Skip to content

fix(secretlint): add rule installation validation and better error handling #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcusquinn merged 2 commits into from
Jan 13, 2026
Merged

fix(secretlint): add rule installation validation and better error handling #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
448e6a5
fix(secretlint): add rule installation validation and better error ha…
marcusquinn Jan 13, 2026
a4f62b5
fix: address review feedback from Gemini Code Assist
marcusquinn Jan 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions .agent/scripts/secretlint-helper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,67 @@ check_secretlint_installed() {
fi
}

# Check if required rule presets are installed
# Returns: 0=all rules installed, 1=missing rules, 2=no config
check_rules_installed() {
local config_file="${1:-$SECRETLINT_CONFIG_FILE}"

if [[ ! -f "$config_file" ]]; then
return 2
fi

# Extract rule IDs from config
local missing_rules=()

# Check for preset-recommend (most common)
if grep -q "secretlint-rule-preset-recommend" "$config_file"; then
if ! npm list @secretlint/secretlint-rule-preset-recommend &>/dev/null; then
if ! npm list -g @secretlint/secretlint-rule-preset-recommend &>/dev/null; then
missing_rules+=("@secretlint/secretlint-rule-preset-recommend")
fi
fi
fi

# Check for pattern rule
if grep -q "secretlint-rule-pattern" "$config_file"; then
if ! npm list @secretlint/secretlint-rule-pattern &>/dev/null; then
if ! npm list -g @secretlint/secretlint-rule-pattern &>/dev/null; then
missing_rules+=("@secretlint/secretlint-rule-pattern")
fi
fi
fi

if [[ ${#missing_rules[@]} -gt 0 ]]; then
print_error "Missing required secretlint rules:"
for rule in "${missing_rules[@]}"; do
echo " - $rule"
done
print_info "Install with: npm install --save-dev ${missing_rules[*]}"
return 1
fi

return 0
}
Comment on lines +97 to +135
Copy link

@gemini-code-assist gemini-code-assist bot Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To improve maintainability and reduce code duplication, the check_rules_installed function can be refactored. The current implementation has separate, nearly identical blocks for each rule check.

By using an associative array to map configuration strings to their corresponding npm package names, you can iterate through the rules in a loop. This makes the code cleaner and simplifies adding or removing rule checks in the future.

check_rules_installed() {
    local config_file="${1:-$SECRETLINT_CONFIG_FILE}"
    
    if [[ ! -f "$config_file" ]]; then
        return 2
    fi
    
    local missing_rules=()
    # Map of config string to package name
    local -A rules_map=(
        ["secretlint-rule-preset-recommend"]="@secretlint/secretlint-rule-preset-recommend"
        ["secretlint-rule-pattern"]="@secretlint/secretlint-rule-pattern"
    )
    
    for config_string in "${!rules_map[@]}"; do
        if grep -q "$config_string" "$config_file"; then
            local package_name="${rules_map[$config_string]}"
            if ! npm list "$package_name" &>/dev/null && ! npm list -g "$package_name" &>/dev/null; then
                missing_rules+=("$package_name")
            fi
        fi
    done
    
    if [[ ${#missing_rules[@]} -gt 0 ]]; then
        print_error "Missing required secretlint rules:"
        for rule in "${missing_rules[@]}"; do
            echo "  - $rule"
        done
        print_info "Install with: npm install --save-dev ${missing_rules[*]}"
        return 1
    fi
    
    return 0
}


# Validate secretlint installation (binary + rules)
validate_secretlint_setup() {
local has_issues=0

# Check binary
if ! check_secretlint_installed; then
has_issues=1
fi

# Check rules - exit code 1 means missing rules, exit code 2 means no config (ok)
check_rules_installed
local rules_exit=$?
if [[ $rules_exit -eq 1 ]]; then
has_issues=1
fi

return $has_issues
}

# Check if Docker is available
check_docker_available() {
if command -v docker &> /dev/null; then
Expand Down Expand Up @@ -406,6 +467,12 @@ run_secretlint_scan() {
init_secretlint_config
fi

# Validate that required rules are installed
if ! check_rules_installed "$SECRETLINT_CONFIG_FILE"; then
print_error "Secretlint rules not properly installed. Run: $0 install"
return 2
fi

# Build command array for safe execution
local -a cmd_array
read -ra cmd_array <<< "$cmd"
Expand Down Expand Up @@ -436,6 +503,10 @@ run_secretlint_scan() {
elif [[ $exit_code -eq 1 ]]; then
print_error "Secrets detected! Please review and remove/rotate exposed credentials."
print_info "Tip: Use 'secretlint-disable-line' comments to ignore false positives"
elif [[ $exit_code -eq 2 ]]; then
print_error "Scan failed - configuration or installation error"
print_info "Run: $0 status (to diagnose)"
print_info "Run: $0 install (to fix installation)"
else
print_error "Scan failed with error code: $exit_code"
fi
Expand Down Expand Up @@ -584,6 +655,17 @@ show_status() {
fi
echo ""

# Validate rule installation
print_info "Rule Installation:"
if [[ -f "$SECRETLINT_CONFIG_FILE" ]]; then
if check_rules_installed "$SECRETLINT_CONFIG_FILE"; then
print_success "All configured rules are installed"
fi
else
print_warning "No config file - cannot validate rules"
fi
echo ""

# Show available rules in preset
print_info "Recommended Rules (preset-recommend):"
echo " - AWS credentials (Access Key, Secret Key, Account ID)"
Expand Down
34 changes: 33 additions & 1 deletion .agent/tools/code-review/secretlint.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,6 +513,21 @@ Secretlint integrates with the framework's quality pipeline:

### Common Issues

**"Failed to load rule module: @secretlint/secretlint-rule-preset-recommend is not found"**

This error means secretlint is installed but the required rule preset is missing. The config file references rules that aren't installed.

```bash
# Fix: Install the preset alongside secretlint
npm install --save-dev secretlint @secretlint/secretlint-rule-preset-recommend

# Or globally
npm install -g secretlint @secretlint/secretlint-rule-preset-recommend

# Verify installation
./.agent/scripts/secretlint-helper.sh status
```

**"No configuration file found"**

```bash
Expand All @@ -524,10 +539,27 @@ Secretlint integrates with the framework's quality pipeline:
```bash
# Use npx
npx secretlint "**/*"
# Or install globally
# Or install globally (include the preset!)
npm install -g secretlint @secretlint/secretlint-rule-preset-recommend
```

**Scan fails with exit code 2**

Exit code 2 indicates a configuration or installation error (not secrets found). Check:

```bash
# Diagnose the issue
./.agent/scripts/secretlint-helper.sh status

# Common fixes:
# 1. Missing rules - reinstall
./.agent/scripts/secretlint-helper.sh install

# 2. Invalid config - reinitialize
rm .secretlintrc.json
./.agent/scripts/secretlint-helper.sh init
```

**Performance issues with large repos**

```bash
Expand Down
3 changes: 2 additions & 1 deletion .markdownlint.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,8 @@
"sub",
"sup",
"div",
"span"
"span",
"system-reminder"
]
},
"MD034": false,
Expand Down
4 changes: 2 additions & 2 deletions .opencode/MCP-TESTING-GUIDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ ws.onmessage = (e) => console.log(JSON.parse(e.data))

### Config File Location

```
```text
.opencode/server/mcp-test-config.json
```

Expand Down Expand Up @@ -287,7 +287,7 @@ const data = await response.json()

## Files Reference

```
```text
.opencode/
├── server/
│ ├── api-gateway.ts # Main API gateway
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"author": "AI DevOps Framework",
"license": "MIT",
"dependencies": {
"dspyground": "^0.1.0",
"dspyground": "^0.2.0",
"elysia": "^1.1.0"
},
"devDependencies": {
Expand Down
2 changes: 1 addition & 1 deletion templates/home/.agent/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ The aidevops framework now uses `~/.aidevops/` for all working files.

## New Structure

```
```text
~/.aidevops/
├── agents/ # Agent files (deployed from repo)
├── .agent-workspace/ # Your working files
Expand Down
18 changes: 12 additions & 6 deletions templates/home/git/.agent/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,31 @@
# AI Assistant Directory - Home Level

**🔒 SECURITY NOTICE: This directory contains minimal configuration only. All detailed instructions are maintained in the authoritative repository.**
**SECURITY NOTICE: This directory contains minimal configuration only. All detailed instructions are maintained in the authoritative repository.**

## Authoritative Source

## 📍 **Authoritative Source**
All AI assistant working directories and instructions are maintained at:
**Repository**: `~/git/aidevops/.agent/`
**Documentation**: `~/git/aidevops/AGENTS.md`

## 🎯 **Purpose**
## Purpose

This directory exists to:

1. **Provide minimal local configuration** for AI assistants
2. **Reference the authoritative repository** for all operations
3. **Maintain security** by avoiding detailed instructions in user space

## 📁 **Working Directory Redirection**
## Working Directory Redirection

**DO NOT use this directory for AI operations.** Instead use:

- **Temporary files**: `~/git/aidevops/.agent/tmp/`
- **Persistent memory**: `~/git/aidevops/.agent/memory/`
- **Development tools**: `~/git/aidevops/.agent/scripts/`

## 🔗 **Access Authoritative Tools**
## Access Authoritative Tools

```bash
# Navigate to authoritative AI tools
cd ~/git/aidevops/.agent/
Expand All @@ -33,7 +38,8 @@ ls ~/git/aidevops/.agent/tmp/
ls ~/git/aidevops/.agent/memory/
```

## ⚠️ **Security Warning**
## Security Warning

**This directory should remain minimal.** All AI assistant operations should use the authoritative repository's .agent/ directory to prevent security vulnerabilities and maintain centralized control.

---
Expand Down
4 changes: 3 additions & 1 deletion tests/toon-test-documents/sample.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ This is a **test document** to demonstrate the Pandoc conversion capabilities of

### Code Example

bash .agent/scripts/pandoc-helper.sh convert document.docx
```bash
bash .agent/scripts/pandoc-helper.sh convert document.docx
```

For more information, visit the [AI DevOps repository](https://github.com/marcusquinn/aidevops).
2 changes: 1 addition & 1 deletion todo/PLANS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -682,7 +682,7 @@ Integrate Beads task management concepts and bi-directional sync into aidevops T

**Sync architecture:**

```
```text
TODO.md ←→ beads-sync-helper.sh ←→ .beads/beads.db
PLANS.md ←→ (command-led sync) ←→ .beads/issues.jsonl
```
Expand Down
Loading