@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/lint/post-synth/tf028.test.ts

@@ -0,0 +1,92 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { Declarable } from "@intentius/chant/declarable";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf028 } from "./tf028";
+import { parseTerraformRootDir } from "../../hcl/parse";
+import { TerraformWatchOp, type TerraformWatchOpConfig } from "../../composites/terraform-watch-op";
+import { TerraformApplyOp } from "../../composites/terraform-apply-op";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF028");
+
+/** The entities of one fixture root, parsed the way `buildRoots` parses a configured root. */
+async function rootEntities(fixture: string, root: string, binary = "choudoufu"): Promise<Map<string, Declarable>> {
+  return parseTerraformRootDir(join(fixtures, fixture), root, undefined, { binary });
+}
+
+/** A `Chant::Op` entity from the real composite, keyed the way a discovered Op is. */
+function watchOp(config: TerraformWatchOpConfig): [string, Declarable] {
+  const { op } = TerraformWatchOp(config);
+  return [config.name, op as unknown as Declarable];
+}
+
+function ctxOf(...maps: Array<Map<string, Declarable> | [string, Declarable]>): PostSynthContext {
+  const entities = new Map<string, Declarable>();
+  for (const m of maps) {
+    if (Array.isArray(m)) entities.set(m[0], m[1]);
+    else for (const [k, v] of m) entities.set(k, v);
+  }
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF028: a live root planned by a stock terraformPlan step", () => {
+  test("fires on a TerraformWatchOp built without live: true", async () => {
+    const diags = tf028.check(
+      ctxOf(await rootEntities("live", "estate"), watchOp({ name: "estate-watch", root: "estate" })),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF028");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].lexicon).toBe("terraform");
+    expect(diags[0].entity).toBe("estate-watch");
+    expect(diags[0].message).toContain('Op "estate-watch"');
+    expect(diags[0].message).toContain('root module "estate"');
+    expect(diags[0].message).toContain("live: true");
+  });
+
+  test("passes when the same Op is built with live: true", async () => {
+    const diags = tf028.check(
+      ctxOf(
+        await rootEntities("live", "estate"),
+        watchOp({ name: "estate-watch", root: "estate", live: true }),
+      ),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("passes on a stock root, which is what terraformPlan is for", async () => {
+    const diags = tf028.check(
+      ctxOf(await rootEntities("stock", "app", "terraform"), watchOp({ name: "app-watch", root: "app" })),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("names the Op that plans the live root, not a sibling Op on another root", async () => {
+    const diags = tf028.check(
+      ctxOf(
+        await rootEntities("live", "estate"),
+        await rootEntities("stock", "app", "terraform"),
+        watchOp({ name: "estate-watch", root: "estate" }),
+        watchOp({ name: "app-watch", root: "app" }),
+      ),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("estate-watch");
+  });
+
+  test("does not fire on a TerraformApplyOp, whose stock plan step is correct on a live root", async () => {
+    const { op } = TerraformApplyOp({ name: "estate-apply", root: "estate" });
+    const diags = tf028.check(
+      ctxOf(await rootEntities("live", "estate"), ["estate-apply", op as unknown as Declarable]),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("ignores a build with no live root at all", async () => {
+    const diags = tf028.check(
+      ctxOf(await rootEntities("stock", "estate", "terraform"), watchOp({ name: "estate-watch", root: "estate" })),
+    );
+    expect(diags).toEqual([]);
+  });
+});

package/src/lint/post-synth/tf028.ts

@@ -0,0 +1,96 @@
+/**
+ * TF028: a live root is watched by a `TerraformWatchOp` built in stock mode.
+ *
+ * `TerraformWatchOp`'s `live` flag is declared, not detected: a composite is
+ * built by `chant build` without reading a root module's `.tf` files, so the
+ * Op author says which shape the Plan phase takes and, until #2216, nothing
+ * checked the answer against the root. Leaving it off a live root is silent
+ * and lossy. `live: true` swaps the Plan step for `choudoufuLivePlan`, whose
+ * single read of the live system answers three questions (drift, how many
+ * live resources sit at a declared identity carrying no marker, and how many
+ * of those an exact content match makes claimable); a stock `terraformPlan`
+ * step answers the first alone, so the watch reports drift and stays quiet
+ * about every unowned and adoptable resource in the estate.
+ *
+ * The check runs over the whole built graph because that is where both halves
+ * of the question are: the root's mode is stamped on every parsed entity by
+ * the build (`props.mode`, #2103), and the Op is a `Chant::Op` entity carrying
+ * the composite's own labels. `TerraformWatchOp` itself cross-checks the flag
+ * where it can (`../../op/resolve-root-mode.ts`), but that read is a
+ * `chant.config.json`-only one, so on a `chant.config.ts` project, which is
+ * every project in this repository, this check is what actually fires.
+ *
+ * Read off the labels the composite stamps rather than off the emitted step,
+ * since a stock `terraformPlan -out` step against a live root is correct in
+ * `TerraformApplyOp`: choudoufu v0.13.0 accepts `plan -out` and re-plans
+ * against the file at apply (#2157), so the apply Op builds one shape for
+ * both kinds of root and the step alone says nothing about a mistake.
+ *
+ * One diagnostic per Op, fired from the Op's entity.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isOpEntity } from "@intentius/chant/op/resource";
+
+/** The labels `TerraformWatchOp` stamps on the Op it builds (`../../composites/terraform-watch-op.ts`). */
+interface WatchOpLabels {
+  Watch?: unknown;
+  TerraformRoot?: unknown;
+  TerraformMode?: unknown;
+}
+
+/** Every root name the build parsed as live: `terraform.binary: "choudoufu"` plus a declared estate. */
+function liveRootsOf(ctx: PostSynthContext): Set<string> {
+  const roots = new Set<string>();
+  for (const entity of ctx.entities.values()) {
+    if (!isResourceDeclarable(entity)) continue;
+    const props = entity.props as { root?: unknown; mode?: unknown };
+    if (props.mode !== "live" || typeof props.root !== "string") continue;
+    roots.add(props.root);
+  }
+  return roots;
+}
+
+export const tf028: PostSynthCheck = {
+  id: "TF028",
+  description: "A live root is watched by a TerraformWatchOp built without live: true",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const liveRoots = liveRootsOf(ctx);
+    if (liveRoots.size === 0) return [];
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isOpEntity(entity)) continue;
+      const props = (entity as { props?: Record<string, unknown> }).props;
+      if (!props || typeof props.name !== "string") continue;
+      const labels = (typeof props.labels === "object" && props.labels !== null
+        ? props.labels
+        : {}) as WatchOpLabels;
+      if (labels.Watch !== "true") continue;
+      if (labels.TerraformMode === "live") continue;
+      const root = labels.TerraformRoot;
+      if (typeof root !== "string" || !liveRoots.has(root)) continue;
+
+      diagnostics.push({
+        checkId: "TF028",
+        severity: "error",
+        message:
+          `Op "${props.name}" watches root module "${root}" in stock mode, but that root runs choudoufu ` +
+          "with a declared estate. A stock plan reports drift alone and stays quiet about every unowned " +
+          `and adoptable resource in the estate. Set live: true on this TerraformWatchOp, or drop the ` +
+          "root's estate if it is not a live root.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/presets.test.ts

@@ -0,0 +1,72 @@
+/**
+ * `terraformPlugin.lintPresets()` (chant #2113): `recommended`/`all`, and
+ * that `lint.presets` + core's `resolvePresetIds`/`applyConfiguredPreset`
+ * filter a terraform post-synth finding end to end: a report-only rule is
+ * not reported under `recommended` and is reported under `all`.
+ *
+ * The terraform lexicon ships no report-only post-synth check yet (TF001,
+ * TF024, TF025 are all merge-worthy. The report-only rules land in
+ * #2109/#2110/#2112, in parallel with this issue), so the "report-only rule
+ * excluded under recommended, included under all" half uses a synthetic
+ * diagnostic and a preset id set widened with a made-up id alongside the
+ * plugin's real `recommended` set, rather than inventing a permanent public
+ * TF id this issue doesn't own.
+ */
+import { describe, test, expect } from "vitest";
+import type { PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { resolvePresetIds, applyConfiguredPreset } from "@intentius/chant/lint/config";
+import { terraformPlugin } from "../plugin";
+
+describe("terraformPlugin.lintPresets()", () => {
+  const presets = terraformPlugin.lintPresets?.();
+
+  test("is defined and exports recommended + all", () => {
+    expect(presets).toBeDefined();
+    expect(presets?.recommended).toBeDefined();
+    expect(presets?.all).toBeDefined();
+  });
+
+  test("recommended is exactly the catalog's merge-worthy ids, and all is exactly every catalog id (derived, not hand-kept)", async () => {
+    const { terraformAuditCatalog } = await import("./audit-catalog");
+    const expectedRecommended = Object.values(terraformAuditCatalog)
+      .filter((m) => m.tier === "merge-worthy")
+      .map((m) => m.id)
+      .sort();
+    expect(presets?.recommended.slice().sort()).toEqual(expectedRecommended);
+    expect(presets?.all.slice().sort()).toEqual(Object.keys(terraformAuditCatalog).sort());
+  });
+
+  test("all is a superset of recommended", () => {
+    for (const id of presets?.recommended ?? []) {
+      expect(presets?.all).toContain(id);
+    }
+  });
+});
+
+describe("lint.presets end to end: a report-only rule is excluded under recommended, included under all (chant #2113)", () => {
+  const recommendedIds = terraformPlugin.lintPresets?.().recommended ?? [];
+  // Widened with a made-up report-only id, not a real TF id this issue owns,
+  // see this file's header comment.
+  const allIds = [...(terraformPlugin.lintPresets?.().all ?? []), "TFZZZ"];
+
+  function diags(): PostSynthDiagnostic[] {
+    return [
+      { checkId: "TF001", severity: "warning", message: "a real merge-worthy TF001 finding", lexicon: "terraform" },
+      { checkId: "TFZZZ", severity: "info", message: "a hypothetical report-only finding", lexicon: "terraform" },
+    ];
+  }
+
+  test("under `recommended`, the report-only finding is not reported (merge-worthy TF001 still is)", () => {
+    const presetIds = resolvePresetIds({ recommended: recommendedIds, all: allIds }, "recommended");
+    const result = applyConfiguredPreset(diags(), presetIds, undefined);
+    expect(result.diagnostics.map((d) => d.checkId)).toEqual(["TF001"]);
+    expect(result.suppressed.map((d) => d.checkId)).toEqual(["TFZZZ"]);
+  });
+
+  test("under `all`, the report-only finding IS reported", () => {
+    const presetIds = resolvePresetIds({ recommended: recommendedIds, all: allIds }, "all");
+    const result = applyConfiguredPreset(diags(), presetIds, undefined);
+    expect(result.diagnostics.map((d) => d.checkId).sort()).toEqual(["TF001", "TFZZZ"]);
+    expect(result.suppressed).toEqual([]);
+  });
+});

package/src/lint/rules/fixtures/TF101/negative-op.ts

@@ -0,0 +1,2 @@
+const plan = terraformPlan("app", { id: "plan" });
+const apply = terraformApply("app", { planFile: stepOutput(plan, "planFile") });

package/src/lint/rules/fixtures/TF101/positive-op.ts

@@ -0,0 +1,2 @@
+const plan = terraformPlan("app", { id: "plan" });
+const apply = terraformApply("app", { planFile: "/tmp/plan.out" });

package/src/lint/rules/fixtures/load.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared lint-rule fixture loader, the `lint/rules/` sibling of
+ * `../../post-synth/fixtures/load.ts`.
+ *
+ * A post-synth check's fixtures are `.tf`, a real Terraform root. A lint
+ * rule's fixtures are Op-shaped source, the kind `chant lint` runs a rule's
+ * `check(context)` against directly. TF101's live under
+ * `fixtures/TF101/positive-op.ts` (triggers) and `negative-op.ts` (passes),
+ * deliberately unimported and unresolved at the identifier level: TF101
+ * itself matches purely on callee name (see `plan-before-apply.ts`'s doc
+ * comment), so a fixture that only needs to parse, not typecheck or run as a
+ * standalone program, stays honest about what the rule actually reads.
+ *
+ * On disk these are named `<name>-op.ts`, not `<name>.op.ts`: a real
+ * `*.op.ts` file is exactly what `packages/core/src/op/discover.ts`'s
+ * `discoverOps()` walks the whole repository (down from the git root, absent
+ * a `chant.config.*`) to find and `import()`, and it does that unconditionally
+ * in tests like `generate-pipeline.test.ts` that exercise real discovery. A
+ * fixture named `positive.op.ts` would be swept into that scan, imported,
+ * and fail at the top-level `const plan = terraformPlan(...)` reference,
+ * turning into a discovery error that breaks an unrelated, already-passing
+ * test. `loadRuleFixture` still hands the rule a logical `.op.ts` filename
+ * (below) so parsing and diagnostics see the file the way a real one would
+ * appear; only the on-disk name dodges the scan. Both physical files are
+ * also excluded from every tsconfig that would otherwise try to compile them
+ * as real source (root `tsconfig.json`, `tsconfig.typecheck.json`, and this
+ * lexicon's `tsconfig.build.json`).
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as ts from "typescript";
+import type { LintContext } from "@intentius/chant/lint/rule";
+
+const FIXTURES_DIR = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Parse `fixtures/<ruleId>/<name>-op.ts` into a {@link LintContext} whose
+ * `filePath` is the logical `<name>.op.ts` a real Op file would carry.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export function loadRuleFixture(ruleId: string, name: string): LintContext {
+  const onDisk = `${name}-op.ts`;
+  const logical = `${name}.op.ts`;
+  const code = readFileSync(join(FIXTURES_DIR, ruleId, onDisk), "utf-8");
+  const sourceFile = ts.createSourceFile(logical, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath: logical };
+}

package/src/lint/rules/plan-before-apply.test.ts

@@ -1,7 +1,11 @@
-import { describe, expect, test } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "vitest";
 import * as ts from "typescript";
 import type { LintContext } from "@intentius/chant/lint/rule";
 import { planBeforeApplyRule } from "./plan-before-apply";
+import { loadRuleFixture } from "./fixtures/load";
 
 function createContext(code: string, fileName = "infra.op.ts"): LintContext {
   const sourceFile = ts.createSourceFile(fileName, code, ts.ScriptTarget.Latest, true);
@@ -10,18 +14,18 @@ function createContext(code: string, fileName = "infra.op.ts"): LintContext {
 
 describe("TF101: plan-before-apply", () => {
   test("flags a literal plan path", () => {
-    const diags = planBeforeApplyRule.check(
-      createContext(`
-        const plan = terraformPlan({ root: "app" });
-        const apply = terraformApply({ planFile: "/tmp/plan.out" });
-      `),
-    );
+    const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "positive"));
     expect(diags).toHaveLength(1);
     expect(diags[0].ruleId).toBe("TF101");
     expect(diags[0].severity).toBe("error");
     expect(diags[0].message).toContain("literal path");
   });
 
+  test("passes a step-output reference to the preceding plan (fixtures/TF101/negative.op.ts)", () => {
+    const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "negative"));
+    expect(diags).toHaveLength(0);
+  });
+
   test("flags a template literal plan path", () => {
     const diags = planBeforeApplyRule.check(
       createContext(`
@@ -109,3 +113,104 @@ describe("TF101: plan-before-apply", () => {
     expect(diags).toHaveLength(0);
   });
 });
+
+describe("TF101: a live root is checked like any other (#2106 follow-up)", () => {
+  const dirs: string[] = [];
+
+  afterEach(() => {
+    for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+  });
+
+  /** A throwaway project with one `terraform.roots` entry, live or stock. */
+  function project(opts: { binary?: string; live?: boolean }): string {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf101-mode-"));
+    dirs.push(dir);
+    mkdirSync(join(dir, "root"), { recursive: true });
+    writeFileSync(
+      join(dir, "root", "main.tf"),
+      opts.live
+        ? ["terraform {", "  live {", '    estate = "fixture-estate"', "  }", "}", ""].join("\n")
+        : 'resource "null_resource" "x" {}\n',
+    );
+    writeFileSync(
+      join(dir, "chant.config.json"),
+      JSON.stringify({ terraform: { binary: opts.binary ?? "terraform", roots: { app: { dir: "./root" } } } }),
+    );
+    return dir;
+  }
+
+  /** A `LintContext` whose file lives inside `project`, so a config walk would find it if the rule did one. */
+  function contextIn(project: string, code: string): LintContext {
+    const filePath = join(project, "ops", "app.op.ts");
+    const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+    return { sourceFile, entities: [], filePath };
+  }
+
+  test("fires on a terraformApply call over a live root, where #2106 exempted it", () => {
+    const dir = project({ binary: "choudoufu", live: true });
+    const diags = planBeforeApplyRule.check(
+      contextIn(
+        dir,
+        `
+          const apply = terraformApply("app", { planFile: "/tmp/plan.out" });
+        `,
+      ),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("literal path");
+  });
+
+  test("fires on a stock root in the same shape", () => {
+    const dir = project({ binary: "terraform", live: false });
+    const diags = planBeforeApplyRule.check(
+      contextIn(
+        dir,
+        `
+          const apply = terraformApply("app", { planFile: "/tmp/plan.out" });
+        `,
+      ),
+    );
+    expect(diags).toHaveLength(1);
+  });
+
+  test("a live root's paired call still passes", () => {
+    const dir = project({ binary: "choudoufu", live: true });
+    const diags = planBeforeApplyRule.check(
+      contextIn(
+        dir,
+        `
+          const plan = terraformPlan("app", { id: "plan" });
+          const apply = terraformApply("app", { planFile: plan.out.planFile });
+        `,
+      ),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("the object-literal-only call form is checked the same way", () => {
+    const dir = project({ binary: "choudoufu", live: true });
+    const diags = planBeforeApplyRule.check(
+      contextIn(
+        dir,
+        `
+          const apply = terraformApply({ root: "app", planFile: "/tmp/plan.out" });
+        `,
+      ),
+    );
+    expect(diags).toHaveLength(1);
+  });
+
+  test("no project config at all changes nothing: the rule reads none", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf101-mode-"));
+    dirs.push(dir);
+    const diags = planBeforeApplyRule.check(
+      contextIn(
+        dir,
+        `
+          const apply = terraformApply("app", { planFile: "/tmp/plan.out" });
+        `,
+      ),
+    );
+    expect(diags).toHaveLength(1);
+  });
+});

package/src/lint/rules/plan-before-apply.ts

@@ -27,6 +27,17 @@ import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lin
  * silent — the same deliberately shallow "bail rather than guess" posture
  * `validateStepOutputRefs` takes, since the runtime brand on a real
  * `StepOutputRef` is invisible to a source-level AST match.
+ *
+ * Fires on every `terraformApply` call, live root or stock. #2106 exempted
+ * live roots for one release, because choudoufu refused `-out` and
+ * `apply <planfile>` and the activity ran a bare `apply -auto-approve` with no
+ * plan file to pair. choudoufu v0.13.0 admits both under a `live` block
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878)), and
+ * there the pairing matters more than on a stock root, not less: the apply
+ * re-plans the live system and compares its fresh plan against the file it was
+ * handed, so a plan file spelled out as a literal is an approval for a run
+ * nobody can trace back to a plan step. The exemption is gone with the
+ * condition that produced it, and this rule reads no project config at all.
  */
 export const planBeforeApplyRule: LintRule = {
   id: "TF101",

package/src/lint/secret-shape.test.ts

@@ -0,0 +1,150 @@
+import { describe, expect, test } from "vitest";
+import {
+  isCredentialShapedValue,
+  isLiteralString,
+  isPlaceholderValue,
+  isSecretName,
+  secretShapedAssignment,
+} from "./secret-shape";
+
+describe("the name heuristic", () => {
+  test.each([
+    "password",
+    "db_password",
+    "PASSWORD",
+    "passwd",
+    "admin_passwd",
+    "secret",
+    "client_secret",
+    "secret_key",
+    "token",
+    "deploy_token",
+    "api_key",
+    "openai_api_key",
+    "private_key",
+    "access_key",
+  ])("%s reads like a credential", (name) => {
+    expect(isSecretName(name)).toBe(true);
+  });
+
+  test.each([
+    "region",
+    "instance_count",
+    "keystore",
+    "tokenizer",
+    "passwordless_sudo_enabled",
+    "bucket",
+  ])("%s does not", (name) => {
+    expect(isSecretName(name)).toBe(false);
+  });
+
+  test.each([
+    "secret_arn",
+    "db_password_file",
+    "api_key_id",
+    "private_key_path",
+    "deploy_token_name",
+  ])("%s is a locator, not the credential itself", (name) => {
+    expect(isSecretName(name)).toBe(false);
+  });
+
+  test("a locator suffix only excludes when it is the suffix", () => {
+    expect(isSecretName("arn_password")).toBe(true);
+    expect(isSecretName("file_secret")).toBe(true);
+  });
+});
+
+describe("the value heuristic", () => {
+  test("an AWS access key id is credential-shaped, through core's own detector", () => {
+    expect(isCredentialShapedValue("AKIA2E0XYZ4PQRSTUVWX")).toBe(true);
+  });
+
+  test("a GitHub token is, for the same reason", () => {
+    expect(isCredentialShapedValue("ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8")).toBe(true);
+  });
+
+  test("a JWT is", () => {
+    expect(
+      isCredentialShapedValue("eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTc2NH0.9mAcYbBqp4Ck2XjLwr7QeR1sT3uVwXyZ"),
+    ).toBe(true);
+  });
+
+  test("a PEM header is, even without the closing block", () => {
+    expect(isCredentialShapedValue("-----BEGIN RSA PRIVATE KEY-----\nMIIEow...")).toBe(true);
+  });
+
+  test("a long high-entropy token is", () => {
+    expect(isCredentialShapedValue("8Jd0hVn2XqB7sLtR4mYcE1zPgWfKa5UiQ3oNrTbA")).toBe(true);
+  });
+
+  test.each(["eu-west-1", "t3.micro", "postgres", "app-prod"])("%s is not", (value) => {
+    expect(isCredentialShapedValue(value)).toBe(false);
+  });
+
+  test("a model id or image ref is not, through core's identifier-slug filter", () => {
+    expect(isCredentialShapedValue("registry.example.com/team/app-server")).toBe(false);
+  });
+
+  test("a value shorter than eight characters is never judged", () => {
+    expect(isCredentialShapedValue("aB3$xY")).toBe(false);
+  });
+});
+
+describe("placeholders", () => {
+  test.each(["changeme", "CHANGE_ME", "change-me", "YOUR_API_KEY", "example-secret", "0000000000000000"])(
+    "%s is a placeholder",
+    (value) => {
+      expect(isPlaceholderValue(value)).toBe(true);
+    },
+  );
+
+  test("a placeholder is never a finding, whatever the attribute is called", () => {
+    expect(secretShapedAssignment("db_password", "CHANGE_ME")).toBeUndefined();
+    expect(secretShapedAssignment("api_key", "your-api-key")).toBeUndefined();
+  });
+});
+
+describe("literals versus references", () => {
+  test("an hcl2json expression is not a literal", () => {
+    // Both `x = var.y` and `x = "${var.y}"` parse to this string.
+    expect(isLiteralString("${var.db_password}")).toBe(false);
+    expect(isLiteralString("${data.aws_secretsmanager_secret_version.db.secret_string}")).toBe(false);
+  });
+
+  test("a template with an interpolation in it is not a literal either", () => {
+    expect(isLiteralString("prefix-${var.env}-suffix")).toBe(false);
+  });
+
+  test("a plain string is", () => {
+    expect(isLiteralString("hunter2-prod-db")).toBe(true);
+  });
+
+  test("a non-string is not", () => {
+    expect(isLiteralString(3)).toBe(false);
+    expect(isLiteralString(true)).toBe(false);
+    expect(isLiteralString(["a"])).toBe(false);
+  });
+});
+
+describe("secretShapedAssignment", () => {
+  test("fires on the name when the value is an unremarkable literal", () => {
+    expect(secretShapedAssignment("db_password", "hunter2-prod-db")).toEqual({ reason: "name", length: 15 });
+  });
+
+  test("fires on the value when the name says nothing", () => {
+    const shape = secretShapedAssignment("bootstrap", "AKIA2E0XYZ4PQRSTUVWX");
+    expect(shape?.reason).toBe("value");
+  });
+
+  test("prefers the value reason when both hold", () => {
+    expect(secretShapedAssignment("api_key", "ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8")?.reason).toBe("value");
+  });
+
+  test("declines a reference, which is the fix rather than the finding", () => {
+    expect(secretShapedAssignment("db_password", "${var.db_password}")).toBeUndefined();
+  });
+
+  test("declines a short value", () => {
+    expect(secretShapedAssignment("password", "abc123")).toBeUndefined();
+  });
+});