4 Commits

Include renames

Author	SHA1	Message	Date
k3nnyandClaude Sonnet 4.6	f79c64cd44	feat(security): security hardening, proxy support, and GL045 HTTP include warning ... Security fixes: - Path traversal guard in include: local: — paths with ../ that escape the repo root are rejected instead of reading arbitrary host files - HTTP timeout (30 s) on all fetcher requests to prevent indefinite hangs - Response size cap (10 MiB) via io.LimitReader to prevent memory exhaustion - Cache directory and file permissions tightened to 0700/0600 - LSP Content-Length cap (64 MiB) to guard against DoS from a malicious client New feature: - --proxy flag on check, graph, and lsp subcommands; also proxy: key in .glint.yml; overrides system HTTP_PROXY / HTTPS_PROXY env vars when set; cmdGraph and cmdLSP now also load .glint.yml for proxy/token/url fallbacks New lint rule: - GL045 (Warning): include: remote: using plain http:// instead of https:// Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-26 21:52:57 +02:00
k3nnyandClaude Sonnet 4.6	b21ef5c0bb	feat(cicontext): rules:changes: path-glob evaluation; 100% test coverage ... - Add --changes PATH and --changes-from REF flags to glint check and glint graph for rules:changes: evaluation. --changes marks files explicitly; --changes-from runs git diff --name-only <REF> automatically. Both flags can be combined. - Implement doublestar glob matching (*, ** across path segments) in EvalJob and EvalWorkflow; extended {paths, compare_to} map form supported. - Without --changes/--changes-from the condition stays permissive (existing behaviour). - Context summary line now shows changed-file count when file data is provided. - Achieve 100% statement coverage: comprehensive tests added across all packages; removed provably dead code; added testability seams (exit, userHomeDirFn, execCommandOutput variables) to cover previously unreachable paths. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-21 22:47:32 +02:00
k3nnyandClaude Sonnet 4.6	04f17f8616	test(coverage): add unit tests across all packages; remove dead code ... - Added comprehensive table-driven test suites for all packages: cmd/glint, cicontext, fetcher, graph, linter, model, resolver. Coverage reaches 98%+ statement coverage across the codebase. - Replaced os.Exit calls in cmd/glint with an `exit` variable so tests can capture exit codes without terminating the test process. - Removed unreachable code found during coverage analysis: dead guard in cicontext.parseRegexLiteral; dead len(jobs)==0 branch in graph.Pipeline; skipWin struct field and dead continue in graph.convertToPNG; pipelineSVG return type simplified to string. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 22:03:46 +02:00
k3nnyandClaude Sonnet 4.6	f5f8546bcf	feat(cli): output formats, GL034-GL041 lint rules, include inputs and cache ... Bundles three patch releases (v0.2.16–v0.2.18): v0.2.18 — output formats (--format flag on glint check): - json: stable JSON report (schema_version: 1, findings array, summary) - sarif: SARIF 2.1.0 for GitHub Code Scanning / GitLab SAST - junit: JUnit XML for CI test-report artifacts (artifacts:reports:junit) - github: GitHub Actions ::error:: / ::warning:: annotation lines - Unknown --format value exits 2 with a helpful error message - Summary line routed to stderr in structured formats; context suppressed v0.2.17 — include resolution improvements: - Recursive include depth capped at 100 (matches GitLab's own limit) - project: and component: includes tracked in visited set (cycle detection) - $[[ inputs.KEY ]] / $[[ inputs.KEY | default(…) ]] substituted from with: - --cache-dir: persist fetched remote templates to disk (SHA-256 keyed) - --offline: serve from cache only; defaults to ~/.cache/glint v0.2.16 — new lint rules (GL034–GL041): - GL034: services map form requires name; alias must be valid DNS label - GL035: rules:changes / rules:exists absolute path detection - GL036: timeout format validation (job-level + default.timeout) - GL037: id_tokens entries must have an aud key - GL038: secrets entries must declare a provider (vault / gcp / azure) - GL039: pages: keyword + artifacts.paths consistency - GL040: duplicate stage names in stages: list - GL041: cache.key.files must be exact paths, not globs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 10:09:16 +02:00