mroberts
f5934181ec
Copy the standalone code-review and terraform-review skills into
plugins/reviews as audit-code and audit-terraform. The rename separates the
automated, linter-driven audits from the guided review-pr walkthrough that
already lived here.
Resolve bundled script paths through ${SKILL_DIR}, exported in a new step 0.
CLAUDE_PLUGIN_ROOT is not set in the Bash tool environment, so the obvious
substitution would have expanded to nothing and broken every collection
script invocation.
Replace the PLAN and DESIGN docs with READMEs written from the current
SKILL.md and scripts. The old docs had drifted badly: they named semgrep
where the code calls opengrep, scoped five review agents where there are
now eight, and predated Lua, PowerShell, and GitHub Actions support.
Add CONSISTENCY_NORMS to the audit-terraform agent inputs. The collection
script writes consistency_norms.json and the agent prompt declares it, but
SKILL.md never listed it, leaving the variable unsubstituted.
Drop the --ingest-verdicts instruction from both skills. review_stats.py
parses no arguments, so the ref-mode verdict template it told users to feed
back could never be read.
Point audit-terraform's smoke test at README.md and resolve its fixture
paths relative to the test file rather than an absolute home directory.
Tests: 197 passing (audit-code), 106 passing (audit-terraform).
91 lines
2.8 KiB
Python
91 lines
2.8 KiB
Python
"""Repo-wide module callsite graph.
|
|
|
|
For each local-source module dir, list callsite dirs and sibling modules
|
|
(other modules instantiated alongside it at any callsite).
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from pathlib import Path, PurePosixPath
|
|
|
|
import hcl2
|
|
|
|
from scripts.manifest import ModuleGraphEntry
|
|
|
|
|
|
def _strip_hcl_quotes(s):
|
|
if isinstance(s, str) and len(s) >= 2 and s[0] == '"' and s[-1] == '"':
|
|
return s[1:-1]
|
|
return s
|
|
|
|
|
|
def _iter_module_blocks(tf_file: Path):
|
|
try:
|
|
with tf_file.open() as fh:
|
|
parsed = hcl2.load(fh)
|
|
except Exception:
|
|
return
|
|
for block in parsed.get("module", []):
|
|
if not isinstance(block, dict):
|
|
continue
|
|
for name, body in block.items():
|
|
if isinstance(body, dict):
|
|
src = body.get("source")
|
|
if isinstance(src, list):
|
|
src = src[0] if src else None
|
|
src = _strip_hcl_quotes(src)
|
|
yield _strip_hcl_quotes(name), src
|
|
|
|
|
|
def _is_local_source(src: str | None) -> bool:
|
|
if not isinstance(src, str):
|
|
return False
|
|
return src.startswith(("./", "../"))
|
|
|
|
|
|
def _resolve_local(callsite_dir: PurePosixPath, source: str) -> str:
|
|
combined = (callsite_dir / source).as_posix()
|
|
parts: list[str] = []
|
|
for part in combined.split("/"):
|
|
if part in ("", "."):
|
|
continue
|
|
if part == "..":
|
|
if parts:
|
|
parts.pop()
|
|
continue
|
|
parts.append(part)
|
|
return "/".join(parts)
|
|
|
|
|
|
def build_module_graph(repo_root: Path | str) -> dict[str, ModuleGraphEntry]:
|
|
root = Path(repo_root)
|
|
raw: dict[str, list[str]] = {}
|
|
callsite_to_modules: dict[str, dict[str, str]] = {}
|
|
|
|
for tf in root.rglob("*.tf"):
|
|
rel_dir = tf.parent.relative_to(root).as_posix()
|
|
callsite_dir = PurePosixPath(rel_dir)
|
|
for name, src in _iter_module_blocks(tf):
|
|
if not _is_local_source(src):
|
|
continue
|
|
target = _resolve_local(callsite_dir, src) # type: ignore[arg-type]
|
|
raw.setdefault(target, []).append(rel_dir)
|
|
callsite_to_modules.setdefault(rel_dir, {})[name] = target
|
|
|
|
out: dict[str, ModuleGraphEntry] = {}
|
|
for mod_dir, callsites in raw.items():
|
|
unique_callsites = sorted(set(callsites))
|
|
siblings: set[str] = set()
|
|
for cs in unique_callsites:
|
|
for other in callsite_to_modules.get(cs, {}).values():
|
|
if other != mod_dir:
|
|
siblings.add(other)
|
|
out[mod_dir] = ModuleGraphEntry(
|
|
callsites=unique_callsites,
|
|
sibling_modules_at_callsites=sorted(siblings),
|
|
callsite_local_names={
|
|
cs: dict(callsite_to_modules.get(cs, {}))
|
|
for cs in unique_callsites
|
|
},
|
|
)
|
|
return out
|