flecto 4.1.1 → 4.2.0

package/CHANGELOG.md

@@ -7,6 +7,97 @@ The format is based on [Keep a Changelog], and this project adheres to
 
 ## [Unreleased]
 
+## [4.2.0] - 2026-10-05
+
+The first npm release since 4.1.1. The `v4.1.2` tag moved the documented Action
+pins but its npm publish failed (the version was never bumped), so the fixes
+below reach npm for the first time here.
+
+### Added
+
+- **`--new-files added`: a pull request that adds a config file no longer has to
+  fail the gate.** `flecto ci --snapshot-ref` stopped with "Failed to resolve
+  snapshot baseline" whenever a target was not in the base commit, so any PR
+  that added a values file or a manifest matched by the gate's glob went red,
+  whatever `--fail-on` said. With `--new-files added` (Action input
+  `new-files: added`), such a file is reported as new, every key `added`, and
+  policies still run on it.
+
+  The default is unchanged and still fails closed, and the error now names the
+  flag. A renamed file looks exactly like a new one, and would turn every
+  `changed` into an `added`, which the Action's `policy,error` does not gate,
+  so this is opt-in and refused from `.flectorc`, as `snapshotRef` is.
+
+  Found by replaying Flecto over a real repository's infra history, where one
+  commit in twelve added a values file.
+
+### Changed
+
+- **`KEY=VALUE` lists diff by KEY, so one inserted variable is one addition**
+  ([#226]). Compose writes `environment`, `labels` and `build.args` as a map or
+  as a list of `KEY=VALUE` strings, and means the same by both. The list form
+  diffed by position: a real pull request that inserted ten `OIDC_*` variables
+  read as 31 `changed` rows, each pairing two unrelated variables. It now reads
+  as 9 additions under `environment["OIDC_ISSUER_URL"]` and so on, and the
+  language server places diagnostics on the right line.
+
+  Paths for these lists change from `environment[3]` to `environment["KEY"]`.
+  `--no-array-id` restores index paths. A list counts only when every item is a
+  `KEY=VALUE` or bare `KEY` with unique keys and at least one `=`, so `command:
+  [python, app.py]` and `args: [--a=1]` keep their order-sensitive diff.
+
+[#226]: https://github.com/myselfsiddharth/Flecto/issues/226
+
+### Fixed
+
+- **A connection string whose password is a reference is no longer reported as
+  a leaked credential** ([#225]). `postgres://app:$(DB_PASSWORD)@db/app`, the
+  Kubernetes form of env-var expansion, and `{{ .Values.x }}` Helm expressions
+  were flagged `url-credentials` (error), although `${DB_PASSWORD}` already
+  was not. A literal password in the same position is still caught. Found on
+  a real repository's ConfigMap during outreach.
+
+- **The symlinked-baseline check never fired below the repository root.** It
+  asked `git ls-tree` for a root-relative path from inside the file's own
+  directory, so for `config/app.yaml` it looked up `config/config/app.yaml`,
+  found nothing, and let the baseline through as the link's target path. Only
+  files at the root were protected.
+
+- **Pointing Flecto at a Helm chart says so, instead of reporting broken YAML**
+  ([#210]). `flecto ci "helm/**/*.yaml"` is the first thing a Helm user tries,
+  and it failed with a syntax error pointing inside a chart template that is
+  perfectly valid — sending them to debug their chart rather than their command.
+
+  A YAML file that **fails to parse** and carries Go template delimiters now
+  reports what it is and the two ways to read it: render the chart, or point at
+  `values.yaml`. The check runs only after a parse failure, so valid YAML
+  holding `{{ ... }}` in a string — a Prometheus alert rule, say — is untouched.
+
+  Found by running Flecto against real repositories instead of our own fixtures.
+
+- **`flecto ci --format human` now explains itself** ([#211], fixed by
+  [@DYNOSuprovo](https://github.com/DYNOSuprovo) in [#212]). `human` is the
+  default for `plan` and `compare` and what `watch` prints, so reaching for it on
+  `ci` is the natural mistake — especially when running `ci` locally to see what
+  the gate will say. The old error listed the valid values without saying that
+  `human` was deliberately excluded, so it read as a typo or an inconsistency. It
+  now names the reason and both ways out: `pr-comment` to read a run, `json` to
+  parse it. An actual typo still gets the list.
+
+- **A command killed by a signal is a failed delivery, not a success**
+  ([#185], fixed by [@nova-loop](https://github.com/nova-loop) in [#214]).
+  `watch --command` checked only the exit code, which is `null` when a signal
+  ends the process, so an OOM-killed or timed-out hook counted as delivered:
+  `--on-alert-failure` never fired and at-least-once deliveries were marked done.
+  The warning now names the signal.
+
+[#210]: https://github.com/myselfsiddharth/Flecto/issues/210
+[#185]: https://github.com/myselfsiddharth/Flecto/issues/185
+[#211]: https://github.com/myselfsiddharth/Flecto/issues/211
+[#212]: https://github.com/myselfsiddharth/Flecto/pull/212
+[#214]: https://github.com/myselfsiddharth/Flecto/pull/214
+[#225]: https://github.com/myselfsiddharth/Flecto/issues/225
+
 ## [4.1.1] - 2026-09-29
 
 ### Fixed
@@ -20,8 +111,6 @@ The format is based on [Keep a Changelog], and this project adheres to
   The rest of the pitch — that Flecto never runs `terraform`, `helm`, or `sops`,
   and never decrypts — lives in the README, which has room for it.
 
-### Fixed
-
 - **Documented Action pins moved from `@v4.0.0` to `@v4.1.0`.** Tags are
   immutable, and the fix that stopped the bundled Actions installing the pre-4.0
   CLI shipped *in* 4.1.0 — so while the examples said `@v4.0.0` they pointed at a
@@ -1322,7 +1411,8 @@ fixed — those runs were never actually gated — but the failure is new.
 - Misconfigured policy packs/plugins cause `watch` to exit non-zero instead of
   continuing with no policies.
 
-[Unreleased]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.1...HEAD
+[Unreleased]: https://github.com/myselfsiddharth/Flecto/compare/v4.2.0...HEAD
+[4.2.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.1...v4.2.0
 [4.1.1]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.0...v4.1.1
 [4.1.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.0.0...v4.1.0
 [4.0.0]: https://github.com/myselfsiddharth/Flecto/compare/v3.1.0...v4.0.0

package/README.md

@@ -6,6 +6,7 @@
 </p>
 
 <p align="center">
+  <a href="https://github.com/marketplace/actions/flecto-pr-risk"><img alt="GitHub Marketplace" src="https://img.shields.io/badge/marketplace-Flecto%20PR%20Risk-34d399?style=flat-square&logo=github&labelColor=0b1220"/></a>
   <a href="https://www.npmjs.com/package/flecto"><img alt="npm" src="https://img.shields.io/npm/v/flecto?style=flat-square&color=34d399&labelColor=0b1220"/></a>
   <a href="https://github.com/myselfsiddharth/Flecto/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/myselfsiddharth/Flecto/ci.yml?branch=main&style=flat-square&label=CI&labelColor=0b1220"/></a>
   <a href="LICENSE"><img alt="MIT" src="https://img.shields.io/badge/license-MIT-8fa3bf?style=flat-square&labelColor=0b1220"/></a>
@@ -74,6 +75,10 @@ aws_db_instance.main.#action
 
 ## Add it in 60 seconds
 
+Flecto PR Risk is on the
+[GitHub Marketplace](https://github.com/marketplace/actions/flecto-pr-risk), so
+`myselfsiddharth/Flecto@v4.1.2` is the whole reference.
+
 **Terraform** — point it at the plan JSON:
 
 ```yaml
@@ -86,7 +91,7 @@ steps:
   - run: |
       terraform plan -out=tf.plan
       terraform show -json tf.plan > plan.json
-  - uses: myselfsiddharth/Flecto/.github/actions/flecto-pr-risk@v4.1.0
+  - uses: myselfsiddharth/Flecto@v4.1.2
     with:
       terraform-plan: plan.json
       fail-on: error
@@ -104,7 +109,7 @@ steps:
     with:
       fetch-depth: 0
   - run: helm template ./chart > rendered.yaml
-  - uses: myselfsiddharth/Flecto/.github/actions/flecto-pr-risk@v4.1.0
+  - uses: myselfsiddharth/Flecto@v4.1.2
     with:
       targets: rendered.yaml
       policies: kubernetes

package/index.js

@@ -385,18 +385,51 @@ function gitRepoRelativePath(filePath) {
  * @returns {boolean}
  */
 function baselineEntryIsSymlink(commit, rel, dir) {
+  return baselineEntryMode(commit, rel, dir) === '120000';
+}
+
+/**
+ * The git mode of the entry at this path in this commit: '' when the commit
+ * has no such path, null when git could not answer.
+ * @param {string} commit
+ * @param {string} rel
+ * @param {string} dir
+ * @returns {string | null}
+ */
+function baselineEntryMode(commit, rel, dir) {
   try {
-    const entry = execFileSync(
+    // `rel` is relative to the repository root, and without --full-tree
+    // ls-tree resolves it against `dir`: for any file below the root it looked
+    // up `sub/sub/file`, found nothing, and the symlink check never fired.
+    return execFileSync(
       'git',
-      ['-C', dir, 'ls-tree', '--format=%(objectmode)', '--end-of-options', commit, '--', rel],
+      ['-C', dir, 'ls-tree', '--full-tree', '--format=%(objectmode)', '--end-of-options', commit, '--', rel],
       { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
     ).trim();
-    return entry === '120000';
   } catch {
-    return false;
+    return null;
   }
 }
 
+/**
+ * Returned in place of a baseline state when `--new-files added` is set and the
+ * baseline commit does not contain the file. A distinct value rather than an
+ * empty document, so the caller cannot mistake "this file is new" for "this
+ * file was empty" (#186), and has to say which one it is reporting.
+ */
+const NEW_FILE = Symbol('new file');
+
+/**
+ * An empty baseline of the same shape as the head document, so every key
+ * diffs as `added`. Not `parseContent(path, '')`: JSON has no empty document.
+ * @param {unknown} after
+ */
+function emptyBaselineLike(after) {
+  if (Array.isArray(after)) return [];
+  if (after !== null && typeof after === 'object') return {};
+  return null;
+}
+
 /**
  * Resolve symlinks where possible, falling back to the input when the path does
  * not exist on disk.
@@ -518,7 +551,7 @@ function isExplicitPath(value) {
     || value.startsWith('..\\');
 }
 
-function readSnapshotStateFromRef(filePath, snapshotRef, store, snapshotFile) {
+function readSnapshotStateFromRef(filePath, snapshotRef, store, snapshotFile, { newFiles = 'fail' } = {}) {
   if (snapshotRef === '') {
     // The same unset-CI-variable case readSnapshotFile refuses. Falling back to
     // the store here would compare against something the operator did not
@@ -576,6 +609,19 @@ function readSnapshotStateFromRef(filePath, snapshotRef, store, snapshotFile) {
   }
 
   const rel = gitRepoRelativePath(filePath);
+  // A file the baseline commit does not have is a file this change adds. The
+  // default is still to fail closed: a rename reads as a new file too, and
+  // turns every `changed` into an `added` that the Action's default --fail-on
+  // does not gate. `--new-files added` is the explicit, CLI-only opt-in. The
+  // commit is the operator's, so the change under review cannot fake absence.
+  if (baselineEntryMode(commit, rel, repoDir) === '') {
+    if (newFiles === 'added') return NEW_FILE;
+    throw new Error(
+      `"${rel}" is not in ${ref}, so there is no baseline to diff it against.`
+      + ' If this change adds the file, pass --new-files added to report every key as added'
+      + ' (policies still run); the default fails closed because a rename looks the same.',
+    );
+  }
   if (baselineEntryIsSymlink(commit, rel, repoDir)) {
     throw new Error(
       `"${rel}" is a symbolic link in ${ref}, so the baseline there is a path, not a configuration.`
@@ -1309,6 +1355,7 @@ program
   .option('-p, --profile <name>', 'Use profile from .flectorc (else FLECTO_PROFILE)')
   .option('--snapshot-ref <ref>', 'Baseline git revision (a snapshot path also works if it is path-shaped)')
   .option('--snapshot-file <path>', 'Baseline snapshot file, never consulted as a git revision')
+  .option('--new-files <mode>', 'A file not in the --snapshot-ref commit: fail (default) | added (every key reported as added)')
   .option('--snapshot-store <id>', `Snapshot store to read: ${SNAPSHOT_STORE_IDS.join(' | ')}`)
   .option('--snapshot-dir <path>', 'Directory holding the snapshot store (default: .flecto-snapshots local, .flecto/snapshots shared)')
   .option('--format <type>', 'Output format: json | ndjson | sarif | github-annotations | pr-comment', 'json')
@@ -1347,9 +1394,23 @@ program
 
       const ignorePaths = parseCsv(effective.ignore);
       const failOn = parseFailOn(effective.failOn ?? 'changed,policy,error');
+      const newFiles = String(effective.newFiles ?? 'fail');
+      if (newFiles !== 'fail' && newFiles !== 'added') {
+        throw new Error(`--new-files must be fail or added (got ${newFiles})`);
+      }
       const format = String(effective.format ?? 'json');
-      if (!['json', 'ndjson', 'sarif', 'github-annotations', 'pr-comment'].includes(format)) {
-        throw new Error('--format must be json, ndjson, sarif, github-annotations, or pr-comment');
+      if (format === 'human') {
+        throw new Error(
+          '--format human is not available for `ci`, whose output is meant to be consumed by a machine. Use pr-comment to read it yourself, or json to parse it. (human is the default for `plan` and `compare`.)',
+        );
+      }
+      // Listed once: the check and the message drift apart otherwise, and the
+      // message is the only place a user finds out what is allowed. The wording
+      // is unchanged -- this is a dedup, not a rewording.
+      const CI_FORMATS = ['json', 'ndjson', 'sarif', 'github-annotations', 'pr-comment'];
+      if (!CI_FORMATS.includes(format)) {
+        const listed = `${CI_FORMATS.slice(0, -1).join(', ')}, or ${CI_FORMATS.at(-1)}`;
+        throw new Error(`--format must be ${listed}`);
       }
       const prCommentPost = Boolean(effective.prCommentPost);
       if (effective.prProvider && !PR_PROVIDER_IDS.includes(String(effective.prProvider))) {
@@ -1421,13 +1482,22 @@ program
           : alignStateWithStore(parseFile(filepath), snapshotStore);
         let before;
         try {
-          before = readSnapshotStateFromRef(filepath, effective.snapshotRef, snapshotStore, effective.snapshotFile);
+          before = readSnapshotStateFromRef(
+            filepath, effective.snapshotRef, snapshotStore, effective.snapshotFile, { newFiles },
+          );
         } catch (err) {
           throw new Error(
             `Failed to resolve snapshot baseline for "${filepath}"` +
             `${effective.snapshotRef ? ` (ref: ${effective.snapshotRef})` : ''}: ${err.message}`
           );
         }
+        if (before === NEW_FILE) {
+          renderWarn(
+            `${relative(cwd, filepath).replaceAll('\\', '/')} is not in ${effective.snapshotRef}: reporting it as a new file,`
+            + ' every key added (--new-files added).',
+          );
+          before = emptyBaselineLike(after);
+        }
         const events = diffTrees(before, after, dOpts);
         const rawFindings = await evaluatePolicies(events, {
           cwd,

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "provenance": true
   },
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "Reads your Terraform plan and Kubernetes changes and posts a plain-English risk summary on every pull request, blocking the dangerous ones",
   "license": "MIT",
   "keywords": [

package/src/alerter.js

@@ -204,7 +204,12 @@ export function runCommand(command, envelope) {
         renderWarn(`Command failed to start: ${err.message}`);
         settle(false);
       });
-      child.on('close', (code) => {
+      child.on('close', (code, signal) => {
+        if (signal) {
+          renderWarn(`Command failed (signal ${signal}): ${command}`);
+          settle(false);
+          return;
+        }
         if (code && code !== 0) {
           renderWarn(`Command failed (exit ${code}): ${command}`);
           settle(false);

package/src/config.js

@@ -519,7 +519,11 @@ export function assertSnapshotRefFromCli(effective, cliOverrides) {
   if (rcBaselineAllowed()) return;
   // `snapshotFile` picks the baseline just as directly, so it is gated with it
   // rather than left as the way around it.
-  for (const option of ['snapshotRef', 'snapshotFile']) {
+  // `newFiles` decides what a file missing from the baseline is compared
+  // against, and a rename is a missing file: from .flectorc it would let a pull
+  // request move prod.yaml and have every `changed` reported as `added`.
+  const flags = { snapshotRef: 'snapshot-ref', snapshotFile: 'snapshot-file', newFiles: 'new-files' };
+  for (const [option, flag] of Object.entries(flags)) {
     if (effective[option] === undefined || cliOverrides[option] !== undefined) continue;
     throw new Error(
       `Refusing "${option}" declared in .flectorc: it chooses the baseline every change is`
@@ -527,7 +531,7 @@ export function assertSnapshotRefFromCli(effective, cliOverrides) {
       + ' pointing it at "HEAD", or at a file it committed, compares every file against itself'
       + ' and exits 0.\n'
       + `Declared: ${JSON.stringify(effective[option])}\n`
-      + `Pass --${option === 'snapshotRef' ? 'snapshot-ref' : 'snapshot-file'} on the command line`
+      + `Pass --${flag} on the command line`
       + ' instead, or set FLECTO_ALLOW_RC_BASELINE=1 if this config is trusted.',
     );
   }

package/src/differ.js

@@ -361,6 +361,48 @@ function identityMap(items, idKey) {
   return map;
 }
 
+// `KEY=VALUE`, or a bare `KEY` (Compose's pass-through from the host).
+export const ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_.-]*)(?:=|$)/;
+
+/**
+ * Key a list of `KEY=VALUE` strings by KEY, or return null when it is not one.
+ *
+ * Compose writes `environment`, `labels` and `build.args` either as a map or as
+ * a list of assignments, and means the same thing by both. Diffed by position,
+ * one inserted variable turned every later line into a `changed` pairing two
+ * unrelated variables (#226). At least one item must carry an `=`, so a plain
+ * word list such as `command: [python, app.py]` keeps its order-sensitive diff.
+ * @param {unknown[]} items
+ * @returns {Map<string, { value: unknown, index: number }> | null}
+ */
+function assignmentMap(items) {
+  /** @type {Map<string, { value: unknown, index: number }>} */
+  const map = new Map();
+  for (let i = 0; i < items.length; i++) {
+    const item = items[i];
+    if (typeof item !== 'string') return null;
+    const match = ASSIGNMENT_RE.exec(item);
+    if (!match || map.has(match[1])) return null;
+    map.set(match[1], { value: item, index: i });
+  }
+  return map;
+}
+
+/**
+ * Both sides are assignment lists and at least one item assigns a value.
+ * @param {unknown[]} before
+ * @param {unknown[]} after
+ * @returns {{ beforeMap: Map<string, { value: unknown, index: number }>, afterMap: Map<string, { value: unknown, index: number }> } | null}
+ */
+function assignmentMaps(before, after) {
+  const beforeMap = assignmentMap(before);
+  const afterMap = beforeMap && assignmentMap(after);
+  if (!beforeMap || !afterMap) return null;
+  const assigns = (item) => typeof item === 'string' && item.includes('=');
+  if (!before.some(assigns) && !after.some(assigns)) return null;
+  return { beforeMap, afterMap };
+}
+
 /**
  * Select a configured identity key, or auto-detect id then name.
  * @param {unknown[]} before
@@ -425,10 +467,11 @@ function arraySignature(value) {
  */
 function diffArrays(before, after, basePath, events, options = {}, ancestors = newAncestors()) {
   const idKey = resolveArrayIdKey(before, after, options);
+  const assignments = !idKey && options.arrayIdentity !== false ? assignmentMaps(before, after) : null;
 
-  if (idKey) {
-    const beforeMap = identityMap(before, idKey);
-    const afterMap = identityMap(after, idKey);
+  if (idKey || assignments) {
+    const { beforeMap, afterMap } = assignments
+      ?? { beforeMap: identityMap(before, idKey), afterMap: identityMap(after, idKey) };
 
     if (beforeMap && afterMap) {
       for (const [key, afterItem] of afterMap) {

package/src/parser.js

@@ -435,6 +435,30 @@ export function yamlDocumentKeys(docs) {
  * @returns {unknown}
  * @throws {Error} on unsupported format or parse failure
  */
+/**
+ * Whether a file that failed to parse as YAML looks like a Helm chart template.
+ *
+ * Only ever consulted **after** a parse failure, which is what keeps it from
+ * firing on valid YAML that happens to contain braces -- a Prometheus rule
+ * holding `{{ $labels.instance }}` in a string parses fine and never reaches
+ * here. Go template delimiters in a file that did not parse are close to
+ * conclusive, and `{{-`, `nindent`, `include "` and a `templates/` path are the
+ * shapes that only a chart has.
+ *
+ * @param {string} raw
+ * @param {string} filepath
+ * @returns {boolean}
+ */
+function looksLikeHelmTemplate(raw, filepath) {
+  if (!/\{\{/u.test(raw) || !/\}\}/u.test(raw)) return false;
+  const path = filepath.replace(/\\/gu, '/');
+  return /\/templates\//u.test(path)
+    || /\{\{-/u.test(raw)
+    || /\|\s*nindent\b/u.test(raw)
+    || /\{\{[^}]*\binclude\s+"/u.test(raw)
+    || /\{\{[^}]*\.Values\./u.test(raw);
+}
+
 export function parseContent(filepath, raw) {
   const ext = extname(filepath).toLowerCase();
   const envLike = isEnvFilename(filepath);
@@ -469,6 +493,19 @@ export function parseContent(filepath, raw) {
       parsed = TOML.parse(raw);
     }
   } catch (err) {
+    // A chart template is not YAML, and saying so beats a column number. Without
+    // this, `flecto ci "helm/**/*.yaml"` -- the first thing a Helm user tries --
+    // reports a syntax error inside a file that is perfectly valid, and sends
+    // them to debug their chart instead of their command.
+    if ((ext === '.yaml' || ext === '.yml') && looksLikeHelmTemplate(raw, filepath)) {
+      throw new Error(
+        `"${filepath}" looks like a Helm template, not YAML.\n` +
+        'Flecto reads rendered manifests, so render the chart first:\n' +
+        '  helm template ./chart > rendered.yaml && flecto ci rendered.yaml\n' +
+        'Or point Flecto at the values file, which is plain YAML:\n' +
+        '  flecto ci chart/values.yaml'
+      );
+    }
     const lineMatch = err.message?.match(/line (\d+)/i);
     const lineInfo = lineMatch ? ` (line ${lineMatch[1]})` : '';
     throw new Error(

package/src/positions.js

@@ -3,6 +3,7 @@ import yaml from 'js-yaml';
 
 import { isArmoredAgeFile } from './encrypted.js';
 import { isEnvFilename, isIniFilename, stripJsonComments, yamlDocumentKeys } from './parser.js';
+import { ASSIGNMENT_RE } from './differ.js';
 
 /**
  * Where a config path lives in the source text (#142).
@@ -247,6 +248,12 @@ function itemByIdentity(items, quoted, arrayIdKey) {
       if (String(id) === target) matches.add(item);
     }
   }
+  // A `KEY=VALUE` list (Compose `environment`, `labels`) is keyed by KEY.
+  if (matches.size === 0 && !arrayIdKey) {
+    for (const item of items) {
+      if (typeof item.value === 'string' && ASSIGNMENT_RE.exec(item.value)?.[1] === target) matches.add(item);
+    }
+  }
   return matches.size === 1 ? [...matches][0] : null;
 }
 

package/src/secrets.js

@@ -78,8 +78,13 @@ const URL_CREDENTIALS_RE = /[a-z][a-z0-9+.-]{0,32}:\/\/[^\s/:@]+:([^\s/@]+)@/gi;
  * Values that only *reference* a secret. Redacting these adds noise and, worse,
  * would make the policy rule fire on configs that correctly keep secrets out of
  * the file.
+ *
+ * `$(NAME)` is Kubernetes' env-var expansion in a container's env and args, and
+ * `{{ ... }}` a Helm or Jinja template expression: in a connection string such
+ * as `postgres://app:$(DB_PASSWORD)@db/app` both are the reference, not the
+ * credential.
  */
-const PLACEHOLDER_RE = /^(?:\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z0-9_]+%|<[^>]*>|\*+)$/;
+const PLACEHOLDER_RE = /^(?:\$\{[^}]*\}|\$\([A-Za-z_][A-Za-z0-9_]*\)|\{\{[^}]*\}\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z0-9_]+%|<[^>]*>|\*+)$/;
 
 /**
  * High-entropy fallback gates. Every one of these must pass: