Class: Kamal::Lint::Checks::KamalSecretsNotGitignored

Inherits:
Kamal::Lint::Check show all
Defined in:
lib/kamal/lint/checks/kamal_secrets_not_gitignored.rb

Instance Attribute Summary

Attributes inherited from Kamal::Lint::Check

#context

Instance Method Summary collapse

Methods inherited from Kamal::Lint::Check

applies_to?, id, #initialize, severity, since, title, until_version

Constructor Details

This class inherits a constructor from Kamal::Lint::Check

Instance Method Details

#call ⇒ Object

We only flag when:

- a .kamal/secrets file exists (so there's something to leak), AND
- it is NOT covered by .gitignore (or .gitignore is missing), AND
- it contains at least one raw literal value (not just shell
substitutions like `$(cmd)`, `${VAR}`, or `$VAR`). Files that
only reference secrets via substitution are safe to commit.



18
19
20
21
22
23
24
25
26
27
 
# File 'lib/kamal/lint/checks/kamal_secrets_not_gitignored.rb', line 18

def call
  return [] unless File.exist?(context.secrets_path)
  return [] if gitignored?
  return [] unless contains_literal_secret?

  [ finding(
    message: ".kamal/secrets exists but isn't ignored by .gitignore; add `.kamal/secrets` to .gitignore",
    line: 1
  ) ]
end