timonel 0.4.0 → 2.0.0

package/CHANGELOG.md

@@ -1,3 +1,59 @@
+# [2.0.0](https://github.com/KenkoGeek/timonel/compare/v1.0.0...v2.0.0) (2025-09-07)
+
+### Bug Fixes
+
+- **ci:** remove redundant publish workflow and configure release token ([fcea159](https://github.com/KenkoGeek/timonel/commit/fcea15914617e372a2aafc8a30001cc54ec8bff6))
+- **examples:** update timonel dependency to ^1.0.0 ([3d1f692](https://github.com/KenkoGeek/timonel/commit/3d1f6922448648c7efe57cc1fdde9a5808e04d7e))
+- **helm:** remove automatic numbering from template files ([#20](https://github.com/KenkoGeek/timonel/issues/20)) ([f75748a](https://github.com/KenkoGeek/timonel/commit/f75748aee974a254f576807f26396b026262b42c))
+
+### Features
+
+- **ci:** add automatic CHANGELOG.md formatting to semantic-release ([6846b4d](https://github.com/KenkoGeek/timonel/commit/6846b4de2cfd411b7b9b9724d67830cf192ad2b9))
+- **core:** add Azure Application Gateway Ingress Controller (AGIC) support ([#19](https://github.com/KenkoGeek/timonel/issues/19)) ([75bbb99](https://github.com/KenkoGeek/timonel/commit/75bbb998981ca6492b09ad12c54e03050b307c27))
+- **core:** add Azure Disk StorageClass helper for AKS ([#18](https://github.com/KenkoGeek/timonel/issues/18)) ([5fb29de](https://github.com/KenkoGeek/timonel/commit/5fb29de260c4cabf6732520b0834cf0d0421a33a))
+
+### BREAKING CHANGES
+
+- **helm:** Template files no longer have automatic numbering prefixes
+
+- refactor(helm): unify template naming strategy and add breaking change notice
+
+* Simplify file naming logic with unified approach
+* Use consistent naming strategy for single and multiple documents
+* Add breaking change warning in README for numbered filename dependencies
+* Improve code maintainability with cleaner implementation
+
+Addresses PR review feedback for better consistency and user awareness.
+
+# [1.0.0](https://github.com/KenkoGeek/timonel/compare/v0.4.0...v1.0.0) (2025-09-07)
+
+### Bug Fixes
+
+- **ci:** configure GitHub App token for semantic-release bypass - Use RELEASE_TOKEN from npm-prd environment for checkout and semantic-release ([0d385d1](https://github.com/KenkoGeek/timonel/commit/0d385d1084a45de3ab731094e87196239811e6fb))
+- **ci:** disable body-max-line-length for semantic-release compatibility - Set body-max-line-length to 0 (disabled) to allow long changelog entries - Fixes semantic-release commit validation failures - Maintains other commitlint rules for developer commits ([b215f65](https://github.com/KenkoGeek/timonel/commit/b215f65bccb69a1cfca79084e6a9c96954fb478a))
+- **ci:** disable footer line length limit for semantic-release commits ([d5ae4dc](https://github.com/KenkoGeek/timonel/commit/d5ae4dc83e68f8fade4a8289d1ce4e2bae5046dd))
+- **ci:** disable footer-leading-blank for semantic-release compatibility - Set footer-leading-blank to 0 (disabled) to allow semantic-release footer format ([2f8c6c8](https://github.com/KenkoGeek/timonel/commit/2f8c6c863c6aabd1d3f3d8022b43fefecb02f010))
+- **ci:** replace CodeQL with security check in release validation ([#15](https://github.com/KenkoGeek/timonel/issues/15)) ([b8cecea](https://github.com/KenkoGeek/timonel/commit/b8cecea1eaf0bb6af3e6fd2f6bc38c2fb2c09f4d))
+- **ci:** resolve release workflow issues ([#16](https://github.com/KenkoGeek/timonel/issues/16)) ([ed5dc9b](https://github.com/KenkoGeek/timonel/commit/ed5dc9b3d86b531d4495d4d05dd913340333322c))
+
+### Features
+
+- add manual release workflow with GitHub Actions ([1035b2e](https://github.com/KenkoGeek/timonel/commit/1035b2e18fbb808e57438353c865ecd129d9e04d))
+- add NetworkPolicy helpers for Zero Trust network security ([#13](https://github.com/KenkoGeek/timonel/issues/13)) ([cee3b58](https://github.com/KenkoGeek/timonel/commit/cee3b5876de839ca3cf16dd6ca6e3b76626392ce))
+- **ci:** add required status checks validation to release workflow ([#14](https://github.com/KenkoGeek/timonel/issues/14)) ([7f8665f](https://github.com/KenkoGeek/timonel/commit/7f8665fa908215cc92a4dbefb7fec00de98464bb))
+- **ci:** implement automated semantic release with conventional commits ([02ce189](https://github.com/KenkoGeek/timonel/commit/02ce18943efd8019168b5f9af29be0140a9e1524))
+- **ci:** implement automated semantic release with conventional commits ([bb94fda](https://github.com/KenkoGeek/timonel/commit/bb94fda3e80bf3e010e7b53bdd1794f88060408a))
+- **core:** add NetworkPolicy helpers for Zero Trust network security ([34ac6bd](https://github.com/KenkoGeek/timonel/commit/34ac6bda3956e5fe326b72e9831bd4bb8bc660da))
+
+### Performance Improvements
+
+- **ci:** homogenize CI/CD workflows and optimize release pipeline ([#17](https://github.com/KenkoGeek/timonel/issues/17)) ([4622d11](https://github.com/KenkoGeek/timonel/commit/4622d113e5753a5ff69c82a1e3784ecf61c34689))
+
+### BREAKING CHANGES
+
+- **ci:** ESLint configuration migrated to flat config format
+- **ci:** ESLint configuration migrated to flat config format
+
 # Changelog
 
 All notable changes to this project will be documented in this file.

package/README.md

@@ -186,6 +186,11 @@ rutter.write('dist/charts/my-app');
 
 ### Custom Manifest Naming
 
+> **⚠️ Breaking Change Notice**: Starting from v1.1.0, template files no longer include
+> automatic numbering prefixes (0000-, 0001-, etc.). Files now use descriptive names
+> following Helm best practices. If your scripts or tools depend on numbered filenames,
+> please update them accordingly.
+
 Timonel provides flexible options for naming your Kubernetes manifest files:
 
 #### Single Manifest File
@@ -210,9 +215,9 @@ const rutter = new Rutter({
 });
 
 // Generates:
-// templates/0000-my-app-deployment-web.yaml
-// templates/0001-my-app-service-web.yaml
-// templates/0002-my-app-configmap-config.yaml
+// templates/my-app-deployment-web.yaml
+// templates/my-app-service-web.yaml
+// templates/my-app-configmap-config.yaml
 ```
 
 #### Default Behavior
@@ -224,9 +229,9 @@ const rutter = new Rutter({
 });
 
 // Generates:
-// templates/0000-deployment-web.yaml
-// templates/0001-service-web.yaml
-// templates/0002-configmap-config.yaml
+// templates/deployment-web.yaml
+// templates/service-web.yaml
+// templates/configmap-config.yaml
 ```
 
 ## Umbrella Charts
@@ -315,9 +320,13 @@ shared values, and multi-environment support.
   (`toString`, `float64`).
 - For numeric fields (ports, replicas), use literal values or template strings with proper casting.
 
-## AWS Multi-Cloud Support
+## Multi-Cloud Support
+
+Timonel provides comprehensive cloud-specific helpers for major Kubernetes platforms:
+
+### AWS Multi-Cloud Support
 
-Timonel provides comprehensive AWS-specific helpers for EKS deployments:
+Comprehensive AWS-specific helpers for EKS deployments:
 
 ### IRSA (IAM Roles for Service Accounts)
 
@@ -429,6 +438,331 @@ rutter.addAWSSecretProviderClass({
 });
 ```
 
+### Azure Multi-Cloud Support
+
+Azure-specific helpers for AKS deployments:
+
+#### Azure Disk Storage Classes
+
+```typescript
+// Premium ZRS disk for production workloads
+rutter.addAzureDiskStorageClass({
+  name: 'azure-premium-zrs',
+  skuName: 'Premium_ZRS',
+  fsType: 'ext4',
+  cachingMode: 'ReadWrite',
+  allowVolumeExpansion: true,
+  volumeBindingMode: 'WaitForFirstConsumer',
+  tags: {
+    Environment: 'production',
+    Application: 'database',
+  },
+});
+
+// Standard SSD for cost-optimized workloads
+rutter.addAzureDiskStorageClass({
+  name: 'azure-standard-ssd',
+  skuName: 'StandardSSD_LRS',
+  fsType: 'ext4',
+  cachingMode: 'ReadOnly',
+});
+
+// Ultra SSD for high-performance workloads
+rutter.addAzureDiskStorageClass({
+  name: 'azure-ultra-ssd',
+  skuName: 'UltraSSD_LRS',
+  fsType: 'ext4',
+  cachingMode: 'None',
+  diskIOPSReadWrite: 2000,
+  diskMBpsReadWrite: 200,
+  logicalSectorSize: 4096,
+});
+```
+
+#### Azure Application Gateway Ingress Controller (AGIC)
+
+Comprehensive AGIC support for AKS deployments with advanced features:
+
+```typescript
+// AGIC Ingress with SSL and health checks
+rutter.addAzureAGICIngress({
+  name: 'app-ingress',
+  rules: [
+    {
+      host: 'app.example.com',
+      paths: [
+        {
+          path: '/',
+          pathType: 'Prefix',
+          backend: { service: { name: 'app-service', port: { number: 80 } } },
+        },
+      ],
+    },
+  ],
+  sslRedirect: true,
+  backendProtocol: 'https',
+  healthProbePath: '/health',
+  healthProbeInterval: 30,
+  cookieBasedAffinity: true,
+  requestTimeout: 60,
+  appgwSslCertificate: 'my-ssl-cert',
+  wafPolicyForPath:
+    '/subscriptions/sub-id/resourceGroups/rg/providers/Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/waf-policy',
+});
+
+// Advanced AGIC features
+rutter.addAzureAGICIngress({
+  name: 'advanced-ingress',
+  rules: [
+    /* rules */
+  ],
+  backendPathPrefix: '/api/v1',
+  backendHostname: 'internal.example.com',
+  usePrivateIp: true,
+  overrideFrontendPort: 8080,
+  connectionDraining: true,
+  connectionDrainingTimeout: 60,
+  hostnameExtension: ['api.example.com', 'admin.example.com'],
+  appgwTrustedRootCertificate: ['root-cert-1', 'root-cert-2'],
+  rewriteRuleSet: 'custom-rewrite-rules',
+  rulePriority: 100,
+});
+```
+
+## Network Security with NetworkPolicies
+
+Timonel provides comprehensive NetworkPolicy helpers for implementing Zero Trust network security
+in Kubernetes:
+
+### Zero Trust Network Security
+
+Implement defense-in-depth with deny-by-default policies:
+
+```typescript
+// 1. Deny all traffic by default (recommended starting point)
+rutter.addDenyAllNetworkPolicy('default-deny-all');
+
+// 2. Allow specific traffic as needed
+rutter.addAllowFromPodsNetworkPolicy({
+  name: 'allow-frontend-to-backend',
+  targetPodSelector: { app: 'backend' },
+  sourcePodSelector: { app: 'frontend' },
+  ports: [{ protocol: 'TCP', port: 8080 }],
+});
+```
+
+### Advanced NetworkPolicy Examples
+
+#### Multi-tier Application Security
+
+```typescript
+// Web tier - allow external traffic on port 80/443
+rutter.addNetworkPolicy({
+  name: 'web-tier-policy',
+  podSelector: { matchLabels: { tier: 'web' } },
+  policyTypes: ['Ingress', 'Egress'],
+  ingress: [
+    {
+      ports: [
+        { protocol: 'TCP', port: 80 },
+        { protocol: 'TCP', port: 443 },
+      ],
+    },
+  ],
+  egress: [
+    // Allow access to app tier
+    {
+      to: [{ podSelector: { matchLabels: { tier: 'app' } } }],
+      ports: [{ protocol: 'TCP', port: 8080 }],
+    },
+    // Allow DNS resolution
+    {
+      to: [{ namespaceSelector: { matchLabels: { name: 'kube-system' } } }],
+      ports: [
+        { protocol: 'UDP', port: 53 },
+        { protocol: 'TCP', port: 53 },
+      ],
+    },
+  ],
+});
+
+// App tier - only allow traffic from web tier
+rutter.addNetworkPolicy({
+  name: 'app-tier-policy',
+  podSelector: { matchLabels: { tier: 'app' } },
+  policyTypes: ['Ingress', 'Egress'],
+  ingress: [
+    {
+      from: [{ podSelector: { matchLabels: { tier: 'web' } } }],
+      ports: [{ protocol: 'TCP', port: 8080 }],
+    },
+  ],
+  egress: [
+    // Allow access to database
+    {
+      to: [{ podSelector: { matchLabels: { tier: 'database' } } }],
+      ports: [{ protocol: 'TCP', port: 5432 }],
+    },
+    // Allow external API calls (with CIDR restrictions)
+    {
+      to: [
+        {
+          ipBlock: {
+            cidr: '0.0.0.0/0',
+            except: ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'],
+          },
+        },
+      ],
+      ports: [{ protocol: 'TCP', port: 443 }],
+    },
+  ],
+});
+
+// Database tier - most restrictive
+rutter.addNetworkPolicy({
+  name: 'database-tier-policy',
+  podSelector: { matchLabels: { tier: 'database' } },
+  policyTypes: ['Ingress', 'Egress'],
+  ingress: [
+    {
+      from: [{ podSelector: { matchLabels: { tier: 'app' } } }],
+      ports: [{ protocol: 'TCP', port: 5432 }],
+    },
+  ],
+  egress: [
+    // Only allow DNS resolution
+    {
+      to: [{ namespaceSelector: { matchLabels: { name: 'kube-system' } } }],
+      ports: [
+        { protocol: 'UDP', port: 53 },
+        { protocol: 'TCP', port: 53 },
+      ],
+    },
+  ],
+});
+```
+
+#### Cross-Namespace Communication
+
+```typescript
+// Allow traffic from monitoring namespace
+rutter.addAllowFromNamespaceNetworkPolicy({
+  name: 'allow-monitoring',
+  targetPodSelector: { app: 'backend' },
+  sourceNamespaceSelector: { name: 'monitoring' },
+  ports: [{ protocol: 'TCP', port: 9090 }], // Prometheus metrics
+});
+
+// Allow traffic to shared services namespace
+rutter.addNetworkPolicy({
+  name: 'allow-to-shared-services',
+  podSelector: { matchLabels: { app: 'backend' } },
+  policyTypes: ['Egress'],
+  egress: [
+    {
+      to: [
+        {
+          namespaceSelector: { matchLabels: { name: 'shared-services' } },
+          podSelector: { matchLabels: { app: 'redis' } },
+        },
+      ],
+      ports: [{ protocol: 'TCP', port: 6379 }],
+    },
+  ],
+});
+```
+
+### Security Best Practices
+
+#### 1. Start with Deny-All Policies
+
+```typescript
+// Always start with deny-all for maximum security
+rutter.addDenyAllNetworkPolicy('default-deny-all');
+
+// Then add specific allow rules
+rutter.addAllowFromPodsNetworkPolicy({
+  name: 'allow-specific-communication',
+  targetPodSelector: { app: 'api' },
+  sourcePodSelector: { app: 'frontend' },
+  ports: [{ protocol: 'TCP', port: 8080 }],
+});
+```
+
+#### 2. Separate Ingress and Egress Policies
+
+```typescript
+// Separate policies for better maintainability
+rutter.addDenyAllIngressNetworkPolicy('deny-all-ingress');
+rutter.addDenyAllEgressNetworkPolicy('deny-all-egress');
+```
+
+#### 3. Use CIDR Blocks for External Access
+
+```typescript
+// Restrict external access to specific IP ranges
+rutter.addNetworkPolicy({
+  name: 'external-api-access',
+  podSelector: { matchLabels: { app: 'backend' } },
+  policyTypes: ['Egress'],
+  egress: [
+    {
+      to: [
+        {
+          ipBlock: {
+            cidr: '203.0.113.0/24', // Specific external service
+          },
+        },
+      ],
+      ports: [{ protocol: 'TCP', port: 443 }],
+    },
+  ],
+});
+```
+
+#### 4. Include DNS Resolution
+
+```typescript
+// Always allow DNS for name resolution
+const dnsEgressRule = {
+  to: [{ namespaceSelector: { matchLabels: { name: 'kube-system' } } }],
+  ports: [
+    { protocol: 'UDP', port: 53 },
+    { protocol: 'TCP', port: 53 },
+  ],
+};
+
+rutter.addNetworkPolicy({
+  name: 'app-with-dns',
+  podSelector: { matchLabels: { app: 'backend' } },
+  policyTypes: ['Egress'],
+  egress: [dnsEgressRule /* other rules */],
+});
+```
+
+### Basic NetworkPolicy
+
+```typescript
+// Custom NetworkPolicy with full control
+rutter.addNetworkPolicy({
+  name: 'custom-policy',
+  podSelector: { matchLabels: { app: 'backend' } },
+  policyTypes: ['Ingress', 'Egress'],
+  ingress: [
+    {
+      from: [{ podSelector: { matchLabels: { app: 'frontend' } } }],
+      ports: [{ protocol: 'TCP', port: 8080 }],
+    },
+  ],
+  egress: [
+    {
+      to: [{ podSelector: { matchLabels: { app: 'database' } } }],
+      ports: [{ protocol: 'TCP', port: 5432 }],
+    },
+  ],
+});
+```
+
 ## Multi-environment values
 
 Provide `envValues` in the `Rutter` constructor to automatically create
@@ -457,7 +791,7 @@ Provide `envValues` in the `Rutter` constructor to automatically create
 - ✅ Auto-scaling helpers (HPA, VPA, PodDisruptionBudget)
 - ✅ AWS multi-cloud support (EBS, EFS, ALB, IRSA, Secrets Manager, Parameter Store)
 - ✅ Custom manifest naming and file organization
-- Azure multi-cloud support (AKS-specific helpers)
+- ✅ Azure multi-cloud support (Azure Disk StorageClass, AGIC)
 - GCP multi-cloud support (GKE-specific helpers)
 - Richer CLI (resource generators, diff)
 - Template validation and testing utilities

package/dist/cli.js

@@ -1,42 +1,7 @@
 #!/usr/bin/env node
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const cp = __importStar(require("child_process"));
+import * as fs from 'fs';
+import * as path from 'path';
+import * as cp from 'child_process';
 const HELM_INSTALL_URL = 'https://helm.sh/docs/intro/install/';
 const HELM_ENV_VAR_MSG = 'Or set HELM_BIN environment variable to helm binary path.';
 function usageAndExit(msg) {
@@ -139,7 +104,6 @@ async function cmdValidate(projectDir, silent = false) {
     }
     finally {
         // Cleanup temp directory
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         if (fs.existsSync(tempDir)) {
             fs.rmSync(tempDir, { recursive: true, force: true });
         }
@@ -158,10 +122,11 @@ async function cmdSynth(projectDir, out, flags) {
         process.exit(1);
     }
     // Enable TS runtime with specific config
-    require('ts-node').register({
+    const { register } = await import('ts-node');
+    register({
         transpileOnly: true,
         compilerOptions: {
-            module: 'CommonJS',
+            module: 'ESNext',
             moduleResolution: 'node',
         },
     });
@@ -172,29 +137,34 @@ async function cmdSynth(projectDir, out, flags) {
         console.error('Module path must be within current working directory');
         process.exit(1);
     }
-    // eslint-disable-next-line security/detect-non-literal-require -- CLI tool needs dynamic module loading
-    const mod = require(resolvedPath);
-    const runner = mod.default || mod.run || mod.synth;
-    if (typeof runner !== 'function') {
-        console.error('chart.ts must export a default/run/synth function');
-        process.exit(1);
-    }
-    // Apply --set overrides if provided
-    if (flags?.set &&
-        Object.keys(flags.set).length > 0 &&
-        mod.rutter &&
-        typeof mod.rutter.setValues === 'function') {
-        mod.rutter.setValues(flags.set);
+    try {
+        const mod = await import(resolvedPath);
+        const runner = mod.default || mod.run || mod.synth;
+        if (typeof runner !== 'function') {
+            console.error('chart.ts must export a default/run/synth function');
+            process.exit(1);
+        }
+        // Apply --set overrides if provided
+        if (flags?.set &&
+            Object.keys(flags.set).length > 0 &&
+            mod.rutter &&
+            typeof mod.rutter.setValues === 'function') {
+            mod.rutter.setValues(flags.set);
+        }
+        const outDir = out || path.join(path.dirname(chartTs), 'dist');
+        if (flags?.dryRun) {
+            log(`[DRY RUN] Would write chart to ${outDir}`, flags.silent);
+            return;
+        }
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
+        fs.mkdirSync(outDir, { recursive: true });
+        await Promise.resolve(runner(outDir));
+        log(`Chart written to ${outDir}`, flags?.silent);
     }
-    const outDir = out || path.join(path.dirname(chartTs), 'dist');
-    if (flags?.dryRun) {
-        log(`[DRY RUN] Would write chart to ${outDir}`, flags.silent);
-        return;
+    catch (error) {
+        console.error(`Failed to import module: ${error instanceof Error ? error.message : error}`);
+        process.exit(1);
     }
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
-    fs.mkdirSync(outDir, { recursive: true });
-    await Promise.resolve(runner(outDir));
-    log(`Chart written to ${outDir}`, flags?.silent);
 }
 async function cmdDiff(projectDir, chartDir, silent = false) {
     if (!projectDir || !chartDir)
@@ -218,7 +188,6 @@ async function cmdDiff(projectDir, chartDir, silent = false) {
     }
     finally {
         // Cleanup temp directory
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         if (fs.existsSync(tempDir)) {
             fs.rmSync(tempDir, { recursive: true, force: true });
         }
@@ -268,7 +237,6 @@ async function cmdDeploy(projectDir, releaseName, flags) {
     }
     finally {
         // Cleanup temp directory
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
         if (fs.existsSync(tempDir)) {
             fs.rmSync(tempDir, { recursive: true, force: true });
         }
@@ -324,12 +292,10 @@ async function cmdUmbrellaAdd(subchartName, silent = false) {
     if (!subchartName)
         usageAndExit(MISSING_SUBCHART_MSG);
     const configFile = path.join(process.cwd(), UMBRELLA_CONFIG_FILE);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
     if (!fs.existsSync(configFile)) {
         console.error(`${UMBRELLA_CONFIG_FILE} not found. Run \`tl umbrella init\` first.`);
         process.exit(1);
     }
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
     const config = JSON.parse(fs.readFileSync(configFile, 'utf8'));
     // Create subchart directory and scaffold
     const subchartDir = path.join(process.cwd(), 'charts', subchartName);
@@ -344,19 +310,16 @@ async function cmdUmbrellaAdd(subchartName, silent = false) {
         version: '0.1.0',
         path: `./charts/${subchartName}/chart.ts`,
     });
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
     fs.writeFileSync(configFile, JSON.stringify(config, null, 2));
     log(`Subchart ${subchartName} added to umbrella`, silent);
 }
 async function cmdUmbrellaSynth(outDir, flags) {
     const configFile = path.join(process.cwd(), UMBRELLA_CONFIG_FILE);
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
     if (!fs.existsSync(configFile)) {
         console.error(`${UMBRELLA_CONFIG_FILE} not found. Run \`tl umbrella init\` first.`);
         process.exit(1);
     }
     const umbrellaFile = path.join(process.cwd(), 'umbrella.ts');
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI tool needs dynamic paths
     if (!fs.existsSync(umbrellaFile)) {
         console.error('umbrella.ts not found.');
         process.exit(1);
@@ -376,7 +339,6 @@ async function cmdUmbrellaSynth(outDir, flags) {
         console.error('Module path must be within current working directory');
         process.exit(1);
     }
-    // eslint-disable-next-line security/detect-non-literal-require -- CLI tool needs dynamic module loading
     const mod = require(resolvedPath);
     const runner = mod.default || mod.run || mod.synth;
     if (typeof runner !== 'function') {
@@ -622,10 +584,8 @@ function parseArgs() {
     return { cmd, args, flags };
 }
 function showVersion() {
-    // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI needs to read package.json
     const packagePath = path.join(__dirname, '..', 'package.json');
     try {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename -- CLI needs to read package.json
         const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
         console.log(`timonel v${packageJson.version}`);
     }