4 Commits

Include renames

Author	SHA1	Message	Date
k3nnyandClaude Sonnet 4.6	a68993d26f	test(config): skip permission test when running as root ... The Gitea CI runner executes as root, which bypasses filesystem permission checks. The TestLoad_ReadError test creates a mode-0000 file and expects a read error, but root can always read files regardless of mode. Skip the test under root instead of removing it so it still runs in restricted environments. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-26 22:41:30 +02:00
k3nnyandClaude Sonnet 4.6	f79c64cd44	feat(security): security hardening, proxy support, and GL045 HTTP include warning ... Security fixes: - Path traversal guard in include: local: — paths with ../ that escape the repo root are rejected instead of reading arbitrary host files - HTTP timeout (30 s) on all fetcher requests to prevent indefinite hangs - Response size cap (10 MiB) via io.LimitReader to prevent memory exhaustion - Cache directory and file permissions tightened to 0700/0600 - LSP Content-Length cap (64 MiB) to guard against DoS from a malicious client New feature: - --proxy flag on check, graph, and lsp subcommands; also proxy: key in .glint.yml; overrides system HTTP_PROXY / HTTPS_PROXY env vars when set; cmdGraph and cmdLSP now also load .glint.yml for proxy/token/url fallbacks New lint rule: - GL045 (Warning): include: remote: using plain http:// instead of https:// Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-26 21:52:57 +02:00
k3nnyandClaude Sonnet 4.6	b21ef5c0bb	feat(cicontext): rules:changes: path-glob evaluation; 100% test coverage ... - Add --changes PATH and --changes-from REF flags to glint check and glint graph for rules:changes: evaluation. --changes marks files explicitly; --changes-from runs git diff --name-only <REF> automatically. Both flags can be combined. - Implement doublestar glob matching (*, ** across path segments) in EvalJob and EvalWorkflow; extended {paths, compare_to} map form supported. - Without --changes/--changes-from the condition stays permissive (existing behaviour). - Context summary line now shows changed-file count when file data is provided. - Achieve 100% statement coverage: comprehensive tests added across all packages; removed provably dead code; added testability seams (exit, userHomeDirFn, execCommandOutput variables) to cover previously unreachable paths. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-21 22:47:32 +02:00
k3nnyandClaude Sonnet 4.6	02d8e63a98	feat(cli): .glint.yml config and inline suppression comments ... Adds project-level configuration and per-job suppression directives: .glint.yml (searched from pipeline dir up to the git root): - ignore: [GL007, GL032] — suppress rules globally for the project - severity: {GL004: warning} — override rule severity (error/warning/ignore) - stages: [quality] — extra stages beyond the pipeline's stages: block - token: / url: / cache_dir: — defaults for flags; lower priority than CLI flags and environment variables Inline suppression (# glint: ignore): - Place "# glint: ignore GL007" immediately before a job definition to suppress that rule for the specific job only - Multiple rules: "# glint: ignore GL007, GL032" (comma or space separated) - Wildcard: "# glint: ignore all" suppresses every finding for the job - Suppressions are scoped to the annotated job; pipeline-level findings are unaffected - Parsed from yaml.Node head/line comments in the first parse pass; stored in Pipeline.Suppressions (root file only, not includes) New packages: internal/config (Load, walk-up search, .git boundary stop) New files: cmd/glint/filter.go (applyConfig, isSuppressed helpers) Tests: config_test.go, parser_suppress_test.go, filter_test.go Validate fixtures: testdata/config_ignored/, config_severity/, config_suppress/ Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 10:23:33 +02:00