proofctl 0.5.5__tar.gz → 0.5.7__tar.gz

{proofctl-0.5.5/proofctl.egg-info → proofctl-0.5.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.5
+Version: 0.5.7
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -172,7 +172,7 @@ git commit -m "chore: add proofctl baseline"
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
 | Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |

{proofctl-0.5.5 → proofctl-0.5.7}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -144,7 +144,7 @@ git commit -m "chore: add proofctl baseline"
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
 | Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |

{proofctl-0.5.5 → proofctl-0.5.7}/proofctl/checkers/imports.py

@@ -294,13 +294,6 @@ def _parse_setup_cfg(text: str) -> list[tuple[str, str | None, int]]:
                 results.append((m.group(1), m.group(3) or None, lineno))
     return results
 
-# mypy error patterns indicating phantom method calls
-_MYPY_ATTR_RE = re.compile(
-    r'^(.+):(\d+):\s+error:\s+(?:Item\s+"[^"]+"\s+of\s+)?"([^"]+)"\s+has\s+no\s+attribute\s+"([^"]+)"'
-    r'|^(.+):(\d+):\s+error:\s+Module\s+"[^"]+"\s+has\s+no\s+attribute\s+"([^"]+)"'
-)
-
-
 def _normalize_pkg_name(name: str) -> str:
     return re.sub(r"[-_.]+", "-", name).lower()
 
@@ -817,104 +810,3 @@ class DependencyChecker(DirectoryChecker):
         return findings
 
 
-class MethodChecker(DirectoryChecker):
-    """PROOFCTL-M-001: Phantom method calls detected by a single mypy invocation.
-
-    Running mypy once on all files is orders of magnitude faster than once per
-    file: mypy's startup and import-resolution cost is paid once, not N times.
-    """
-
-    def check(self, root: Path, py_files: list[Path]) -> list[Finding]:
-        if not py_files:
-            return []
-        if not shutil.which("mypy"):
-            # Surface the disabled state as a single INFO finding so CI users
-            # don't silently lose phantom-method coverage.
-            return [self._mypy_missing_finding(root)]
-        try:
-            return self._run_mypy(py_files)
-        except FileNotFoundError:
-            return [self._mypy_missing_finding(root)]
-
-    def _mypy_missing_finding(self, root: Path) -> Finding:
-        return Finding(
-            file=str(root),
-            line=None,
-            col=None,
-            rule_id="PROOFCTL-M-001",
-            rule_name="Phantom method check disabled",
-            severity=Severity.INFO,
-            message=(
-                "M-001 disabled — mypy not installed; install proofctl[dev] or "
-                "pip install mypy to enable phantom-method detection"
-            ),
-            hint="pip install mypy   # or: pip install proofctl[dev]",
-            authority="mypy attr-defined — AI calls methods that don't exist",
-            docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
-        )
-
-    def _run_mypy(self, py_files: list[Path]) -> list[Finding]:
-        try:
-            result = subprocess.run(
-                [
-                    "mypy",
-                    "--ignore-missing-imports",
-                    "--no-error-summary",
-                    "--no-pretty",
-                    *[str(p) for p in py_files],
-                ],
-                capture_output=True,
-                text=True,
-                timeout=300,
-            )
-        except subprocess.TimeoutExpired:
-            return []
-        except FileNotFoundError:
-            raise
-        except OSError:
-            return []
-
-        # Index scoped files for quick membership check after path normalisation.
-        scoped = {str(p.resolve()) for p in py_files}
-
-        findings = []
-        for line in result.stdout.splitlines():
-            m = _MYPY_ATTR_RE.match(line)
-            if not m:
-                continue
-
-            if m.group(1):
-                file_path, lineno_str = m.group(1), m.group(2)
-                obj_type, attr = m.group(3), m.group(4)
-                msg = f"'{obj_type}' has no attribute '{attr}'"
-            else:
-                file_path, lineno_str = m.group(5), m.group(6)
-                attr = m.group(7)
-                msg = f"Module has no attribute '{attr}'"
-
-            # Skip findings for files outside the scan scope (e.g. installed libs).
-            try:
-                if str(Path(file_path).resolve()) not in scoped:
-                    continue
-            except OSError:
-                continue
-
-            try:
-                lineno = int(lineno_str)
-            except ValueError:
-                lineno = None
-
-            findings.append(Finding(
-                file=file_path,
-                line=lineno,
-                col=None,
-                rule_id="PROOFCTL-M-001",
-                rule_name="Phantom method call",
-                severity=Severity.ERROR,
-                message=msg,
-                hint="Check the library's documentation for the correct method name.",
-                authority="mypy attr-defined — AI calls methods that don't exist",
-                docs_url="https://mypy.readthedocs.io/en/stable/error_codes.html",
-            ))
-
-        return findings

{proofctl-0.5.5 → proofctl-0.5.7}/proofctl/checkers/terraform.py

@@ -1632,12 +1632,41 @@ class TerraformChecker(HclFileChecker):
                 ))
         return out
 
+    # ── GKE Autopilot detection (0.5.6) ──────────────────────────────────
+    #
+    # GKE Autopilot is a managed-node mode where Google forces hardened
+    # defaults that cannot be overridden. Many rules in this family target
+    # `node_config` attributes that are illegal to set on Autopilot
+    # clusters — flagging them produces false positives whose suggested
+    # fix wouldn't even apply.
+    #
+    # The two helpers below let downstream rules skip themselves (or
+    # demote severity) when scanning an Autopilot cluster. The detection
+    # is whole-block string-match — adequate because the attribute name
+    # is unambiguous.
+
+    @staticmethod
+    def _is_gke_autopilot(b: HclBlock) -> bool:
+        """True iff the cluster has `enable_autopilot = true`."""
+        if b.label1 != "google_container_cluster":
+            return False
+        val = (b.attr_value("enable_autopilot") or "").strip().lower()
+        return val == "true"
+
+    @staticmethod
+    def _has_workload_identity(b: HclBlock) -> bool:
+        """True iff `workload_identity_config { … }` block is nested."""
+        return b.has_nested("workload_identity_config")
+
     def _g034(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """G-034 — GKE cluster missing explicit enable_legacy_abac = false."""
         out = []
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_container_cluster":
                 continue
+            # Autopilot: legacy ABAC is forced false and unchangeable.
+            if self._is_gke_autopilot(b):
+                continue
             val = b.attr_value("enable_legacy_abac")
             if val is None:
                 # Absent — provider default is false now, but old default was true.
@@ -1680,6 +1709,10 @@ class TerraformChecker(HclFileChecker):
         for b in blocks:
             if b.kind != "resource" or b.label1 not in ("google_container_cluster", "google_container_node_pool"):
                 continue
+            # Autopilot: node_config is not settable and Autopilot forces
+            # disable-legacy-endpoints = "true" by default. Skip.
+            if b.label1 == "google_container_cluster" and self._is_gke_autopilot(b):
+                continue
             # Heuristic: require disable-legacy-endpoints = "true" anywhere in the block.
             if not b.contains(r'disable-legacy-endpoints\s*=\s*"true"'):
                 out.append(self._f(
@@ -1699,6 +1732,10 @@ class TerraformChecker(HclFileChecker):
         for b in blocks:
             if b.kind != "resource" or b.label1 not in ("google_container_cluster", "google_container_node_pool"):
                 continue
+            # Autopilot: shielded VM is forced on and node_config is not
+            # settable. The suggested fix would even fail provider validation.
+            if b.label1 == "google_container_cluster" and self._is_gke_autopilot(b):
+                continue
             has_block = b.contains(r'shielded_instance_config\s*\{')
             has_secure = b.contains(r'enable_secure_boot\s*=\s*true')
             has_integrity = b.contains(r'enable_integrity_monitoring\s*=\s*true')
@@ -1716,14 +1753,23 @@ class TerraformChecker(HclFileChecker):
 
     def _g038(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """G-038 — GKE cluster without release_channel pinned to STABLE/REGULAR/RAPID."""
-        _channel_re = re.compile(r'channel\s*=\s*"(STABLE|REGULAR|RAPID)"')
+        _channel_literal_re = re.compile(r'channel\s*=\s*"(STABLE|REGULAR|RAPID)"')
+        # `channel = var.something` is also a valid pin — the value comes
+        # from a typed variable, not a hardcoded mistake. Recognise it.
+        _channel_var_re = re.compile(r'channel\s*=\s*var\.[a-zA-Z_][a-zA-Z0-9_]*')
+        # `channel = local.something` similarly.
+        _channel_local_re = re.compile(r'channel\s*=\s*local\.[a-zA-Z_][a-zA-Z0-9_]*')
         out = []
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_container_cluster":
                 continue
             body = "\n".join(b.raw_lines)
             has_block = bool(re.search(r'release_channel\s*\{', body))
-            has_channel = bool(_channel_re.search(body))
+            has_channel = (
+                bool(_channel_literal_re.search(body))
+                or bool(_channel_var_re.search(body))
+                or bool(_channel_local_re.search(body))
+            )
             if not has_block or not has_channel:
                 out.append(self._f(
                     path, b.start_line,
@@ -1747,10 +1793,16 @@ class TerraformChecker(HclFileChecker):
                 continue
             val = (b.attr_value("enable_shielded_nodes") or "").strip().lower()
             if val != "true":
+                # Autopilot: shielded nodes are forced on regardless. The
+                # explicit attribute remains useful as documentation — demote
+                # severity to INFO so the gate doesn't fail prod CI on it.
+                severity = (
+                    Severity.INFO if self._is_gke_autopilot(b) else Severity.WARNING
+                )
                 out.append(self._f(
                     path, b.attr_line("enable_shielded_nodes") or b.start_line,
                     "PROOFCTL-TF-G040", "GKE shielded nodes not enabled",
-                    Severity.WARNING,
+                    severity,
                     f'Cluster "{b.label2}" has enable_shielded_nodes not set to true',
                     hint="Set enable_shielded_nodes = true on the cluster.",
                     authority="CIS GKE Benchmark 6.5.5",
@@ -1765,6 +1817,17 @@ class TerraformChecker(HclFileChecker):
         for b in blocks:
             if b.kind != "resource" or b.label1 not in ("google_container_cluster", "google_container_node_pool"):
                 continue
+            # Autopilot + Workload Identity: workloads get GCP API access via
+            # Workload Identity bindings to GSAs, not via the node SA. The
+            # node SA is mostly inert. Skip the warning when the cluster is
+            # Autopilot AND has workload_identity_config — that's the
+            # recommended Autopilot security model.
+            if (
+                b.label1 == "google_container_cluster"
+                and self._is_gke_autopilot(b)
+                and self._has_workload_identity(b)
+            ):
+                continue
             body = "\n".join(b.raw_lines)
             uses_default = bool(_default_sa_re.search(body))
             # Absence of any service_account inside node_config also implies default SA.

{proofctl-0.5.5 → proofctl-0.5.7}/proofctl/engine.py

@@ -28,7 +28,7 @@ from .models import Finding, Severity
 from .checkers.placeholders import PlaceholderChecker
 from .checkers.leakage import LeakageChecker
 from .checkers.quality import QualityChecker, AbstractionChecker
-from .checkers.imports import ImportChecker, MethodChecker, DependencyChecker
+from .checkers.imports import ImportChecker, DependencyChecker
 from .checkers.variants import VariantChecker
 from .checkers.security import SecurityChecker
 from .checkers.llm_integration import LLMChecker
@@ -151,8 +151,6 @@ def _build_dir_checkers(config: ProofctlConfig, families: set[str] | None) -> li
         checkers.append(DependencyChecker(
             extra_high_risk=config.i002_extra_high_risk,
         ))
-    if _include("M"):
-        checkers.append(MethodChecker())
 
     return checkers
 

{proofctl-0.5.5 → proofctl-0.5.7}/proofctl/registry.py

@@ -31,7 +31,6 @@ FAMILY_LABELS: dict[str, str] = {
     "L":        "Cross-language leakage",
     "Q":        "Code quality",
     "I":        "Imports",
-    "M":        "Phantom methods (mypy)",
     "V":        "Variant files / near-duplicates",
     "S":        "Security (Python)",
     "LLM":      "LLM integration",

{proofctl-0.5.5 → proofctl-0.5.7/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.5
+Version: 0.5.7
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **268 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -172,7 +172,7 @@ git commit -m "chore: add proofctl baseline"
 | Python — Quality (`Q`) | 17 | Mutable defaults, broad `except`, complexity, long functions, AI-slop patterns (echo docstrings, single-method classes, stale kwargs, defensive guards) |
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
-| Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
+| Python — Other | 11 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
 | Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |

{proofctl-0.5.5 → proofctl-0.5.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.5.5"
+version = "0.5.7"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }