proofctl 0.5.0__tar.gz → 0.5.2__tar.gz

{proofctl-0.5.0/proofctl.egg-info → proofctl-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.0
+Version: 0.5.2
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.5.0 → proofctl-0.5.2}/proofctl/checkers/terraform.py

@@ -143,7 +143,12 @@ _AI_PLACEHOLDER_VALUE_RE = re.compile(
     r'<[A-Z][A-Z0-9_\-]+>|placeholder|todo)"',
     re.IGNORECASE,
 )
-_AI_ANGLE_BRACKET_RE = re.compile(r'"[^"]*<[A-Za-z][A-Za-z0-9_\-]+>[^"]*"')
+# Single-line anchored: [^"\n]* (not [^"]*) so the match can't span
+# across a closing+opening quote pair on different lines. Without the
+# \n exclusion, a line like `attr = "TRUE"` followed several lines
+# down by `image = "..."` produces a spurious match that picks up any
+# `<placeholder>` in a comment in between.
+_AI_ANGLE_BRACKET_RE = re.compile(r'"[^"\n]*<[A-Za-z][A-Za-z0-9_\-]+>[^"\n]*"')
 
 # AWS region format: us-east-1 (with trailing -digit). GCP uses us-east1, us-central1.
 _AWS_REGION_RE = re.compile(
@@ -3477,6 +3482,36 @@ class TerraformChecker(HclFileChecker):
         re.IGNORECASE,
     )
 
+    # Suffixes that mark a variable name as a reference identifier rather
+    # than the secret value itself. ``var.db_password_secret_id`` is the
+    # *name* of a Secret Manager secret (fetched at runtime via gcloud)
+    # — not the password value — so embedding it in metadata is safe.
+    # AI-013 must NOT fire on names matching these suffixes.
+    _ID_SUFFIX_RE = re.compile(
+        r"_(?:id|name|arn|uri|url|email|self_link|version|"
+        r"key_id|key_name|secret_id|secret_name)$",
+        re.IGNORECASE,
+    )
+
+    @classmethod
+    def _sensitive_var_match(cls, line_text: str) -> "re.Match[str] | None":
+        """Return a match on a secret-shaped var name, or None.
+
+        Wraps ``_SENSITIVE_VAR_NAME_RE.search`` with a suffix filter:
+        names ending in ``_id``, ``_name``, ``_arn``, ``_uri``, ``_email``,
+        ``_self_link``, ``_version``, ``_secret_id``, ``_secret_name``,
+        ``_key_id``, ``_key_name``, ``_url`` are reference identifiers
+        (pointers to other resources) rather than secret values themselves.
+        They are safe to embed in metadata because the actual secret is
+        fetched at runtime by the consumer.
+        """
+        for m in cls._SENSITIVE_VAR_NAME_RE.finditer(line_text):
+            name = m.group(1)
+            if cls._ID_SUFFIX_RE.search(name):
+                continue
+            return m
+        return None
+
     @staticmethod
     def _line_range_of_attr(
         block: HclBlock, attr_name: str
@@ -3552,14 +3587,14 @@ class TerraformChecker(HclFileChecker):
                 lo, hi = rng
                 for offset in range(lo, hi + 1):
                     line_text = b.raw_lines[offset]
-                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    m = self._sensitive_var_match(line_text)
                     if m:
                         _emit(b, b.start_line + offset, m.group(1),
                               "metadata_startup_script")
             # 2. Scan nested metadata { ... } blocks (HCL block form).
             for md in b.nested("metadata"):
                 for offset, line_text in enumerate(md.raw_lines):
-                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    m = self._sensitive_var_match(line_text)
                     if m:
                         _emit(b, md.start_line + offset, m.group(1),
                               "metadata block")
@@ -3569,7 +3604,7 @@ class TerraformChecker(HclFileChecker):
                 lo, hi = rng
                 for offset in range(lo, hi + 1):
                     line_text = b.raw_lines[offset]
-                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    m = self._sensitive_var_match(line_text)
                     if m:
                         _emit(b, b.start_line + offset, m.group(1),
                               "metadata block")

{proofctl-0.5.0 → proofctl-0.5.2/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.0
+Version: 0.5.2
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.5.0 → proofctl-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.5.0"
+version = "0.5.2"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }