Skip to content

Avoid env-var-secret false positives for SECRETS_* names#1206

Open
arpitjain099 wants to merge 1 commit into
stackrox:mainfrom
arpitjain099:fix/env-var-secret-secrets-dir
Open

Avoid env-var-secret false positives for SECRETS_* names#1206
arpitjain099 wants to merge 1 commit into
stackrox:mainfrom
arpitjain099:fix/env-var-secret-secrets-dir

Conversation

@arpitjain099

Copy link
Copy Markdown

Fixes #1198.

The built-in env-var-secret check used (?i).*secret.*, which also matched names like SECRETS_DIR.

This narrows the built-in pattern so plural secrets suffixes are not flagged, and extends the fixture with a SECRETS_DIR case to keep that behavior covered.

Verification:

  • go test ./pkg/builtinchecks/...
  • go run ./cmd/kube-linter lint --include env-var-secret --do-not-auto-add-defaults --format json tests/checks/env-var-secret.yml

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@arpitjain099 arpitjain099 requested a review from rhybrillou as a code owner June 18, 2026 12:59
@coderabbitai

coderabbitai Bot commented Jun 18, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 48646998-9713-495f-9b13-03aa1f1c28cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov

codecov Bot commented Jun 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.71%. Comparing base (dbd7529) to head (20df834).
⚠️ Report is 316 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff             @@
##             main    #1206       +/-   ##
===========================================
- Coverage   62.36%   30.71%   -31.65%     
===========================================
  Files         197      239       +42     
  Lines        4854     6534     +1680     
===========================================
- Hits         3027     2007     -1020     
- Misses       1439     4351     +2912     
+ Partials      388      176      -212     
Flag Coverage Δ
unit 30.71% <ø> (-31.65%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] env-var-secret rule is triggered by SECRETS_DIR

1 participant