Repository navigation
Improve YAML Hardcoded tokens custom rule - #42
DMarinhoCodacy wants to merge 3 commits into
Conversation
Up to standards ✅🟢 Issues
|
There was a problem hiding this comment.
Pull Request Overview
The checked-in expected results are inconsistent with the hardcoded-token rule: line 12 expects a finding for a bracketed redacted value that none of the rule alternatives matches. This should be resolved by either supporting that format intentionally or removing the expected finding.
Coverage is also missing for common GitHub, GitLab, Slack, and npm formats, as well as safe numeric, null, environment-reference, anchor, and block-scalar values.
Test suggestions
- Detect token-like keys with literal, quoted, and templated values
- Detect token-like keys using hyphens and compound names
- Detect common GitHub, GitLab, Slack, and npm token formats
- Do not flag booleans, short values, or unrelated templated values
- Do not flag numeric, null, environment-reference, anchor, and block-scalar values for exact token keys
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Detect common GitHub, GitLab, Slack, and npm token formats
2. Do not flag numeric, null, environment-reference, anchor, and block-scalar values for exact token keys
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
No description provided.