@theglitchking/gimme-the-lint 2.5.0 → 2.5.1

package/.claude-plugin/marketplace.json

@@ -6,13 +6,13 @@
   },
   "metadata": {
     "description": "Official marketplace for gimme-the-lint - polyglot progressive linting with per-app baselines and drift detection",
-    "version": "2.5.0"
+    "version": "2.5.1"
   },
   "plugins": [
     {
       "name": "gimme-the-lint",
       "description": "Polyglot progressive linting for monorepos — adapter-driven baselines, per-app drift detection, and idempotent skips across JavaScript/TypeScript, Python, Go, Rust, Terraform, and Ansible.",
-      "version": "2.5.0",
+      "version": "2.5.1",
       "author": {
         "name": "TheGlitchKing"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gimme-the-lint",
   "description": "Polyglot progressive linting for monorepos — adapter-driven baselines, per-app drift detection, and idempotent skips across JavaScript/TypeScript, Python, Go, Rust, Terraform, and Ansible.",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "author": {
     "name": "TheGlitchKing",
     "email": "theglitchking@users.noreply.github.com"

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.5.1] - 2026-05-17
+
+### Fixed
+- **tflint config resolution is now root-aware.** In the standard Terraform
+  monorepo — one repo-root `.tflint.hcl`, many nested `modules/*` / `envs/*`
+  units — the adapter resolved config only in the unit directory, so every
+  unit was linted with tflint defaults: the repo's preset, plugin declarations
+  and `rule { enabled = false }` overrides were silently ignored and
+  `tflint --init` never ran. Meanwhile `configHashFor()` *did* find the
+  repo-root config, so the baseline's `config_hash` reflected a config the
+  linter never actually used — a silent correctness bug. A new shared resolver,
+  `LinterAdapter.resolveConfigPath()`, walks up from the unit directory to the
+  project root; `buildCommand()` and `initCommand()` now pass the resolved
+  file as an absolute `--config`, and `configHashFor()` hashes that same file —
+  the hashed config and the linted config can no longer disagree. A unit with
+  its own `.tflint.hcl` still wins (nearest-first); a repo with no config
+  anywhere still runs the zero-config core ruleset. The resolver is generic
+  (no provider name in code) and root-aware config-hashing now benefits every
+  adapter.
+
 ## [2.5.0] - 2026-05-17
 
 ### Added

package/lib/adapters/adapter.js

@@ -65,6 +65,38 @@ class LinterAdapter {
     return [];
   }
 
+  /**
+   * Resolve the EFFECTIVE config file for the unit being linted: walk up from
+   * `startDir` (default: appRoot) to projectRoot inclusive and return the
+   * absolute path of the nearest file named by configFiles(), or null if none
+   * exists anywhere on that path.
+   *
+   * Root-aware — this is what lets a single repo-root config (the standard
+   * monorepo layout: one config, many nested units) govern every unit. It is
+   * the SINGLE source of truth shared by the config-hash (baseline.js) and the
+   * linter invocation, so the hashed config and the linted config can never
+   * disagree.
+   * @param {string} [startDir]
+   * @returns {string|null}
+   */
+  resolveConfigPath(startDir) {
+    const names = this.configFiles();
+    if (!names || names.length === 0) return null;
+    const root = path.resolve(this.projectRoot);
+    let dir = path.resolve(startDir || this.appRoot);
+    while (true) {
+      for (const name of names) {
+        const candidate = path.join(dir, name);
+        if (fs.existsSync(candidate)) return candidate;
+      }
+      if (dir === root) break; // checked projectRoot — stop
+      const parent = path.dirname(dir);
+      if (parent === dir) break; // filesystem root reached
+      dir = parent;
+    }
+    return null;
+  }
+
   /** Return the first candidate path that exists, else the last candidate. */
   resolveBinary(candidates) {
     for (const candidate of candidates) {

package/lib/adapters/tflint.js

@@ -66,16 +66,22 @@ class TflintAdapter extends LinterAdapter {
 
   // --- .tflint.hcl introspection (generic — no provider is special-cased) ---
 
-  /** True when the unit directory carries a .tflint.hcl. */
+  /** True when an effective .tflint.hcl exists (the unit dir or up to root). */
   _hasConfig(dir) {
-    return fs.existsSync(path.join(dir || this.appRoot, '.tflint.hcl'));
+    return this.resolveConfigPath(dir) !== null;
   }
 
-  /** Enumerate every `plugin "<name>"` block declared in a unit's .tflint.hcl. */
+  /**
+   * Enumerate every `plugin "<name>"` block in the EFFECTIVE .tflint.hcl —
+   * the one resolveConfigPath() resolves, which may live up at the repo root,
+   * not in the unit dir.
+   */
   _declaredPlugins(dir) {
+    const configPath = this.resolveConfigPath(dir);
+    if (!configPath) return [];
     let hcl;
     try {
-      hcl = fs.readFileSync(path.join(dir || this.appRoot, '.tflint.hcl'), 'utf8');
+      hcl = fs.readFileSync(configPath, 'utf8');
     } catch {
       return [];
     }
@@ -105,10 +111,12 @@ class TflintAdapter extends LinterAdapter {
    * base adapter). A repo with no .tflint.hcl gets core linting, no init.
    */
   initCommand(cwd) {
-    if (this._hasConfig(cwd)) {
-      return { cmd: this.binary, args: ['--init'] };
-    }
-    return null;
+    const configPath = this.resolveConfigPath(cwd);
+    if (!configPath) return null;
+    // Pass the resolved config explicitly so `--init` reads the right
+    // .tflint.hcl for its plugin declarations — even when it lives up at the
+    // repo root rather than in the unit dir.
+    return { cmd: this.binary, args: ['--init', `--config=${configPath}`] };
   }
 
   // --- availability: agree with what lint() will actually see --------------
@@ -178,6 +186,14 @@ class TflintAdapter extends LinterAdapter {
         // Unresolvable target — fall back to the default cwd.
       }
     }
+
+    // tflint runs IN the unit dir; pass the effective config — which may live
+    // up at the repo root — as an absolute --config so the unit is linted with
+    // the repo's preset / plugin declarations / rule overrides, not tflint
+    // defaults. No config anywhere → plain tflint (zero-config core ruleset).
+    const configPath = this.resolveConfigPath(cwd);
+    if (configPath) args.push(`--config=${configPath}`);
+
     return { cmd: this.binary, args, cwd };
   }
 

package/lib/baseline.js

@@ -18,15 +18,17 @@ const gtlManifest = require('./gtl-manifest');
 // the baseline CLI, the hooks installer) can refuse to gate commits against a
 // baseline that never actually captured a linter.
 
-/** Hash the first config file found for an adapter (unit root, then project). */
+/**
+ * Hash the EFFECTIVE config file for an adapter. Resolution walks up from the
+ * unit dir to the project root via the adapter's shared resolver, so the
+ * hashed config is exactly the one the linter is invoked with — a repo-root
+ * config governing nested units is hashed correctly, never missed or faked.
+ */
+// eslint-disable-next-line no-unused-vars
 async function configHashFor(projectRoot, unitRoot, adapter) {
-  for (const name of adapter.configFiles()) {
-    for (const base of [unitRoot, projectRoot]) {
-      const hash = await manifestManager.hashFile(path.join(base, name));
-      if (hash !== 'unknown') return hash;
-    }
-  }
-  return 'unknown';
+  const configPath = adapter.resolveConfigPath(unitRoot);
+  if (!configPath) return 'unknown';
+  return manifestManager.hashFile(configPath);
 }
 
 /** Baseline a single unit across all its bound linters. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theglitchking/gimme-the-lint",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Polyglot progressive linting for monorepos — adapter-driven baselines, per-app drift detection, and idempotent skips across JavaScript/TypeScript, Python, Go, Rust, Terraform, and Ansible.",
   "keywords": [
     "linting",