Improve YAML Hardcoded tokens custom rule

docs/codacy-rules.yaml

@@ -645,8 +645,15 @@ rules:
     severity: ERROR
     languages:
       - generic
-    patterns:
+    pattern-either:
+      # any key containing _token / -token with a single-word value
       - pattern-regex: '(?i)^\s*[\w-]*[_-]token[_-]?[\w-]*\s*:\s*["'']?[^\s"'']+["'']?\s*$'
+      # Same keys with a {{ ... }} template value containing spaces
+      - pattern-regex: '(?i)^\s*[\w-]*[_-]token[_-]?[\w-]*\s*:\s*["'']?\{\{[^}\n]*\}\}["'']?\s*$'
+      # Key named token / *_token / *-token with a literal value (skips booleans, numbers, null, templates, env refs, anchors, block scalars)
+      - pattern-regex: '(?i)^\s*(?:[\w-]*[_-])?token\s*:\s*(?!(?:true|false|yes|no|null|~|-?\d+(?:\.\d+)?)\s*(?:#.*)?$)(?!["'']?\s*(?:\{\{|\$\{|\$[A-Z_]|<%|%\{))(?:"[^"\n]{8,}"|''[^''\n]{8,}''|[^\s"''#|>&*!{\[][^\s#]{7,})\s*(?:#.*)?$'
+      # Well-known token formats under any key (GitHub, GitLab, Slack, npm)
+      - pattern-regex: '\b(?:gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22,}|glpat-[A-Za-z0-9_-]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|npm_[A-Za-z0-9]{36})\b'
     message: Hardcoded tokens are a security risk. They can be easily found by attackers and used to gain unauthorized access to the system.
     metadata:
       owasp:

docs/multiple-tests/codacy-rules/patterns.xml

@@ -16,4 +16,5 @@
     <module name="codacy.k8s.ingress.nginx.retirement.ingress-class" />
     <module name="codacy.k8s.ingress.nginx.retirement.workload" />
     <module name="codacy.bash.security.hard-coded-password" />
+    <module name="codacy.yaml.security.hard-coded-tokens" />
 </module>

docs/multiple-tests/codacy-rules/results.xml

@@ -34,7 +34,7 @@
     <file name="codacy.csharp-lowercase.cs">
         <error source="codacy.generic.csharp-lowercase-variables" line="5" message="Variable names should be lowercase" severity="info" />
     </file>
-    <file name="codacy_apenai_non_guardrails.py">
+    <file name="codacy_openai_non_guardrails.py">
         <error source="codacy.python.openai.non-guardrails-direct-call" line="6" message="Direct OpenAI SDK call detected." severity="warning" />
         <error source="codacy.python.openai.non-guardrails-client-usage" line="3" message="OpenAI client used without Guardrails." severity="warning" />
         <error source="codacy.python.openai.non-guardrails-client-usage" line="3" message="OpenAI client used without Guardrails." severity="warning" />
@@ -56,4 +56,21 @@
     <file name="codacy-shell.sh"> 
         <error source="codacy.bash.security.hard-coded-password" line="1" message="Hardcoded passwords are a security risk." severity="error" />
     </file>
+    <file name="codacy.yaml.security.hard-coded-tokens.yaml">
+        <error source="codacy.yaml.security.hard-coded-tokens" line="2" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="3" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="4" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="5" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="6" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="7" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="8" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="9" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="10" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="11" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="12" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="12" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="13" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="13" message="Hardcoded tokens are a security risk." severity="error" />
+        <error source="codacy.yaml.security.hard-coded-tokens" line="13" message="Hardcoded tokens are a security risk." severity="error" />
+    </file>
 </checkstyle>

docs/multiple-tests/codacy-rules/src/codacy.yaml.security.hard-coded-tokens.yaml

@@ -0,0 +1,19 @@
+# Should be flagged
+gh_token: >-
+gh_token: "{{gh_token}}"
+gh_token: "{{ gh_token }}"
+gh_token: '{{ secrets.GH }}'
+gh_token: "correct horse battery staple"
+max_tokens: 4096
+access_token_ttl: 3600
+use_refresh_token: true
+auth-token: "s3cr3tValue99"
+Token: 'abcdef123456'
+token: ghp_EXAMPLEexampleEXAMPLEexample00001234
+slack_token: xoxb-1234567890-abcdef
+
+# Should not be flagged
+name: "{{ gh_token }}"
+token: true
+token: abc
+api_key: some-value