puppet-check 2.5.0 → 2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a0fcb7ee7b05692747da7d0449b6bd442c3078311c0bcbd2e25bd56e491decd
-  data.tar.gz: 6ef3744b4c7a008c2a3042fd41b9bddc5f3dd236322180a8ff8cbc51df870b87
+  metadata.gz: 98b3c25f3adb4837ec7ce74efb4e06c422defab2a7360646b4daae7dda962c0f
+  data.tar.gz: 4814ad9b99fd205914ad1b976280d70479264ebff708aa0390a22346d1c4c1e6
 SHA512:
-  metadata.gz: 8bdf3f7e6ba85fa4917329314f7f87382940b5e039a49891eb8d789aa57861d0e91b9f63b0d2a738523ffe1fb056e30842005d0f1bc06312859420ac9df1986e
-  data.tar.gz: 01f4cd1102f300ffa35b4943c8426b2e91db54b68bfb439489b4f88efce58248abd8839d738681cc2f6c2d55c46241aed13ff455cc2eb059374b3c6589c137b5
+  metadata.gz: 714bc3ea74a76dd03a2dac33274e12b236f898cfe5f6257ea1a04dd7f0a61124d4509d1b73e2c74f2bf8b8d987aa3343ece7fce5a8e387a211464f400e7aecc7
+  data.tar.gz: 9c0737fee70f019f5189a499981b4a54b1449cb43d297b92ce2e8da5fe13dfa7194b4239db4417394626747de8acc250b3d5388b20687a469998c02d4b46418d

data/CHANGELOG.md

@@ -1,3 +1,16 @@
+### 2.5.2
+- Fix incorrect exit code `0` when `octocatalog` detects catalog compilation failure.
+- Avoid mutation of and optimize Rubocop argument interfacing.
+- Fix existing module install check when using Puppet Forge source for RSpec.
+- Upgrade EYAML validation functionality from beta to release candidate.
+
+### 2.5.1
+- Fix explicit `fail_on_warnings` default value assignment.
+- Improve message transformation for Puppet::Face errors and warnings.
+- Improve EYAML certification validation check.
+- Verify that files to be validated are readable by current user.
+- Fix Puppet 5.4-6.4 syntax error output format.
+
 ### 2.5.0
 - Minimum Ruby version increased to 3.1.
 - Minimum Puppet-Lint increased to 5.0.

data/README.md

@@ -13,7 +13,7 @@
 ## Description
 Puppet Check is a gem that provides a comprehensive, streamlined, and efficient analysis of the syntax, style, and validity of your entire Puppet code and data.
 
-**IMPORTANT**: The current support for encrypted yaml validation is experimental and should be considered a beta feature as of 2.3.0.
+**IMPORTANT**: The current support for encrypted yaml validation is semi-experimental and should be considered a release candidate feature as of 2.5.2.
 
 ### Former Method for Code and Data Checks
 ![Old](https://raw.githubusercontent.com/mschuchard/puppet-check/master/images/puppetcheck_old.png)

data/lib/puppet-check/data_parser.rb

@@ -25,6 +25,7 @@ class DataParser
   # checks eyaml (.eyaml/.eyml)
   def self.eyaml(files, public, private)
     require 'openssl'
+    require 'base64'
 
     # keys specified?
     if public.nil? || private.nil?
@@ -33,43 +34,56 @@ class DataParser
     end
 
     # keys exist?
-    unless File.file?(public) && File.file?(private)
+    unless File.readable?(public) && File.readable?(private)
       PuppetCheck.files[:ignored].concat(files)
-      return warn 'Specified Public X509 and/or Private RSA PKCS7 certs do not exist. EYAML checks will not be executed.'
+      return warn 'Specified Public X509 and/or Private RSA PKCS7 certs do not exist or are not readable. EYAML checks will not be executed.'
     end
 
     # setup decryption
     rsa = OpenSSL::PKey::RSA.new(File.read(private))
     x509 = OpenSSL::X509::Certificate.new(File.read(public))
 
+    # iterate through files and decrypt eyaml values
     files.each do |file|
-      # check encoded yaml syntax
+      # load the file
       parsed = YAML.safe_load_file(file, permitted_classes: [Symbol], permitted_symbols: [], aliases: true)
 
-      # extract encoded values
-      # ENC[PKCS7]
-
-      # decrypt the encoded yaml
-      # decrypted = OpenSSL::PKCS7.new(File.read(file)).decrypt(rsa, x509)
-
-      # check decoded eyaml syntax
-      # decoded = YAML.safe_load(decrypted)
-
-      # merge data hashes
-      # parsed = merge(parsed, decoded)
+      # decrypt any ENC[PKCS7,...] leaf values found in the parsed structure
+      decoded = decrypt_eyaml(parsed, rsa, x509)
     rescue StandardError => err
       PuppetCheck.files[:errors][file] = err.to_s.gsub("(#{file}): ", '').split("\n")
     else
       warnings = []
 
       # perform some rudimentary hiera checks if data exists and is hieradata
-      warnings = hiera(parsed, file) if parsed
+      warnings = hiera(decoded, file) if decoded
 
       next PuppetCheck.files[:warnings][file] = warnings unless warnings.empty?
       PuppetCheck.files[:clean].push(file.to_s)
     end
   end
 
+  # recursively decrypts ENC[PKCS7,...] leaf values in a parsed eyaml structure
+  private_class_method def self.decrypt_eyaml(data, rsa, x509)
+    case data
+    when Hash
+      # recurse into hash values, keys are never encrypted
+      data.transform_values { |v| decrypt_eyaml(v, rsa, x509) }
+    when Array
+      # recurse into array elements
+      data.map { |v| decrypt_eyaml(v, rsa, x509) }
+    when String
+      # leave plain (non-ENC) strings untouched
+      match = data.match(/\AENC\[PKCS7,(.+)\]\z/m)
+      return data unless match
+
+      # decode the base64 payload to DER and decrypt
+      OpenSSL::PKCS7.new(Base64.decode64(match[1])).decrypt(rsa, x509)
+    else
+      data
+    end
+  end
+
   # metadata consts
   REQUIRED_KEYS = %w[name version author license summary source dependencies].freeze
   REQ_DEP_KEYS = %w[requirements dependencies].freeze

data/lib/puppet-check/puppet_parser.rb

@@ -32,12 +32,12 @@ class PuppetParser
         new_error = Puppet::Face[:parser, :current].validate(file)
         # puppet 6.5 output format is now a hash from the face api
         if Gem::Version.new(Puppet::PUPPETVERSION) >= Gem::Version.new('6.5.0') && new_error != {}
-          messages.concat(new_error.values.map(&:to_s).map { |error| error.gsub(/ \(file: #{File.absolute_path(file)}(, |\))/, '') }.map { |error| error.gsub('Could not parse for environment *root*: ', '') })
+          messages.concat(new_error.values.map(&:to_s).map { |error| error.gsub(Regexp.escape(" (file: #{File.absolute_path(file)}(, |))"), '') }.map { |error| error.gsub('Could not parse for environment *root*: ', '') })
         end
       # this is the actual error that we need to rescue Puppet::Face from
       rescue SystemExit
         # puppet 5.4-6.4 has a new validator output format and eof errors have fake dir env info
-        messages.concat(errors.map(&:to_s).join("\n").map { |error| error.gsub(/file: #{File.absolute_path(file)}(, |\))/, '') }.map { |error| error.gsub(/Could not parse.*: /, '') })
+        messages.concat(errors.map(&:to_s).map { |error| error.gsub(Regexp.escape("file: #{File.absolute_path(file)}(, |))"), '') }.map { |error| error.gsub(/Could not parse.*: /, '') })
       end
 
       Puppet::Util::Log.close_all
@@ -50,7 +50,7 @@ class PuppetParser
       # weirdly puppet >= 6.5 still does not return warnings and logs them instead unlike errors
       unless errors.empty?
         # puppet >= 5.4 has a new validator output format
-        warnings.concat(errors.map(&:to_s).join("\n").gsub("file: #{File.absolute_path(file)}, ", '').split("\n"))
+        warnings.concat(errors.map(&:to_s).join("\n").gsub(Regexp.escape("file: #{File.absolute_path(file)}(, |))"), '').split("\n"))
       end
 
       # check puppet style

data/lib/puppet-check/rspec_puppet_support.rb

@@ -97,7 +97,7 @@ class RSpecPuppetSupport
   # download external module dependency with forge
   private_class_method def self.forge(forge_name, args = '')
     # is the module present? do an upgrade; otherwise, do an install
-    subcommand = File.directory?("spec/fixtures/modules/#{forge_name}") ? 'upgrade' : 'install'
+    subcommand = File.directory?("spec/fixtures/modules/#{forge_name.split('-').last}") ? 'upgrade' : 'install'
     spawn("puppet module #{subcommand} --modulepath spec/fixtures/modules/ #{args} #{forge_name}")
   end
 

data/lib/puppet-check/ruby_parser.rb

@@ -23,10 +23,15 @@ class RubyParser
       # check ruby style
       if style
         # add rubocop rspec plugin if the file is a spec
-        rc_args.push('--plugin', 'rubocop-rspec') if file =~ /_spec\.rb$/
+        if file =~ /_spec\.rb$/
+          # invoke RuboCop with rspec plugin
+          rubocop_warnings = Utils.capture_stdout { rubocop_cli.run(rc_args + ['--plugin', 'rubocop-rspec','--enable-pending-cops', '--plugin', 'rubocop-performance', '--format', 'json', file]) }
+        else
+          # invoke rubocop
+          rubocop_warnings = Utils.capture_stdout { rubocop_cli.run(rc_args + ['--enable-pending-cops', '--plugin', 'rubocop-performance', '--format', 'json', file]) }
+        end
 
-        # check RuboCop and parse warnings' JSON output
-        rubocop_warnings = Utils.capture_stdout { rubocop_cli.run(rc_args + ['--enable-pending-cops', '--plugin', 'rubocop-performance', '--format', 'json', file]) }
+        # parse rubocop offenses' structured JSON output
         rubocop_offenses = JSON.parse(rubocop_warnings)['files'][0]['offenses'].map { |warning| "#{warning['location']['line']}:#{warning['location']['column']} #{warning['message']}" }
 
         # check Reek using examiner api

data/lib/puppet_check.rb

@@ -42,12 +42,15 @@ class PuppetCheck
       # if octocatalog-diff is not installed then continue immediately
       rescue NameError
         puts 'puppet-check: immediately continuing to results'
+        0
       # smoke check failure? output message and return 2
       rescue OctocatalogDiff::Errors::CatalogError => err
         puts 'There was a smoke check error:'
         puts err
         puts catalog.error_message unless catalog.valid?
         2
+      else
+        0
       end
       # perform regression checks if there were no errors and the user desires
       # begin
@@ -61,7 +64,6 @@ class PuppetCheck
 
       # code to output differences in catalog?
       # everything passed? return 0
-      0
     else
       # error files? return 2
       2
@@ -75,7 +77,7 @@ class PuppetCheck
     # return settings with defaults where unspecified
     {
       # initialize fail on warning,  style check, and regression check bools
-      fail_on_warning: false,
+      fail_on_warnings: false,
       style: false,
       smoke: false,
       regression: false,
@@ -101,11 +103,11 @@ class PuppetCheck
     paths.uniq.each do |path|
       if File.directory?(path)
         # glob all files in directory and concat them
-        files.concat(Dir.glob("#{path}/**/*").select { |subpath| File.file?(subpath) && !subpath.include?('fixtures') })
-      elsif File.file?(path) && !path.include?('fixtures')
+        files.concat(Dir.glob("#{path}/**/*").select { |subpath| File.file?(subpath) && File.readable?(subpath) && !subpath.include?('fixtures') })
+      elsif File.file?(path) && File.readable?(path) && !path.include?('fixtures')
         files.push(path)
       else
-        warn "puppet-check: #{path} is not a directory, file, or symlink, and will not be considered during parsing"
+        warn "puppet-check: #{path} is not a readable directory, file, or symlink, and will not be considered during parsing"
       end
     end
 
@@ -120,14 +122,14 @@ class PuppetCheck
     manifests, files = files.partition { |file| File.extname(file) == '.pp' }
     PuppetParser.manifest(manifests, style, puppetlint_args) unless manifests.empty?
     # check puppet templates
-    templates, files = files.partition { |file| File.extname(file) == '.epp' }
-    PuppetParser.template(templates) unless templates.empty?
+    epp, files = files.partition { |file| File.extname(file) == '.epp' }
+    PuppetParser.template(epp) unless epp.empty?
     # check ruby files
     rubies, files = files.partition { |file| File.extname(file) == '.rb' }
     RubyParser.ruby(rubies, style, rubocop_args) unless rubies.empty?
     # check ruby templates
-    templates, files = files.partition { |file| File.extname(file) == '.erb' }
-    RubyParser.template(templates) unless templates.empty?
+    erb, files = files.partition { |file| File.extname(file) == '.erb' }
+    RubyParser.template(erb) unless erb.empty?
     # check yaml data
     yamls, files = files.partition { |file| File.extname(file) =~ /\.ya?ml$/ }
     DataParser.yaml(yamls) unless yamls.empty?

data/puppet-check.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |spec|
   spec.name          = 'puppet-check'
-  spec.version       = '2.5.0'
+  spec.version       = '2.5.2'
   spec.authors       = ['Matt Schuchard']
   spec.description   = 'Puppet Check is a gem that provides a comprehensive, streamlined, and efficient analysis of the syntax, style, and validity of your entire Puppet code and data.'
   spec.summary       = 'A streamlined comprehensive set of checks for your entire Puppet code and data'

data/spec/fixtures/hieradata/decrypt_error.eyaml

@@ -0,0 +1,3 @@
+---
+bad:
+  eyaml: ENC[PKCS7,not-a-valid-pkcs7-payload==]

data/spec/fixtures/hieradata/nested_array.eyaml

@@ -0,0 +1,6 @@
+---
+items:
+- name: one
+  secret: ENC[PKCS7,MIIBeQYJKoZIhvcNAQcDoIIBajCCAWYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAWYkSR19bdTGCu3NUMRGjHUIkXidzM4ejpICm7voB4JLUYyrwPxnvb8d761VA6JJwLe6dPmppm1x62k6Sp9HXyP3BqkhBlshLsgbNSbhMoLBPxfpjQhRTDFbeqZq35aY6grqj25AYB18Grfja8RoSK4jLHBECPJr0lUgW4qBANgV7KcaZndwxyDfTPFA3vCtc4r1l/r4Bg9esyV3ClJHP5A7bOmw38aibGcu1O4CHLEHCt3plvqrF7vElSFBJi62I7omGvdJitY+CVe6eTJiHLn3HnP9jeRGdRiC2eGhS+A7sE8JXK3n/ZtKFiH78payBlU6BWolgapBC3RnFw9jabTA8BgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB/Ep4/M8NuRlUOin0nQKjXgBArdhX8G2RtUEdfdl3ujD89]
+- name: two
+  secret: plain

data/spec/puppet-check/cli_spec.rb

@@ -6,7 +6,7 @@ describe PuppetCheck::CLI do
     it 'targets the current working directory if no paths were specified' do
       expect { PuppetCheck::CLI.run(%w[--fail-on-warnings]) }.not_to raise_exception
       expect(PuppetCheck.files[:clean].length).to eql(29)
-      if ci_env
+      if CI_ENV
         expect(PuppetCheck.files[:ignored].length).to eql(8)
       else
         expect(PuppetCheck.files[:ignored].length).to eql(7)
@@ -40,7 +40,7 @@ describe PuppetCheck::CLI do
     end
 
     it 'correctly loads a .puppet-lint.rc' do
-      expect(PuppetCheck::CLI.send(:parse, %W[-c #{fixtures_dir}/manifests/.puppet-lint.rc])).to include(puppetlint_args: ['--puppetlint-arg-one', '--puppetlint-arg-two'])
+      expect(PuppetCheck::CLI.send(:parse, %W[-c #{FIXTURES_DIR}/manifests/.puppet-lint.rc])).to include(puppetlint_args: ['--puppetlint-arg-one', '--puppetlint-arg-two'])
     end
 
     it 'correctly parses Rubocop arguments' do

data/spec/puppet-check/data_parser_spec.rb

@@ -13,24 +13,24 @@ describe DataParser do
 
   context '.yaml' do
     it 'puts a bad syntax yaml file in the error files hash' do
-      DataParser.yaml(["#{fixtures_dir}hieradata/syntax.yaml"])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}hieradata/syntax.yaml"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}hieradata/syntax.yaml"].join("\n")).to match(/^block sequence entries are not allowed/)
+      DataParser.yaml(["#{FIXTURES_DIR}hieradata/syntax.yaml"])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}hieradata/syntax.yaml"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/syntax.yaml"].join("\n")).to match(/^block sequence entries are not allowed/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good yaml file with potential hiera issues in the warning files array' do
-      DataParser.yaml(["#{fixtures_dir}hieradata/style.yaml"])
+      DataParser.yaml(["#{FIXTURES_DIR}hieradata/style.yaml"])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}hieradata/style.yaml"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}hieradata/style.yaml"].join("\n")).to match(/^Value\(s\) missing in key.*\nValue\(s\) missing in key.*\nThe string --- appears more than once in this data and Hiera may fail to parse it correctly/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}hieradata/style.yaml"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}hieradata/style.yaml"].join("\n")).to match(/^Value\(s\) missing in key.*\nValue\(s\) missing in key.*\nThe string --- appears more than once in this data and Hiera may fail to parse it correctly/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good yaml file in the clean files array' do
-      DataParser.yaml(["#{fixtures_dir}hieradata/good.yaml"])
+      DataParser.yaml(["#{FIXTURES_DIR}hieradata/good.yaml"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}hieradata/good.yaml"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}hieradata/good.yaml"])
     end
   end
 
@@ -42,83 +42,141 @@ describe DataParser do
       expect { DataParser.eyaml(['foo.eyaml'], 'public.pem', nil) }.to output("Public X509 and/or Private RSA PKCS7 certs were not specified. EYAML checks will not be executed.\n").to_stderr
     end
     it 'returns a warning if the public key or private key are not existing files' do
-      expect { DataParser.eyaml(['foo.eyaml'], 'public.pem', 'private.pem') }.to output("Specified Public X509 and/or Private RSA PKCS7 certs do not exist. EYAML checks will not be executed.\n").to_stderr
+      expect { DataParser.eyaml(['foo.eyaml'], 'public.pem', 'private.pem') }.to output("Specified Public X509 and/or Private RSA PKCS7 certs do not exist or are not readable. EYAML checks will not be executed.\n").to_stderr
     end
     it 'puts a bad syntax eyaml file in the error files hash' do
-      DataParser.eyaml(["#{fixtures_dir}hieradata/syntax.eyaml"], "#{fixtures_dir}keys/public_key.pkcs7.pem", "#{fixtures_dir}keys/private_key.pkcs7.pem")
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}hieradata/syntax.eyaml"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}hieradata/syntax.eyaml"].join("\n")).to match(/^block sequence entries are not allowed/)
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/syntax.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}hieradata/syntax.eyaml"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/syntax.eyaml"].join("\n")).to match(/^block sequence entries are not allowed/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good eyaml file with potential hiera issues in the warning files array' do
-      DataParser.eyaml(["#{fixtures_dir}hieradata/style.eyaml"], "#{fixtures_dir}keys/public_key.pkcs7.pem", "#{fixtures_dir}keys/private_key.pkcs7.pem")
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/style.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}hieradata/style.eyaml"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}hieradata/style.eyaml"].join("\n")).to match(/^Value\(s\) missing in key.*\nValue\(s\) missing in key.*\nThe string --- appears more than once in this data and Hiera may fail to parse it correctly/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}hieradata/style.eyaml"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}hieradata/style.eyaml"].join("\n")).to match(/^Value\(s\) missing in key.*\nValue\(s\) missing in key.*\nThe string --- appears more than once in this data and Hiera may fail to parse it correctly/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good eyaml file in the clean files array' do
-      DataParser.eyaml(["#{fixtures_dir}hieradata/good.eyaml"], "#{fixtures_dir}keys/public_key.pkcs7.pem", "#{fixtures_dir}keys/private_key.pkcs7.pem")
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/good.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}hieradata/good.eyaml"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}hieradata/good.eyaml"])
+    end
+    it 'puts an eyaml file with an undecryptable PKCS7 payload in the error files hash; distinctly from a YAML syntax error' do
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"].join("\n")).to match(/PKCS7/i)
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/decrypt_error.eyaml"].join("\n")).not_to match(/^block sequence entries are not allowed/)
+      expect(PuppetCheck.files[:warnings]).to eql({})
+      expect(PuppetCheck.files[:clean]).to eql([])
+    end
+    it 'decrypts an ENC[PKCS7,...] value nested inside an array of hashes and puts the file in the clean files array' do
+      DataParser.eyaml(["#{FIXTURES_DIR}hieradata/nested_array.eyaml"], "#{FIXTURES_DIR}keys/public_key.pkcs7.pem", "#{FIXTURES_DIR}keys/private_key.pkcs7.pem")
+      expect(PuppetCheck.files[:errors]).to eql({})
+      expect(PuppetCheck.files[:warnings]).to eql({})
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}hieradata/nested_array.eyaml"])
+    end
+  end
+
+  context '.decrypt_eyaml' do
+    before(:all) do
+      require 'openssl'
+      require 'base64'
+    end
+
+    let(:rsa) { OpenSSL::PKey::RSA.new(File.read("#{FIXTURES_DIR}keys/private_key.pkcs7.pem")) }
+    let(:x509) { OpenSSL::X509::Certificate.new(File.read("#{FIXTURES_DIR}keys/public_key.pkcs7.pem")) }
+
+    # encrypts a plaintext value against the fixture cert and wraps it as eyaml expects
+    def encrypt(plaintext)
+      pkcs7 = OpenSSL::PKCS7.encrypt([x509], plaintext, OpenSSL::Cipher.new('AES-256-CBC'), OpenSSL::PKCS7::BINARY)
+      "ENC[PKCS7,#{Base64.strict_encode64(pkcs7.to_der)}]"
+    end
+
+    it 'decrypts a single ENC[PKCS7,...] string to its original plaintext' do
+      expect(DataParser.send(:decrypt_eyaml, encrypt('puppetcheck'), rsa, x509)).to eql('puppetcheck')
+    end
+    it 'leaves a plain non-ENC string untouched' do
+      expect(DataParser.send(:decrypt_eyaml, 'plaintext value', rsa, x509)).to eql('plaintext value')
+    end
+    it 'leaves a string that merely resembles but does not fully match the ENC[PKCS7,...] pattern untouched' do
+      expect(DataParser.send(:decrypt_eyaml, 'prefix ENC[PKCS7,abc] suffix', rsa, x509)).to eql('prefix ENC[PKCS7,abc] suffix')
+    end
+    it 'recurses into hash values and decrypts them, while never decrypting hash keys' do
+      encrypted = encrypt('secret-value')
+      result = DataParser.send(:decrypt_eyaml, { encrypted => 'plain-key-value', 'plain-key' => encrypted }, rsa, x509)
+      expect(result.keys).to eql([encrypted, 'plain-key'])
+      expect(result[encrypted]).to eql('plain-key-value')
+      expect(result['plain-key']).to eql('secret-value')
+    end
+    it 'recurses into array elements and decrypts them' do
+      expect(DataParser.send(:decrypt_eyaml, ['plain', encrypt('array-secret')], rsa, x509)).to eql(['plain', 'array-secret'])
+    end
+    it 'recurses through nested hash/array/hash structures' do
+      expect(DataParser.send(:decrypt_eyaml, { 'list' => [{ 'inner' => encrypt('nested-secret') }] }, rsa, x509)).to eql({ 'list' => [{ 'inner' => 'nested-secret' }] })
+    end
+    it 'returns non-string/hash/array scalars unchanged' do
+      expect(DataParser.send(:decrypt_eyaml, 42, rsa, x509)).to eql(42)
+      expect(DataParser.send(:decrypt_eyaml, nil, rsa, x509)).to be_nil
+      expect(DataParser.send(:decrypt_eyaml, true, rsa, x509)).to be true
     end
   end
 
   context '.json' do
     it 'puts a bad syntax json file in the error files hash' do
-      DataParser.json(["#{fixtures_dir}hieradata/syntax.json"])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}hieradata/syntax.json"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}hieradata/syntax.json"].join("\n")).to match(/after object value, got.*at line 2 column 3/)
+      DataParser.json(["#{FIXTURES_DIR}hieradata/syntax.json"])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}hieradata/syntax.json"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}hieradata/syntax.json"].join("\n")).to match(/after object value, got.*at line 3 column 3/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad metadata json file in the error files hash' do
-      DataParser.json(["#{fixtures_dir}metadata_syntax/metadata.json"])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}metadata_syntax/metadata.json"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}metadata_syntax/metadata.json"].join("\n")).to match(/^Required field.*\nField 'requirements'.*\nDuplicate dependencies.*\nDeprecated field.*\nSummary exceeds/)
+      DataParser.json(["#{FIXTURES_DIR}metadata_syntax/metadata.json"])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}metadata_syntax/metadata.json"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}metadata_syntax/metadata.json"].join("\n")).to match(/^Required field.*\nField 'requirements'.*\nDuplicate dependencies.*\nDeprecated field.*\nSummary exceeds/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style metadata json file in the warning files array' do
-      DataParser.json(["#{fixtures_dir}metadata_style/metadata.json"])
+      DataParser.json(["#{FIXTURES_DIR}metadata_style/metadata.json"])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}metadata_style/metadata.json"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}metadata_style/metadata.json"].join("\n")).to match(/^'pe' is missing an upper bound.\n.*operatingsystem_support.*\nLicense identifier/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}metadata_style/metadata.json"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}metadata_style/metadata.json"].join("\n")).to match(/^'pe' is missing an upper bound.\n.*operatingsystem_support.*\nLicense identifier/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts another bad style metadata json file in the warning files array' do
-      DataParser.json(["#{fixtures_dir}metadata_style_two/metadata.json"])
+      DataParser.json(["#{FIXTURES_DIR}metadata_style_two/metadata.json"])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}metadata_style_two/metadata.json"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}metadata_style_two/metadata.json"].join("\n")).to match(%r{^'puppetlabs/one' has non-semantic versioning.*\n'puppetlabs/two' is missing an upper bound\.\n.*operatingsystem.*\n.*operatingsystemrelease})
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}metadata_style_two/metadata.json"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}metadata_style_two/metadata.json"].join("\n")).to match(%r{^'puppetlabs/one' has non-semantic versioning.*\n'puppetlabs/two' is missing an upper bound\.\n.*operatingsystem.*\n.*operatingsystemrelease})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad task metadata json file in the warning files array' do
-      DataParser.json(["#{fixtures_dir}task_metadata/task_bad.json"])
+      DataParser.json(["#{FIXTURES_DIR}task_metadata/task_bad.json"])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}task_metadata/task_bad.json"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}task_metadata/task_bad.json"].join("\n")).to match(/^description value is not a String\ninput_method value is not one of environment, stdin, or powershell\nparameters value is not a Hash\npuppet_task_version value is not an Integer\nsupports_noop value is not a Boolean/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}task_metadata/task_bad.json"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}task_metadata/task_bad.json"].join("\n")).to match(/^description value is not a String\ninput_method value is not one of environment, stdin, or powershell\nparameters value is not a Hash\npuppet_task_version value is not an Integer\nsupports_noop value is not a Boolean/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good json file in the clean files array' do
-      DataParser.json(["#{fixtures_dir}hieradata/good.json"])
+      DataParser.json(["#{FIXTURES_DIR}hieradata/good.json"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}hieradata/good.json"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}hieradata/good.json"])
     end
     it 'puts a good metadata json file in the clean files array' do
-      DataParser.json(["#{fixtures_dir}metadata_good/metadata.json"])
+      DataParser.json(["#{FIXTURES_DIR}metadata_good/metadata.json"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}metadata_good/metadata.json"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}metadata_good/metadata.json"])
     end
     it 'puts a good task metadata json file in the clean files array' do
-      DataParser.json(["#{fixtures_dir}task_metadata/task_good.json"])
+      DataParser.json(["#{FIXTURES_DIR}task_metadata/task_good.json"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}task_metadata/task_good.json"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}task_metadata/task_good.json"])
     end
   end
-end
+end

data/spec/puppet-check/puppet_parser_spec.rb

@@ -13,12 +13,12 @@ describe PuppetParser do
 
   context '.manifest' do
     it 'puts a bad syntax Puppet manifest in the error files hash' do
-      PuppetParser.manifest(["#{fixtures_dir}manifests/syntax.pp"], false, [])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}manifests/syntax.pp"])
+      PuppetParser.manifest(["#{FIXTURES_DIR}manifests/syntax.pp"], false, [])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}manifests/syntax.pp"])
       if Gem::Version.new(Puppet::PUPPETVERSION) >= Gem::Version.new('6.5.0')
-        expect(PuppetCheck.files[:errors]["#{fixtures_dir}manifests/syntax.pp"].join("\n")).to match(/^Language validation logged 2 errors/)
+        expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}manifests/syntax.pp"].join("\n")).to match(/^Language validation logged 2 errors/)
       else
-        expect(PuppetCheck.files[:errors]["#{fixtures_dir}hieradata/syntax.yaml"].join("\n")).to match(/^This Variable has no effect.*\nIllegal variable name/)
+        expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}manifests/syntax.pp"].join("\n")).to match(/^This Variable has no effect.*\nIllegal variable name/)
       end
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
@@ -26,77 +26,77 @@ describe PuppetParser do
     # puppet 5 api has output issues for this fixture
     unless Gem::Version.new(Puppet::PUPPETVERSION) < Gem::Version.new('6.0.0')
       it 'puts a bad syntax at eof Puppet manifest in the error files hash' do
-        PuppetParser.manifest(["#{fixtures_dir}manifests/eof_syntax.pp"], false, [])
-        expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}manifests/eof_syntax.pp"])
-        expect(PuppetCheck.files[:errors]["#{fixtures_dir}manifests/eof_syntax.pp"].join("\n")).to match(/^Syntax error at end of input/)
+        PuppetParser.manifest(["#{FIXTURES_DIR}manifests/eof_syntax.pp"], false, [])
+        expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}manifests/eof_syntax.pp"])
+        expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}manifests/eof_syntax.pp"].join("\n")).to match(/^Syntax error at end of input/)
         expect(PuppetCheck.files[:warnings]).to eql({})
         expect(PuppetCheck.files[:clean]).to eql([])
       end
     end
     it 'puts a bad syntax Puppet plan in the error files hash' do
-      PuppetParser.manifest(["#{fixtures_dir}plans/syntax.pp"], false, [])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}plans/syntax.pp"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}plans/syntax.pp"].join("\n")).to match(/^Syntax error at '\)'/)
+      PuppetParser.manifest(["#{FIXTURES_DIR}plans/syntax.pp"], false, [])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}plans/syntax.pp"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}plans/syntax.pp"].join("\n")).to match(/^Syntax error at '\)'/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad parser style and lint style Puppet manifest in the warning files array' do
-      PuppetParser.manifest(["#{fixtures_dir}manifests/style_parser.pp"], true, [])
+      PuppetParser.manifest(["#{FIXTURES_DIR}manifests/style_parser.pp"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}manifests/style_parser.pp"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}manifests/style_parser.pp"].join("\n")).to match(/^Unrecognized escape sequence.*\nUnrecognized escape sequence.*\n.*double quoted string containing/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}manifests/style_parser.pp"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}manifests/style_parser.pp"].join("\n")).to match(/^Unrecognized escape sequence.*\nUnrecognized escape sequence.*\n.*double quoted string containing/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad lint style Puppet manifest in the warning files array' do
-      PuppetParser.manifest(["#{fixtures_dir}manifests/style_lint.pp"], true, [])
+      PuppetParser.manifest(["#{FIXTURES_DIR}manifests/style_lint.pp"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}manifests/style_lint.pp"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}manifests/style_lint.pp"].join("\n")).to match(/(?:indentation of|double quoted string containing).*\n.*(?:indentation of|double quoted string containing)/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}manifests/style_lint.pp"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}manifests/style_lint.pp"].join("\n")).to match(/(?:indentation of|double quoted string containing).*\n.*(?:indentation of|double quoted string containing)/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style Puppet manifest in the clean files array when puppetlint_args ignores its warnings' do
-      PuppetParser.manifest(["#{fixtures_dir}manifests/style_lint.pp"], true, ['--no-double_quoted_strings-check', '--no-arrow_alignment-check'])
+      PuppetParser.manifest(["#{FIXTURES_DIR}manifests/style_lint.pp"], true, ['--no-double_quoted_strings-check', '--no-arrow_alignment-check'])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}manifests/style_lint.pp"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}manifests/style_lint.pp"])
     end
     it 'puts a bad style Puppet plan in the warning files array' do
-      PuppetParser.manifest(["#{fixtures_dir}plans/style.pp"], true, [])
+      PuppetParser.manifest(["#{FIXTURES_DIR}plans/style.pp"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}plans/style.pp"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}plans/style.pp"].join("\n")).to match(/variable not enclosed in {}/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}plans/style.pp"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}plans/style.pp"].join("\n")).to match(/variable not enclosed in {}/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good Puppet manifest in the clean files array' do
-      PuppetParser.manifest(["#{fixtures_dir}manifests/good.pp"], true, [])
+      PuppetParser.manifest(["#{FIXTURES_DIR}manifests/good.pp"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}manifests/good.pp"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}manifests/good.pp"])
     end
     it 'puts a good Puppet plan in the clean files array' do
-      PuppetParser.manifest(["#{fixtures_dir}plans/good.pp"], true, [])
+      PuppetParser.manifest(["#{FIXTURES_DIR}plans/good.pp"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}plans/good.pp"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}plans/good.pp"])
     end
     it 'throws a well specified error for an invalid PuppetLint argument' do
-      expect { PuppetParser.manifest(["#{fixtures_dir}manifests/style_lint.pp"], true, ['--non-existent', '--does-not-exist']) }.to raise_error(RuntimeError, 'puppet-lint: invalid option supplied among --non-existent --does-not-exist')
+      expect { PuppetParser.manifest(["#{FIXTURES_DIR}manifests/style_lint.pp"], true, ['--non-existent', '--does-not-exist']) }.to raise_error(RuntimeError, 'puppet-lint: invalid option supplied among --non-existent --does-not-exist')
     end
   end
 
   context '.template' do
     it 'puts a bad syntax Puppet template in the error files hash' do
-      PuppetParser.template(["#{fixtures_dir}templates/syntax.epp"])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}templates/syntax.epp"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}templates/syntax.epp"].join("\n")).to match(/^This Name has no effect/)
+      PuppetParser.template(["#{FIXTURES_DIR}templates/syntax.epp"])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}templates/syntax.epp"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}templates/syntax.epp"].join("\n")).to match(/^This Name has no effect/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a good Puppet template in the clean files array' do
-      PuppetParser.template(["#{fixtures_dir}templates/good.epp"])
+      PuppetParser.template(["#{FIXTURES_DIR}templates/good.epp"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}templates/good.epp"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}templates/good.epp"])
     end
   end
 end

data/spec/puppet-check/regression_check_spec.rb

@@ -7,10 +7,10 @@ begin
     context '.config' do
       # json gem is messed up for the EOL Ruby versions
       it 'raise an appropriate error if the file is malformed' do
-        expect { RegressionCheck.send(:config, "#{fixtures_dir}metadata.json") }.to raise_error(OctocatalogDiff::Errors::ConfigurationFileContentError, 'Configuration must define OctocatalogDiff::Config!')
+        expect { RegressionCheck.send(:config, "#{FIXTURES_DIR}metadata.json") }.to raise_error(OctocatalogDiff::Errors::ConfigurationFileContentError, 'Configuration must define OctocatalogDiff::Config!')
       end
       it 'loads in a good octocatalog-diff config file' do
-        expect { RegressionCheck.send(:config, "#{octocatalog_diff_dir}octocatalog_diff.cfg.rb") }.not_to raise_exception
+        expect { RegressionCheck.send(:config, "#{OCTOCATALOG_DIFF_DIR}octocatalog_diff.cfg.rb") }.not_to raise_exception
       end
       it 'loads in the settings from the file correctly' do
         # TODO
@@ -19,16 +19,16 @@ begin
 
     context '.smoke' do
       # octocatalog-diff is returning a blank error for these tests
-      unless ci_env
+      unless CI_ENV
         it 'returns a pass for a successful catalog compilation' do
-          expect { RegressionCheck.smoke(['good.example.com'], "#{octocatalog_diff_dir}octocatalog_diff.cfg.rb") }.not_to raise_exception
+          expect { RegressionCheck.smoke(['good.example.com'], "#{OCTOCATALOG_DIFF_DIR}octocatalog_diff.cfg.rb") }.not_to raise_exception
         end
         it 'returns a failure for a catalog with an error' do
-          expect { RegressionCheck.smoke(['does_not_exist.example.com'], "#{octocatalog_diff_dir}octocatalog_diff.cfg.rb") }.to raise_error(OctocatalogDiff::Errors::CatalogError)
+          expect { RegressionCheck.smoke(['does_not_exist.example.com'], "#{OCTOCATALOG_DIFF_DIR}octocatalog_diff.cfg.rb") }.to raise_error(OctocatalogDiff::Errors::CatalogError)
         end
       end
       it 'returns a failure for a good and bad catalog' do
-        # RegressionCheck.smoke(['good.example.com', 'syntax_error.example.com'], "#{fixtures_dir}octocatalog_diff.cfg.rb")
+        # RegressionCheck.smoke(['good.example.com', 'syntax_error.example.com'], "#{FIXTURES_DIR}octocatalog_diff.cfg.rb")
       end
     end
 

data/spec/puppet-check/rspec_puppet_support_spec.rb

@@ -5,17 +5,17 @@ require 'fileutils'
 describe RSpecPuppetSupport do
   after(:all) do
     # cleanup rspec_puppet_setup
-    File.delete("#{fixtures_dir}/spec/spec_helper.rb")
-    %w[manifests modules].each { |dir| FileUtils.rm_r("#{fixtures_dir}/spec/fixtures/#{dir}") }
+    File.delete("#{FIXTURES_DIR}/spec/spec_helper.rb")
+    %w[manifests modules].each { |dir| FileUtils.rm_r("#{FIXTURES_DIR}/spec/fixtures/#{dir}") }
   end
 
   context '.run' do
     let(:rspec_puppet_setup) { RSpecPuppetSupport.run }
-    before(:each) { Dir.chdir(fixtures_dir) }
+    before(:each) { Dir.chdir(FIXTURES_DIR) }
 
     it 'creates missing directories, missing site.pp, missing symlinks, and a missing spec_helper' do
       # circle ci and gh actions
-      if ci_env
+      if CI_ENV
         expect { rspec_puppet_setup }.to output("git is not installed and cannot be used to retrieve dependency modules\nsubversion is not installed and cannot be used to retrieve dependency modules\npuppetlabs/gruntmaster has an unspecified, or specified but unsupported, download method.\n").to_stderr
       else
         expect { rspec_puppet_setup }.to output("subversion is not installed and cannot be used to retrieve dependency modules\npuppetlabs/gruntmaster has an unspecified, or specified but unsupported, download method.\n").to_stderr
@@ -29,7 +29,7 @@ describe RSpecPuppetSupport do
       expect(File.file?('spec/spec_helper.rb')).to be true
 
       # .dependency_setup
-      expect(File.directory?('spec/fixtures/modules/puppetlabs-lvm')).to be true unless ci_env
+      expect(File.directory?('spec/fixtures/modules/puppetlabs-lvm')).to be true unless CI_ENV
       expect(File.directory?('spec/fixtures/modules/stdlib')).to be true
     end
   end

data/spec/puppet-check/ruby_parser_spec.rb

@@ -13,96 +13,96 @@ describe RubyParser do
 
   context '.ruby' do
     it 'puts a bad syntax ruby file in the error files hash' do
-      RubyParser.ruby(["#{fixtures_dir}lib/syntax.rb"], false, [])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}lib/syntax.rb"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}lib/syntax.rb"].join("\n")).to match(/^.*syntax error/)
+      RubyParser.ruby(["#{FIXTURES_DIR}lib/syntax.rb"], false, [])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}lib/syntax.rb"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}lib/syntax.rb"].join("\n")).to match(/^.*syntax error/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style ruby file in the warning files array' do
-      RubyParser.ruby(["#{fixtures_dir}lib/style.rb"], true, [])
+      RubyParser.ruby(["#{FIXTURES_DIR}lib/style.rb"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}lib/style.rb"])
-      unless ci_env
-        expect(PuppetCheck.files[:warnings]["#{fixtures_dir}lib/style.rb"].length).to eql(8)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}lib/style.rb"])
+      unless CI_ENV
+        expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}lib/style.rb"].length).to eql(8)
       else
-        expect(PuppetCheck.files[:warnings]["#{fixtures_dir}lib/style.rb"].join("\n")).to match(/Useless assignment.*\n.*Use the new.*\n.*Do not introduce.*\n.*Prefer single.*\n.*Remove unnecessary empty.*\n.*Source code comment is empty/)
+        expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}lib/style.rb"].join("\n")).to match(/Useless assignment.*\n.*Use the new.*\n.*Do not introduce.*\n.*Prefer single.*\n.*Remove unnecessary empty.*\n.*Source code comment is empty/)
       end
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style ruby file in the clean files array when rubocop_args ignores its warnings' do
-      RubyParser.ruby(["#{fixtures_dir}lib/rubocop_style.rb"], true, ['--except', 'Lint/UselessAssignment,Style/HashSyntax,Style/GlobalVars,Style/StringLiterals'])
+      RubyParser.ruby(["#{FIXTURES_DIR}lib/rubocop_style.rb"], true, ['--except', 'Lint/UselessAssignment,Style/HashSyntax,Style/GlobalVars,Style/StringLiterals'])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}lib/rubocop_style.rb"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}lib/rubocop_style.rb"])
     end
     it 'puts a good ruby file in the clean files array' do
-      RubyParser.ruby(["#{fixtures_dir}lib/good.rb"], true, [])
+      RubyParser.ruby(["#{FIXTURES_DIR}lib/good.rb"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}lib/good.rb"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}lib/good.rb"])
     end
   end
 
   context '.template' do
     it 'puts a bad syntax ruby template file in the error files hash' do
-      RubyParser.template(["#{fixtures_dir}templates/syntax.erb"])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}templates/syntax.erb"])
+      RubyParser.template(["#{FIXTURES_DIR}templates/syntax.erb"])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}templates/syntax.erb"])
       if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('2.7')
-        expect(PuppetCheck.files[:errors]["#{fixtures_dir}templates/syntax.erb"].join("\n")).to match(/1: syntax error, unexpected.*\n.*ruby/)
+        expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}templates/syntax.erb"].join("\n")).to match(/1: syntax error, unexpected.*\n.*ruby/)
       else
-        expect(PuppetCheck.files[:errors]["#{fixtures_dir}templates/syntax.erb"].join("\n")).to match(/syntax error, unexpected tIDENTIFIER/)
+        expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}templates/syntax.erb"].join("\n")).to match(/syntax error, unexpected tIDENTIFIER/)
       end
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style ruby template file in the warning files array' do
-      RubyParser.template(["#{fixtures_dir}templates/style.erb"])
+      RubyParser.template(["#{FIXTURES_DIR}templates/style.erb"])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}templates/style.erb"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}templates/style.erb"].join("\n")).to match(/already initialized constant.*\n.*previous definition of/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}templates/style.erb"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}templates/style.erb"].join("\n")).to match(/already initialized constant.*\n.*previous definition of/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a ruby template file with ignored errors in the clean files array' do
-      RubyParser.template(["#{fixtures_dir}templates/no_method_error.erb"])
+      RubyParser.template(["#{FIXTURES_DIR}templates/no_method_error.erb"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}templates/no_method_error.erb"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}templates/no_method_error.erb"])
     end
     it 'puts a good ruby template file in the clean files array' do
-      RubyParser.template(["#{fixtures_dir}templates/good.erb"])
+      RubyParser.template(["#{FIXTURES_DIR}templates/good.erb"])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}templates/good.erb"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}templates/good.erb"])
     end
   end
 
   context '.librarian' do
     it 'puts a bad syntax librarian Puppet file in the error files hash' do
-      RubyParser.librarian(["#{fixtures_dir}librarian/Puppetfile_syntax"], false, [])
-      expect(PuppetCheck.files[:errors].keys).to eql(["#{fixtures_dir}librarian/Puppetfile_syntax"])
-      expect(PuppetCheck.files[:errors]["#{fixtures_dir}librarian/Puppetfile_syntax"].join("\n")).to match(/^.*syntax error/)
+      RubyParser.librarian(["#{FIXTURES_DIR}librarian/Puppetfile_syntax"], false, [])
+      expect(PuppetCheck.files[:errors].keys).to eql(["#{FIXTURES_DIR}librarian/Puppetfile_syntax"])
+      expect(PuppetCheck.files[:errors]["#{FIXTURES_DIR}librarian/Puppetfile_syntax"].join("\n")).to match(/^.*syntax error/)
       expect(PuppetCheck.files[:warnings]).to eql({})
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style librarian Puppet file in the warning files array' do
-      RubyParser.librarian(["#{fixtures_dir}librarian/Puppetfile_style"], true, [])
+      RubyParser.librarian(["#{FIXTURES_DIR}librarian/Puppetfile_style"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
-      expect(PuppetCheck.files[:warnings].keys).to eql(["#{fixtures_dir}librarian/Puppetfile_style"])
-      expect(PuppetCheck.files[:warnings]["#{fixtures_dir}librarian/Puppetfile_style"].join("\n")).to match(/Align the arguments.*\n.*Use the new/)
+      expect(PuppetCheck.files[:warnings].keys).to eql(["#{FIXTURES_DIR}librarian/Puppetfile_style"])
+      expect(PuppetCheck.files[:warnings]["#{FIXTURES_DIR}librarian/Puppetfile_style"].join("\n")).to match(/Align the arguments.*\n.*Use the new/)
       expect(PuppetCheck.files[:clean]).to eql([])
     end
     it 'puts a bad style librarian Puppet file in the clean files array when rubocop_args ignores its warnings' do
-      RubyParser.librarian(["#{fixtures_dir}librarian/Puppetfile_style"], true, ['--except', 'Layout/ArgumentAlignment,Style/HashSyntax'])
+      RubyParser.librarian(["#{FIXTURES_DIR}librarian/Puppetfile_style"], true, ['--except', 'Layout/ArgumentAlignment,Style/HashSyntax'])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}librarian/Puppetfile_style"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}librarian/Puppetfile_style"])
     end
     it 'puts a good librarian Puppet file in the clean files array' do
-      RubyParser.librarian(["#{fixtures_dir}librarian/Puppetfile_good"], true, [])
+      RubyParser.librarian(["#{FIXTURES_DIR}librarian/Puppetfile_good"], true, [])
       expect(PuppetCheck.files[:errors]).to eql({})
       expect(PuppetCheck.files[:warnings]).to eql({})
-      expect(PuppetCheck.files[:clean]).to eql(["#{fixtures_dir}librarian/Puppetfile_good"])
+      expect(PuppetCheck.files[:clean]).to eql(["#{FIXTURES_DIR}librarian/Puppetfile_good"])
     end
   end
 end

data/spec/puppet-check/tasks_spec.rb

@@ -5,15 +5,15 @@ require_relative '../../lib/puppet-check/tasks'
 describe PuppetCheck::Tasks do
   after(:all) do
     # cleanup rspec_puppet_setup
-    File.delete("#{fixtures_dir}/spec/spec_helper.rb")
-    %w[manifests modules].each { |dir| FileUtils.rm_r("#{fixtures_dir}/spec/fixtures/#{dir}") }
+    File.delete("#{FIXTURES_DIR}/spec/spec_helper.rb")
+    %w[manifests modules].each { |dir| FileUtils.rm_r("#{FIXTURES_DIR}/spec/fixtures/#{dir}") }
   end
 
   context 'puppetcheck:spec' do
     let(:spec_tasks) { Rake::Task[:'puppetcheck:spec'].invoke }
 
     it 'executes RSpec and RSpec-Puppet checks in the expected manner' do
-      Dir.chdir(fixtures_dir)
+      Dir.chdir(FIXTURES_DIR)
 
       # rspec task executed
       expect { spec_tasks }.to output(%r{spec/facter/facter_spec.rb}).to_stdout

data/spec/puppet_check_spec.rb

@@ -35,7 +35,7 @@ describe PuppetCheck do
     it 'returns defaults correctly' do
       expect(PuppetCheck.send(:defaults)).to eql(
         {
-          fail_on_warning: false,
+          fail_on_warnings: false,
           style: false,
           smoke: false,
           regression: false,
@@ -52,7 +52,7 @@ describe PuppetCheck do
 
     it 'modifies settings correctly' do
       settings = {
-        fail_on_warning: true,
+        fail_on_warnings: true,
         style: true,
         smoke: true,
         regression: true,
@@ -69,7 +69,7 @@ describe PuppetCheck do
   end
 
   context '.parse_paths' do
-    before(:each) { Dir.chdir(fixtures_dir) }
+    before(:each) { Dir.chdir(FIXTURES_DIR) }
 
     let(:no_files) { PuppetCheck.send(:parse_paths, %w[foo bar baz]) }
     let(:mixed_files) { PuppetCheck.send(:parse_paths, %w[foo lib/good.rb]) }
@@ -83,7 +83,7 @@ describe PuppetCheck do
     end
 
     it 'warns on invalid path and correctly parses a valid file path' do
-      expect { mixed_files }.to output("puppet-check: foo is not a directory, file, or symlink, and will not be considered during parsing\n").to_stderr
+      expect { mixed_files }.to output("puppet-check: foo is not a readable directory, file, or symlink, and will not be considered during parsing\n").to_stderr
       expect(mixed_files[0]).to eql('lib/good.rb')
     end
 
@@ -93,7 +93,7 @@ describe PuppetCheck do
 
     it 'correctly parses one directory and returns all of its files' do
       dir.each { |file| expect(File.file?(file)).to be true }
-      if ci_env
+      if CI_ENV
         expect(dir.length).to eql(37)
       else
         expect(dir.length).to eql(40)
@@ -112,16 +112,51 @@ describe PuppetCheck do
   end
 
   context '.execute_parsers' do
-    it 'correctly organizes a set of files and invokes the correct parsers' do
-      # parser_output = instance_double('execute_parsers', files: %w[puppet.pp puppet_template.epp ruby.rb ruby_template.erb yaml.yaml yaml.yml json.json Puppetfile Modulefile foobarbaz], style: false, pl_args: [], rc_args: [])
-      # expect(parser_output).to receive(:manifest).with(%w[puppet.pp])
-      # expect(parser_output).to receive(:template).with(%w[puppet_template.epp])
-      # expect(parser_output).to receive(:ruby).with(%w[ruby.rb])
-      # expect(parser_output).to receive(:template).with(%w[ruby_template.erb])
-      # expect(parser_output).to receive(:yaml).with(%w[yaml.yaml yaml.yml])
-      # expect(parser_output).to receive(:json).with(%w[json.json])
-      # expect(parser_output).to receive(:librarian).with(%w[Puppetfile Modulefile])
-      # expect(PuppetCheck.files[:ignored]).to eql(%w[foobarbaz])
+    before(:each) do
+      PuppetCheck.files = { errors: {}, warnings: {}, clean: [], ignored: [] }
+    end
+    let(:puppet_check) { PuppetCheck.new }
+
+    it 'correctly routes each file type to the appropriate parser and ignores unrecognized files' do
+      expect(PuppetParser).to receive(:manifest).with(['manifests/good.pp'], false, [])
+      expect(PuppetParser).to receive(:template).with(['templates/good.epp'])
+      expect(RubyParser).to receive(:ruby).with(['lib/good.rb'], false, [])
+      expect(RubyParser).to receive(:template).with(['templates/good.erb'])
+      expect(DataParser).to receive(:yaml).with(['hieradata/good.yaml', 'hieradata/good.yml'])
+      expect(DataParser).to receive(:json).with(['hieradata/good.json'])
+      expect(DataParser).to receive(:eyaml).with(['hieradata/good.eyaml'], nil, nil)
+      expect(RubyParser).to receive(:librarian).with(['librarian/Puppetfile_good'], false, [])
+
+      puppet_check.send(:execute_parsers, %w[manifests/good.pp templates/good.epp lib/good.rb templates/good.erb hieradata/good.yaml hieradata/good.yml hieradata/good.json hieradata/good.eyaml librarian/Puppetfile_good foobarbaz], false, [], [], nil, nil)
+
+      expect(PuppetCheck.files[:ignored]).to eql(['foobarbaz'])
+    end
+
+    it 'passes style and arg options through to the correct parsers and skips parser calls when a given file category is empty' do
+      expect(PuppetParser).to receive(:manifest).with(['manifests/good.pp'], true, ['--no-140chars-check'])
+      expect(PuppetParser).not_to receive(:template)
+      expect(RubyParser).to receive(:ruby).with(['lib/good.rb'], true, ['--except', 'Style/FrozenStringLiteralComment'])
+      expect(RubyParser).to receive(:librarian).with(['librarian/Puppetfile_good'], true, ['--except', 'Style/FrozenStringLiteralComment'])
+      expect(RubyParser).not_to receive(:template)
+      expect(DataParser).to receive(:yaml).with(['hieradata/good.yaml'])
+      expect(DataParser).not_to receive(:json)
+      expect(DataParser).not_to receive(:eyaml)
+
+      puppet_check.send(
+        :execute_parsers,
+        %w[manifests/good.pp lib/good.rb hieradata/good.yaml librarian/Puppetfile_good],
+        true,
+        ['--no-140chars-check'],
+        ['--except', 'Style/FrozenStringLiteralComment'],
+        nil,
+        nil
+      )
+    end
+
+    it 'returns PuppetCheck.files' do
+      allow(PuppetParser).to receive(:manifest)
+      result = puppet_check.send(:execute_parsers, ['manifests/good.pp'], false, [], [], nil, nil)
+      expect(result).to eql(PuppetCheck.files)
     end
   end
 end

data/spec/spec_helper.rb

@@ -1,23 +1,10 @@
 require 'rspec'
 
 # for path to fixtures
-module Variables
-  extend RSpec::SharedContext
-
-  def fixtures_dir
-    @fixtures_dir = "#{File.dirname(__FILE__)}/fixtures/"
-  end
-
-  def octocatalog_diff_dir
-    @octocatalog_diff_dir = "#{File.dirname(__FILE__)}/octocatalog-diff/"
-  end
-
-  def ci_env
-    @ci_env = ENV['CIRCLECI'] == 'true' || ENV['GITHUB_ACTIONS'] == 'true'
-  end
-end
+FIXTURES_DIR = "#{File.dirname(__FILE__)}/fixtures/".freeze
+OCTOCATALOG_DIFF_DIR = "#{File.dirname(__FILE__)}/octocatalog-diff/".freeze
+CI_ENV = ENV['CIRCLECI'] == 'true' || ENV['GITHUB_ACTIONS'] == 'true'
 
 RSpec.configure do |config|
-  config.include Variables
   config.color = true
 end

data/spec/system/system_spec.rb

@@ -6,18 +6,18 @@ require_relative '../../lib/puppet-check/tasks'
 describe PuppetCheck do
   context 'executed as a system from the CLI with arguments and various files to be processed' do
     it 'outputs diagnostic results correctly after processing all of the files' do
-      Dir.chdir(fixtures_dir)
+      Dir.chdir(FIXTURES_DIR)
 
       # see regression_check_spec
-      if ci_env
+      if CI_ENV
         expect(PuppetCheck::CLI.run(%w[-s --puppet-lint no-hard_tabs-check,no-140chars-check --rubocop Layout/LineLength,Style/Encoding --public keys/public_key.pkcs7.pem --private keys/private_key.pkcs7.pem .])).to eql(2)
       else
         expect(PuppetCheck::CLI.run(%w[-s --puppet-lint no-hard_tabs-check,no-140chars-check --rubocop Layout/LineLength,Style/Encoding --public keys/public_key.pkcs7.pem --private keys/private_key.pkcs7.pem --smoke -n good.example.com --octoconfig spec/octocatalog-diff/octocatalog-diff.cfg.rb .])).to eql(2)
       end
 
-      expect(PuppetCheck.files[:errors].length).to eql(11)
+      expect(PuppetCheck.files[:errors].length).to eql(12)
       expect(PuppetCheck.files[:warnings].length).to eql(13)
-      expect(PuppetCheck.files[:clean].length).to eql(13)
+      expect(PuppetCheck.files[:clean].length).to eql(14)
       expect(PuppetCheck.files[:ignored].length).to eql(3)
     end
   end
@@ -25,7 +25,7 @@ describe PuppetCheck do
   context 'executed as a system from the Rakefile with arguments and various files to be processed' do
     it 'outputs diagnostic results correctly after processing all of the files' do
       # ensure rake only checks the files inside fixtures
-      Dir.chdir(fixtures_dir)
+      Dir.chdir(FIXTURES_DIR)
 
       # clear out files member from previous system test
       PuppetCheck.files = {
@@ -47,7 +47,7 @@ describe PuppetCheck do
 
     it 'uses override settings and outputs diagnostic results correctly after processing all of the files' do
         # ensure rake only checks the files inside fixtures
-        Dir.chdir(fixtures_dir)
+        Dir.chdir(FIXTURES_DIR)
 
         # clear out files member from previous system test
         PuppetCheck.files = {
@@ -60,7 +60,7 @@ describe PuppetCheck do
         # assign settings
         settings = { style: true }
         # see regression_check_spec
-        unless ci_env
+        unless CI_ENV
           settings[:smoke] = true
           settings[:octonodes] = %w[good.example.com]
           settings[:octoconfig] = 'spec/octocatalog-diff/octocatalog-diff.cfg.rb'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppet-check
 version: !ruby/object:Gem::Version
-  version: 2.5.0
+  version: 2.5.2
 platform: ruby
 authors:
 - Matt Schuchard
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-21 00:00:00.000000000 Z
+date: 2026-07-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: puppet
@@ -153,9 +153,11 @@ files:
 - lib/puppet_check.rb
 - puppet-check.gemspec
 - spec/fixtures/foobarbaz
+- spec/fixtures/hieradata/decrypt_error.eyaml
 - spec/fixtures/hieradata/good.eyaml
 - spec/fixtures/hieradata/good.json
 - spec/fixtures/hieradata/good.yaml
+- spec/fixtures/hieradata/nested_array.eyaml
 - spec/fixtures/hieradata/style.eyaml
 - spec/fixtures/hieradata/style.yaml
 - spec/fixtures/hieradata/syntax.eyaml