feat(catalog): add HashiCorp Vault#124
Merged
Merged
Conversation
Adds vault as the second hashicorp_zip tool (after terraform), installable
via 'make install-vault'. Records the current upstream version (2.0.3) in
the committed baseline and updates the catalog coverage docs, including
the stale cataloged-tool count (98 -> 100).
Vault has no stdout bash-completion generator ('vault completion bash'
prints usage; the real mechanism is 'vault -autocomplete-install', which
edits rc files directly), so no bash_completion is declared.
Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
CybotTM
added a commit
that referenced
this pull request
Jul 23, 2026
#126) Fixes #125. ## Root cause `cmd_update_baseline` built a fresh empty `UpstreamCache()` (`audit.py:1029`), filled it with only the tools collected this run, and `write_upstream_cache` overwrote the whole file. Consequences: - A tool-scoped run (`audit.py --update-baseline vault`) replaced `upstream_versions.json` with just that one entry, dropping ~95 committed entries (observed in #124). - Even in full runs, a transient collection failure silently deleted that tool's committed entry (the exception path never re-adds it). ## Fix Start from `load_upstream_cache()` and update only the entries collected this run — everything else survives. Follow-ups inside the same blast radius: - The `✓ Collected N versions` summary counted the merged map size, which would have read "Collected 96" after collecting 1; it now reports successful collections as `N/total`. - `UpstreamCache` import removed from `audit.py` (orphaned by the fix; the other pre-existing F401s are untouched). Side-effect note: a full `--update-baseline` run no longer prunes entries for tools removed from the catalog — stale entries are removed by editing the committed file, which review covers. ## Tests `TestUpdateBaselineMerges` (tests/test_update_fixes.py) — written red against the unfixed code: - tool-scoped run preserves unrelated entries and updates the requested one - failed collection leaves the existing entry intact Full suite 740 passed / 1 skipped, smoke test OK; flake8 findings on `audit.py` are the 3 pre-existing ones from `main`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
vaultto the tool catalog as the secondhashicorp_ziptool (after terraform).catalog/vault.json— modeled onterraform.json(product_name/binary_namevault, guide order 205, amd64/arm64 arch map)upstream_versions.json— vault 2.0.3 added to the committed baseline (merged additively; two npm entries got key-sorted to match the canonicalsort_keys=Truewriter output)catalog/COVERAGE.md,catalog/README.md— coverage lists and counts updated; the cataloged-tool count was already stale at 98 vs. 99 actual JSON entries, now corrected to 100No
bash_completiondeclared:vault completion bashprints usage text (which the completion validator rejects); vault's actual mechanism isvault -autocomplete-install, which edits rc files directly instead of emitting a script.Verification
https://releases.hashicorp.com/vault/2.0.3/vault_2.0.3_linux_amd64.zip→ HTTP 200make install-vault→ installsVault v2.0.3to~/.local/bin/vault, snapshot refresheduv run python audit.py vault→ ✅ 2.0.3 / 2.0.3Note
audit.py --update-baseline <tool>with a single tool argument replaces the wholeupstream_versions.jsoninstead of merging — it dropped the other ~95 entries when run for vault (restored, then merged manually). Worth a follow-up issue.