4 Commits

Include renames

Author	SHA1	Message	Date
k3nnyandClaude Sonnet 4.6	986162d270	feat(linter): add GL046-GL049 rules, AND-group support, and GL032 fix ... - GL046: validate image/service pull_policy values (always, if-not-present, never) - GL047: error when a variables.options default value is not in the options list - GL048: error on unrecognised trigger.forward keys - GL049: validate rules[n].allow_failure (bool or {exit_codes:} map) - Parse and evaluate workflow.rules/job.rules nested-array AND-groups; crash on !!seq nodes is fixed; all members of a group must match for it to fire - Add workflow.name and workflow.auto_cancel fields to Workflow struct - Fix GL032 false positive: variables declared in any workflow rule's variables: block no longer trigger an undeclared-variable warning in sibling workflow rule if: expressions - Add Windows ARM64 release build target (task build-windows-arm64) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-30 22:44:22 +02:00
k3nnyandClaude Sonnet 4.6	f79c64cd44	feat(security): security hardening, proxy support, and GL045 HTTP include warning ... Security fixes: - Path traversal guard in include: local: — paths with ../ that escape the repo root are rejected instead of reading arbitrary host files - HTTP timeout (30 s) on all fetcher requests to prevent indefinite hangs - Response size cap (10 MiB) via io.LimitReader to prevent memory exhaustion - Cache directory and file permissions tightened to 0700/0600 - LSP Content-Length cap (64 MiB) to guard against DoS from a malicious client New feature: - --proxy flag on check, graph, and lsp subcommands; also proxy: key in .glint.yml; overrides system HTTP_PROXY / HTTPS_PROXY env vars when set; cmdGraph and cmdLSP now also load .glint.yml for proxy/token/url fallbacks New lint rule: - GL045 (Warning): include: remote: using plain http:// instead of https:// Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-26 21:52:57 +02:00
k3nnyandClaude Sonnet 4.6	8dc30d9207	feat(linter): rules:needs: validation (GL044) ... Add GL044 to validate jobs listed in rules:needs: overrides (GitLab CI 16.4+). rules:needs: lets a specific rule override the job's top-level needs: list; any referenced job must exist in the pipeline. Unknown jobs produce an error; optional: true entries produce a warning, matching the GL027 behaviour for top-level needs:. Cross-pipeline needs and skipped jobs (when a context is active) are excluded from checking. Implementation: - model.Rule gains a Needs []any field (yaml:"needs") - checkRulesNeeds(p, skipped) added to needs.go; wired into Lint - GL044 / RuleRulesNeedsUnknown added to rules.go and explain.go - 6 unit tests + 2 testdata fixtures; task validate updated Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-25 00:33:52 +02:00
k3nnyandClaude Sonnet 4.6	4ce7f86d4d	feat(linter): glint explain, GL042 rules:if: reachability, GL043 inherit completeness ... - `glint explain <RULE>`: new subcommand printing rule description, rationale, bad-YAML example and fix for every GL001–GL043 rule. `glint explain` (no arg) lists all rules with ID, severity, title. Rule IDs are case-insensitive. - GL042 (rules:if: evaluated reachability): warns when every rules:if: condition evaluates to false given the values of variables declared in the pipeline YAML, making the job statically unreachable. Conservative: only fires when all referenced variables are declared in YAML; predefined CI_* / GITLAB_* variables are skipped to avoid false positives. - GL043 (inherit: completeness): warns when inherit: default: is declared but there is no default: block in the pipeline (dead declaration), or when the list form names fields not set in the default: block. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 11:02:23 +02:00