — pass `--fix` on the CLI to enable writes.
+
+| Flag | Effect |
+|------|--------|
+| `--fail-on-warnings` | Exit 1 when warnings are found |
+| `--no-<check_name>-check` | Disable a check |
+| `--only-checks LIST` | Run only the named checks (comma-separated) |
+| `--log-format FORMAT` | Named format (`text`, `json`, `csv`, `github`, `codeclimate`) or a custom format string (`%{path}`, `%{line}`, …) |
+| `--format FORMAT` / `-f FORMAT` | Named output format only (same allowlist as CLI `-f`) |
+| `--ignore-paths GLOBS` | Comma-separated globs to skip |
 
 ```
 # Disable specific checks
@@ -380,6 +396,12 @@ Create `.openvox-lint.rc` in your project root or `~/.openvox-lint.rc`:
 
 # Ignore paths
 --ignore-paths vendor/**/*.pp,pkg/**/*.pp
+
+# --fix in an RC file is ignored; pass --fix on the CLI to enable writes
+
+# Named format or a custom --log-format string
+# --format json
+# --log-format %{path}:%{line}:%{KIND}:%{check}:%{message}
 ```
 
 ### Inline Ignore Comments
@@ -502,10 +524,16 @@ openvox-lint --fail-on-warnings $files
 
 ## Writing Custom Checks
 
+openvox-lint auto-loads **only** the built-in files shipped in this gem
+(`lib/openvox-lint/plugins/checks/*.rb`). There is no `--load FILE` flag and
+no RubyGems plugin discovery. A third-party check is picked up only when
+something in the same Ruby process `require`s (or `load`s) the file after
+`openvox-lint` itself.
+
 Create a Ruby file with a check plugin:
 
 ```ruby
-# lib/openvox-lint/plugins/checks/my_custom_check.rb
+# my_custom_check.rb  (any path you control)
 OpenvoxLint.new_check(:my_custom_check) do
   def check
     tokens.each do |tok|
@@ -520,7 +548,24 @@ OpenvoxLint.new_check(:my_custom_check) do
 end
 ```
 
-Place in `lib/openvox-lint/plugins/checks/` and it will be auto-loaded.
+Load it explicitly before you run the linter:
+
+```ruby
+require 'openvox-lint'
+require_relative 'my_custom_check'
+
+linter = OpenvoxLint::Linter.new
+linter.run('manifests/')
+```
+
+Duplicate `new_check` names always warn on stderr and overwrite the previous
+registration. Putting a file under `lib/openvox-lint/plugins/checks/` in
+*your* gem does not make openvox-lint load it.
+
+To add a check to this repository, place it in
+`lib/openvox-lint/plugins/checks/` so the built-in auto-loader picks it up.
+See [DOCUMENTATION.md](DOCUMENTATION.md#plugin-development) and
+[docs/ARCHITECTURE_REVIEW.md](docs/ARCHITECTURE_REVIEW.md).
 
 ---
 
@@ -548,7 +593,7 @@ bundle update openvox-lint
 
 ```bash
 cd openvox-lint
-git pull origin main
+git pull origin development
 gem build openvox-lint.gemspec
 gem install openvox-lint-*.gem
 ```
@@ -619,12 +664,14 @@ openvox-lint/
 │       ├── linter.rb             # File-level orchestrator
 │       ├── cli.rb                # Command-line interface
 │       └── plugins/
-│           └── checks/           # 38 built-in check plugins
+│           └── checks/           # 37 built-in check plugins
 │               ├── trailing_whitespace.rb
 │               ├── legacy_facts.rb
 │               ├── hiera3_function.rb
 │               └── ...
 ├── spec/                         # RSpec test suite
+├── docs/
+│   └── ARCHITECTURE_REVIEW.md    # Evidence-based architecture notes
 ├── openvox-lint.gemspec
 ├── Gemfile
 ├── Rakefile
@@ -638,23 +685,25 @@ openvox-lint/
 
 ## Comparison with puppet-lint
 
-| Feature | puppet-lint 5.x | openvox-lint 1.3.1 |
-|---------|-----------------|------------------|
-| Ruby requirement | ≥ 3.1 | ≥ 2.5 (RHEL 8, macOS, all modern platforms) |
+Snapshot as of 2026-09-18 against [puppetlabs/puppet-lint `main` README and `lib/puppet-lint/plugins.rb`](https://github.com/puppetlabs/puppet-lint). puppet-lint remains under active maintenance; treat this table as dated evidence, not a permanent scorecard.
+
+| Feature | puppet-lint (current `main`) | openvox-lint 1.3.4 |
+|---------|------------------------------|--------------------|
+| Ruby requirement | Documented for Puppet 7/8 environments (typically ≥ 3.1 in 5.x) | ≥ 2.6 as declared in this gemspec |
 | Runtime dependencies | None | None |
-| Built-in checks | ~25 | 37 |
-| Legacy facts detection | Via plugin | Built-in |
-| Top-scope facts detection | Via plugin | Built-in |
-| Deprecated Hiera 3 function detection | No | Built-in (error) |
-| Import statement detection | No | Built-in (error) |
-| Strict indent check | Via plugin | Built-in |
-| GitHub Actions output | No | Built-in (`-f github`) |
-| Code Climate output | No | Built-in (`-f codeclimate`) |
-| CSV output | No | Built-in (`-f csv`) |
-| Custom log format | Yes | Yes (compatible) |
+| Built-in checks | Core style set plus built-in `legacy_facts` / `top_scope_facts` (including YAML facts) | 37 `.pp` checks |
+| Legacy facts detection | Built-in (not plugin-only) | Built-in |
+| Top-scope facts detection | Built-in (not plugin-only) | Built-in |
+| Deprecated Hiera 3 function detection | Not in the published core check list | Built-in (error) |
+| Import statement detection | Not in the published core check list | Built-in (error) |
+| Strict indent | 2-space / hard-tab rules in core; stricter indent historically a plugin | Built-in `strict_indent` |
+| GitHub Actions | `--sarif`, [puppet-lint-action](https://github.com/marketplace/actions/puppet-lint-action), env-based annotations | Built-in `-f github` workflow commands |
+| Code Climate | `--codeclimate-report-file` / `CODECLIMATE_REPORT_FILE` | Built-in `-f codeclimate` |
+| CSV output | No native CSV formatter | Built-in (`-f csv`) |
+| Custom log format | Yes (`%{path}`, `%{filename}`, `%{fullpath}`, …) | Yes (same core placeholders; no `%{filename}` / `%{fullpath}`) |
 | OpenVox awareness | No | Yes |
-| Plugin system | Yes | Yes (compatible) |
-| `--fix` support | Yes | Yes (real implementations for trailing_whitespace, hard_tabs, quoted_booleans, double_quoted_strings, single_quote_string_with_variables + line-based) |
+| Plugin system | `--load FILE`, `--load-from-puppet`, gem auto-discovery via `PuppetLint::Plugins.load_from_gems` | `OpenvoxLint.new_check` DSL; **require-your-file only** — no `--load`, no gem auto-discovery |
+| `--fix` support | Yes (token-rewriting; many core checks) | Yes, line-based, for five checks: `trailing_whitespace`, `hard_tabs`, `quoted_booleans`, `double_quoted_strings`, `single_quote_string_with_variables` |
 | vim-openvox integration | No | Native |
 
 ---