flecto 4.3.0 → 4.4.0

package/CHANGELOG.md

@@ -7,6 +7,22 @@ The format is based on [Keep a Changelog], and this project adheres to
 
 ## [Unreleased]
 
+## [4.4.0] - 2026-10-05
+
+### Changed
+
+- **Flag lists diff by flag name, so removing one arg is one removal**
+  ([#238]). A real pull request that removed the first of eight container
+  `args` read as 7 `changed` and 1 `removed`, each pairing two unrelated flags.
+  It now reads as `removed args["--keytoolPath"]`. A list counts when every item
+  is `-x`, `--name` or `--name=value` with unique names; a repeated `--set`,
+  `["--port", "8080"]`, and `["-c", "echo hi"]` keep the position diff, and
+  `--no-array-id` turns it off. Paths change from `args[0]` to
+  `args["--name"]` for these lists. No built-in pack rule matches an `args`
+  index.
+
+[#238]: https://github.com/myselfsiddharth/Flecto/issues/238
+
 ## [4.3.0] - 2026-10-05
 
 ### Fixed
@@ -1438,7 +1454,8 @@ fixed — those runs were never actually gated — but the failure is new.
 - Misconfigured policy packs/plugins cause `watch` to exit non-zero instead of
   continuing with no policies.
 
-[Unreleased]: https://github.com/myselfsiddharth/Flecto/compare/v4.3.0...HEAD
+[Unreleased]: https://github.com/myselfsiddharth/Flecto/compare/v4.4.0...HEAD
+[4.4.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.3.0...v4.4.0
 [4.3.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.2.0...v4.3.0
 [4.2.0]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.1...v4.2.0
 [4.1.1]: https://github.com/myselfsiddharth/Flecto/compare/v4.1.0...v4.1.1

package/README.md

@@ -77,7 +77,7 @@ aws_db_instance.main.#action
 
 Flecto PR Risk is on the
 [GitHub Marketplace](https://github.com/marketplace/actions/flecto-pr-risk), so
-`myselfsiddharth/Flecto@v4.2.0` is the whole reference.
+`myselfsiddharth/Flecto@v4.3.0` is the whole reference.
 
 **Terraform** — point it at the plan JSON:
 
@@ -91,7 +91,7 @@ steps:
   - run: |
       terraform plan -out=tf.plan
       terraform show -json tf.plan > plan.json
-  - uses: myselfsiddharth/Flecto@v4.2.0
+  - uses: myselfsiddharth/Flecto@v4.3.0
     with:
       terraform-plan: plan.json
       fail-on: error
@@ -109,7 +109,7 @@ steps:
     with:
       fetch-depth: 0
   - run: helm template ./chart > rendered.yaml
-  - uses: myselfsiddharth/Flecto@v4.2.0
+  - uses: myselfsiddharth/Flecto@v4.3.0
     with:
       targets: rendered.yaml
       policies: kubernetes

package/package.json

@@ -4,7 +4,7 @@
     "access": "public",
     "provenance": true
   },
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "Reads your Terraform plan and Kubernetes changes and posts a plain-English risk summary on every pull request, blocking the dangerous ones",
   "license": "MIT",
   "keywords": [

package/src/differ.js

@@ -364,24 +364,43 @@ function identityMap(items, idKey) {
 // `KEY=VALUE`, or a bare `KEY` (Compose's pass-through from the host).
 export const ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_.-]*)(?:=|$)/;
 
+// `-x`, `--name`, or `--name=value`: a command-line flag, keyed by its name.
+export const FLAG_RE = /^(-{1,2}[A-Za-z0-9][A-Za-z0-9_.-]*)(?:=|$)/;
+
 /**
- * Key a list of `KEY=VALUE` strings by KEY, or return null when it is not one.
+ * String-list shapes that are really maps, and how each is keyed.
  *
  * Compose writes `environment`, `labels` and `build.args` either as a map or as
- * a list of assignments, and means the same thing by both. Diffed by position,
+ * a list of `KEY=VALUE`, and means the same thing by both. Diffed by position,
  * one inserted variable turned every later line into a `changed` pairing two
- * unrelated variables (#226). At least one item must carry an `=`, so a plain
- * word list such as `command: [python, app.py]` keeps its order-sensitive diff.
+ * unrelated variables (#226); one removed container arg did the same to every
+ * later flag (#238). A list counts only when every item has the shape and keys
+ * are unique, so a repeated `--set` falls back to position.
+ *
+ * Assignments also need at least one `=`, so a plain word list such as
+ * `command: [python, app.py]` keeps its order-sensitive diff. A flag list does
+ * not: `[-v, --debug]` is already unambiguous, and `["--port", "8080"]` or
+ * `["-c", "echo hi"]` fail the shape and keep position.
+ * @type {Array<{ re: RegExp, needsValue: boolean }>}
+ */
+const KEYED_STRING_SHAPES = [
+  { re: ASSIGNMENT_RE, needsValue: true },
+  { re: FLAG_RE, needsValue: false },
+];
+
+/**
+ * Key a list of strings by the given shape, or return null when it is not one.
  * @param {unknown[]} items
+ * @param {RegExp} re
  * @returns {Map<string, { value: unknown, index: number }> | null}
  */
-function assignmentMap(items) {
+function keyedStringMap(items, re) {
   /** @type {Map<string, { value: unknown, index: number }>} */
   const map = new Map();
   for (let i = 0; i < items.length; i++) {
     const item = items[i];
     if (typeof item !== 'string') return null;
-    const match = ASSIGNMENT_RE.exec(item);
+    const match = re.exec(item);
     if (!match || map.has(match[1])) return null;
     map.set(match[1], { value: item, index: i });
   }
@@ -389,18 +408,22 @@ function assignmentMap(items) {
 }
 
 /**
- * Both sides are assignment lists and at least one item assigns a value.
+ * Both sides have the same keyed shape (see KEYED_STRING_SHAPES).
  * @param {unknown[]} before
  * @param {unknown[]} after
  * @returns {{ beforeMap: Map<string, { value: unknown, index: number }>, afterMap: Map<string, { value: unknown, index: number }> } | null}
  */
 function assignmentMaps(before, after) {
-  const beforeMap = assignmentMap(before);
-  const afterMap = beforeMap && assignmentMap(after);
-  if (!beforeMap || !afterMap) return null;
   const assigns = (item) => typeof item === 'string' && item.includes('=');
-  if (!before.some(assigns) && !after.some(assigns)) return null;
-  return { beforeMap, afterMap };
+  for (const { re, needsValue } of KEYED_STRING_SHAPES) {
+    const beforeMap = keyedStringMap(before, re);
+    const afterMap = beforeMap && keyedStringMap(after, re);
+    if (!beforeMap || !afterMap) continue;
+    if (beforeMap.size === 0 && afterMap.size === 0) continue;
+    if (needsValue && !before.some(assigns) && !after.some(assigns)) continue;
+    return { beforeMap, afterMap };
+  }
+  return null;
 }
 
 /**

package/src/positions.js

@@ -3,7 +3,7 @@ import yaml from 'js-yaml';
 
 import { isArmoredAgeFile } from './encrypted.js';
 import { isEnvFilename, isIniFilename, stripJsonComments, yamlDocumentKeys } from './parser.js';
-import { ASSIGNMENT_RE } from './differ.js';
+import { ASSIGNMENT_RE, FLAG_RE } from './differ.js';
 
 /**
  * Where a config path lives in the source text (#142).
@@ -248,10 +248,13 @@ function itemByIdentity(items, quoted, arrayIdKey) {
       if (String(id) === target) matches.add(item);
     }
   }
-  // A `KEY=VALUE` list (Compose `environment`, `labels`) is keyed by KEY.
+  // A `KEY=VALUE` list (Compose `environment`, `labels`) is keyed by KEY, and
+  // a flag list (container `args`) by flag name.
   if (matches.size === 0 && !arrayIdKey) {
     for (const item of items) {
-      if (typeof item.value === 'string' && ASSIGNMENT_RE.exec(item.value)?.[1] === target) matches.add(item);
+      if (typeof item.value !== 'string') continue;
+      const key = ASSIGNMENT_RE.exec(item.value)?.[1] ?? FLAG_RE.exec(item.value)?.[1];
+      if (key === target) matches.add(item);
     }
   }
   return matches.size === 1 ? [...matches][0] : null;