proofctl 0.2.0__tar.gz → 0.2.1__tar.gz

{proofctl-0.2.0 → proofctl-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.2.0
+Version: 0.2.1
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.2.0 → proofctl-0.2.1}/proofctl/checkers/terraform.py

@@ -1997,8 +1997,15 @@ class TerraformChecker(HclFileChecker):
 
     def _t015(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """T-015 — Output with sensitive-looking name but sensitive = true not set."""
+        # "key" is excluded when followed by measurement/metadata suffixes
+        # (e.g. max_key_age_days, key_count, key_rotation_period) — those are
+        # not sensitive values, just numeric descriptors that happen to contain
+        # the word "key".  Other terms (password, secret, token, credential)
+        # are always sensitive regardless of suffix.
         _sensitive_name_pat = re.compile(
-            r'(?:password|secret|token|key|credential)',
+            r'(?:password|secret|token|credential'
+            r'|key(?!_age|_days|_hours|_seconds|_count|_max|_min|_num'
+            r'|_threshold|_expir|_rotation|_version|_size|_length))',
             re.IGNORECASE,
         )
         out = []

{proofctl-0.2.0 → proofctl-0.2.1}/proofctl/config.py

@@ -9,16 +9,72 @@ import yaml
 from .models import Severity
 
 _DEFAULT_EXCLUDES: list[str] = [
+    # ── Python project environments ───────────────────────────────────────────
     "**/.venv/**",
     "**/venv/**",
-    "**/node_modules/**",
-    "**/.git/**",
     "**/__pycache__/**",
     "**/*.egg-info/**",
     "**/dist/**",
     "**/build/**",
-    "**/.terragrunt-cache/**",
+    # ── Universal VCS / package managers ─────────────────────────────────────
+    "**/.git/**",
+    "**/node_modules/**",
+    # ── Terraform / Terragrunt caches ─────────────────────────────────────────
     "**/.terraform/**",
+    "**/.terragrunt-cache/**",
+    # Terraform/OpenTofu state and plan artifacts — never hand-authored;
+    # may contain sensitive resource outputs and secrets.
+    "**/*.tfstate",
+    "**/*.tfstate.backup",
+    "**/*.tfplan",
+    # ── Flux CD ───────────────────────────────────────────────────────────────
+    # Both files are auto-generated by `flux bootstrap` and contain the comment
+    # "# This manifest was generated by flux. DO NOT EDIT."
+    # gotk-components.yaml carries wildcard RBAC + cluster-admin bindings that
+    # are intentional Flux design; gotk-sync.yaml wires the GitRepository/
+    # Kustomization that reconciles flux-system itself.  Neither is user policy.
+    "**/flux-system/gotk-components.yaml",
+    "**/flux-system/gotk-sync.yaml",
+    # ── ArgoCD Autopilot ──────────────────────────────────────────────────────
+    # Files generated by `argocd-autopilot repo bootstrap`. The kustomization
+    # references upstream install.yaml which carries a cluster-admin binding for
+    # argocd-application-controller — intentional, not a misconfiguration.
+    "**/bootstrap/argo-cd/kustomization.yaml",
+    "**/bootstrap/argo-cd.yaml",
+    "**/bootstrap/cluster-resources/in-cluster/**",
+    # ── AWS CDK / CDK for Terraform ───────────────────────────────────────────
+    # cdk.out/ is synthesized CloudFormation JSON from `cdk synth`.
+    # .gen/ and cdktf.out/ are CDKTF provider bindings and synth output.
+    "**/cdk.out/**",
+    "**/.gen/**",
+    "**/cdktf.out/**",
+    # ── Helm ─────────────────────────────────────────────────────────────────
+    # Chart tarballs downloaded by `helm dep update` into charts/ subdirectories.
+    "**/charts/*.tgz",
+    # ── Pulumi ───────────────────────────────────────────────────────────────
+    # Local backend state written by `pulumi up` when using file:// backend.
+    "**/.pulumi/**",
+    # ── Other IaC tool caches ─────────────────────────────────────────────────
+    "**/packer_cache/**",     # Packer: ISO/VM template cache (default ./packer_cache/)
+    "**/.vagrant/**",         # Vagrant: machine state, private keys, VM references
+    "**/.crossplane/**",      # Crossplane CLI: provider OCI layer / CRD schema cache
+    # ── Ansible Galaxy ────────────────────────────────────────────────────────
+    # Collections installed via `ansible-galaxy collection install`.
+    "**/collections/ansible_collections/**",
+    # ── Go vendor ─────────────────────────────────────────────────────────────
+    # Third-party module source vendored by `go mod vendor`. Contains .go files
+    # that can trigger false-positives in import / quality rules.
+    "**/vendor/**",
+    # ── Python tool caches ────────────────────────────────────────────────────
+    # These directories contain .py files and can surface false-positives if
+    # scanned (e.g. generated test helpers, mypy stubs, hypothesis examples).
+    "**/.tox/**",
+    "**/.nox/**",
+    "**/.pytest_cache/**",
+    "**/.mypy_cache/**",
+    "**/.ruff_cache/**",
+    "**/.hypothesis/**",
+    "**/htmlcov/**",
 ]
 
 # Top-level config keys recognised by `.proofctl.yaml`. Anything else triggers

{proofctl-0.2.0 → proofctl-0.2.1}/proofctl/engine.py

@@ -411,7 +411,24 @@ def run_check(
         floor = Severity.from_str(min_severity)
         findings = [f for f in findings if f.severity >= floor]
 
-    return sorted(findings, key=lambda x: (-x.severity, x.file, x.line or 0))
+    sorted_findings = sorted(findings, key=lambda x: (-x.severity, x.file, x.line or 0))
+
+    # ── 8. Module-level rule deduplication. ───────────────────────────────────
+    # Rules like T014 (missing required_version) represent a per-module property,
+    # not a per-file one.  A module with 10 .tf files should produce one finding,
+    # not ten.  After sorting we keep the first occurrence per (dir, rule_id) so
+    # the preserved finding is always the alphabetically-first file in the module.
+    _MODULE_LEVEL_RULES: frozenset[str] = frozenset({"PROOFCTL-TF-T014"})
+    seen_module_dirs: set[tuple[str, str]] = set()
+    result: list[Finding] = []
+    for f in sorted_findings:
+        if f.rule_id in _MODULE_LEVEL_RULES:
+            dir_key = (str(Path(f.file).parent), f.rule_id)
+            if dir_key in seen_module_dirs:
+                continue
+            seen_module_dirs.add(dir_key)
+        result.append(f)
+    return result
 
 
 def _normalise(f: Finding, root: Path, config: ProofctlConfig) -> Finding | None:

{proofctl-0.2.0 → proofctl-0.2.1}/proofctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.2.0
+Version: 0.2.1
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.2.0 → proofctl-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.2.0"
+version = "0.2.1"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }

{proofctl-0.2.0 → proofctl-0.2.1}/tests/test_config_proofctl.py

@@ -20,6 +20,37 @@ def test_load_config_no_file_returns_defaults(tmp_path):
     assert cfg.any_threshold == 3
 
 
+def test_default_excludes_include_vendor_generated_paths(tmp_path):
+    """All vendor/generated tool paths must be present in default excludes."""
+    cfg = load_config(tmp_path)
+    required = [
+        # Flux CD bootstrap files
+        "**/flux-system/gotk-components.yaml",
+        "**/flux-system/gotk-sync.yaml",
+        # ArgoCD Autopilot bootstrap files
+        "**/bootstrap/argo-cd/kustomization.yaml",
+        "**/bootstrap/argo-cd.yaml",
+        # Terraform generated artifacts
+        "**/*.tfstate",
+        "**/*.tfplan",
+        # CDK tools
+        "**/cdk.out/**",
+        "**/.gen/**",
+        # Helm chart tarballs
+        "**/charts/*.tgz",
+        # Pulumi local backend
+        "**/.pulumi/**",
+        # Go vendor
+        "**/vendor/**",
+        # Python caches
+        "**/.tox/**",
+        "**/.pytest_cache/**",
+        "**/.mypy_cache/**",
+    ]
+    for pat in required:
+        assert pat in cfg.exclude_paths, f"missing default exclude: {pat}"
+
+
 def test_load_config_empty_file_returns_defaults(tmp_path):
     (tmp_path / ".proofctl.yaml").write_text("")
     cfg = load_config(tmp_path)

{proofctl-0.2.0 → proofctl-0.2.1}/tests/test_engine.py

@@ -48,6 +48,57 @@ def test_engine_excludes_configured_paths(tmp_path):
     assert all("venv" not in f.file for f in findings)
 
 
+_WILDCARD_RBAC_YAML = (
+    "apiVersion: rbac.authorization.k8s.io/v1\n"
+    "kind: ClusterRole\n"
+    "metadata:\n"
+    "  name: crd-controller-flux-system\n"
+    "rules:\n"
+    "- apiGroups: ['*']\n"
+    "  resources: ['*']\n"
+    "  verbs: ['*']\n"
+)
+
+
+def test_engine_excludes_flux_gotk_components(tmp_path):
+    """Flux bootstrap gotk-components.yaml must be skipped by default (vendor file)."""
+    flux_dir = tmp_path / "clusters" / "prod" / "flux-system"
+    flux_dir.mkdir(parents=True)
+    (flux_dir / "gotk-components.yaml").write_text(_WILDCARD_RBAC_YAML)
+    findings = run_check(tmp_path, _cfg(), families=["YAML"])
+    assert not any("gotk-components" in f.file for f in findings)
+
+
+def test_engine_excludes_flux_gotk_sync(tmp_path):
+    """Flux bootstrap gotk-sync.yaml must be skipped by default."""
+    flux_dir = tmp_path / "flux-system"
+    flux_dir.mkdir(parents=True)
+    (flux_dir / "gotk-sync.yaml").write_text(
+        "apiVersion: source.toolkit.fluxcd.io/v1\n"
+        "kind: GitRepository\n"
+        "metadata:\n"
+        "  name: flux-system\n"
+        "  namespace: flux-system\n"
+    )
+    findings = run_check(tmp_path, _cfg(), families=["YAML"])
+    assert not any("gotk-sync" in f.file for f in findings)
+
+
+def test_engine_excludes_argocd_autopilot_bootstrap(tmp_path):
+    """ArgoCD Autopilot bootstrap files must be skipped by default (vendor RBAC)."""
+    bootstrap_dir = tmp_path / "bootstrap" / "argo-cd"
+    bootstrap_dir.mkdir(parents=True)
+    (bootstrap_dir / "kustomization.yaml").write_text(_WILDCARD_RBAC_YAML)
+    (tmp_path / "bootstrap" / "argo-cd.yaml").write_text(
+        "apiVersion: argoproj.io/v1alpha1\nkind: Application\n"
+        "metadata:\n  name: argo-cd\n  namespace: argocd\n"
+    )
+    findings = run_check(tmp_path, _cfg(), families=["YAML"])
+    assert not any(
+        "bootstrap/argo-cd" in f.file.replace("\\", "/") for f in findings
+    )
+
+
 def test_engine_respects_disabled_rules(tmp_path):
     """Rules in config.disable must produce zero findings."""
     (tmp_path / "code.py").write_text(
@@ -86,3 +137,20 @@ def test_engine_deduplicates_findings(tmp_path):
     findings = run_check(tmp_path, _cfg(), families=["S"])
     keys = [f.dedup_key() for f in findings]
     assert len(keys) == len(set(keys))
+
+
+def test_engine_t014_deduplicates_to_one_per_module_directory(tmp_path):
+    """T014 must fire once per module directory, not once per .tf file."""
+    module = tmp_path / "atlantis"
+    module.mkdir()
+    # Three .tf files with resources but no required_version in any of them.
+    # HCL parser requires multi-line block syntax.
+    resource_tmpl = 'resource "google_storage_bucket" "b{n}" {{\n  name = "b{n}"\n}}\n'
+    for name in ("apigateway.tf", "asg.tf", "cloudfunction.tf"):
+        (module / name).write_text(resource_tmpl.format(n=name[0]))
+    findings = run_check(tmp_path, _cfg(), families=["TF"])
+    t014 = [f for f in findings if f.rule_id == "PROOFCTL-TF-T014"]
+    assert len(t014) == 1, (
+        f"Expected 1 T014 finding for the module, got {len(t014)}: "
+        + ", ".join(f.file for f in t014)
+    )

{proofctl-0.2.0 → proofctl-0.2.1}/tests/test_terraform_ext.py

@@ -1119,3 +1119,33 @@ output "encryption_key" {
 """
     f = _find(_checker.check(_P, src), "PROOFCTL-TF-T015")
     assert len(f) == 1
+
+
+def test_t015_key_age_days_is_not_sensitive():
+    """max_key_age_days is a numeric duration, not a sensitive value (FP regression)."""
+    src = """
+output "max_key_age_days" {
+  value = 90
+}
+"""
+    assert "PROOFCTL-TF-T015" not in _ids(_checker.check(_P, src))
+
+
+def test_t015_key_count_is_not_sensitive():
+    src = """
+output "key_rotation_days" {
+  value = 30
+}
+"""
+    assert "PROOFCTL-TF-T015" not in _ids(_checker.check(_P, src))
+
+
+def test_t015_key_name_still_fires():
+    """Output 'key_name' references a key resource — should still be flagged."""
+    src = """
+output "kms_key_name" {
+  value = google_kms_crypto_key.main.name
+}
+"""
+    f = _find(_checker.check(_P, src), "PROOFCTL-TF-T015")
+    assert len(f) == 1