Function commandFn

packages/varlock/src/cli/commands/scan.command.ts:453–570

(ctx)

}

export const commandFn: TypedGunshiCommandFn<typeof commandSpec> = async (ctx) => {
  // Handle --install-hook before doing any scanning
  if (ctx.values['install-hook']) {
    await installHook(process.cwd());
    return;
  }

  const onlyStaged = ctx.values.staged ?? false;
  const includeIgnored = ctx.values['include-ignored'] ?? false;

  // Positional arguments are treated as explicit paths/globs to scan
  const scanTargets = ctx.values.targets ?? [];

  // Load the varlock env graph to get the actual sensitive values
  const envGraph = await loadVarlockEnvGraph({
    entryFilePaths: ctx.values.path,
  });

  // Check for loading/schema errors
  for (const source of envGraph.sortedDataSources) {
    if (source.loadingError) {
      throw new CliExitError(`Error loading config: ${source.loadingError.message}`, {
        suggestion: 'Make sure your .env.schema file is valid.',
      });
    }
  }

  await envGraph.resolveEnvValues();

  // Collect all sensitive string values that are non-empty
  const sensitiveValues = new Map<string, string>();
  for (const itemKey in envGraph.configSchema) {
    const item = envGraph.configSchema[itemKey];
    if (item.isSensitive && _.isString(item.resolvedValue) && item.resolvedValue !== '') {
      sensitiveValues.set(itemKey, item.resolvedValue);
    }
  }

  if (sensitiveValues.size === 0) {
    logLines([ansis.green('✅ No sensitive values found in config - nothing to scan for.')]);
    return;
  }

  const cwd = process.cwd();
  let files: Array<string>;

  if (scanTargets.length > 0) {
    // Explicit paths/globs provided — scan only those targets.
    // We skip git-aware filtering so the user gets exactly what they asked for,
    // and we do NOT apply SKIP_DIRS (e.g. `dist`, `.next`) since the whole point
    // is often to scan a build output directory.
    files = await resolveTargetPaths(scanTargets, cwd);
  } else if (includeIgnored) {
    // Walk the full directory tree, no git filtering
    files = await walkDirectory(cwd);
  } else {
    // Try to use git to get non-ignored files
    const gitFiles = await getGitFiles(cwd, onlyStaged);