envscan

Documentation

Overview

Command envscan is the shared env-var classifier for Epic 7 (memql#2103). It is the single source of truth for "which env vars does the code read", used both by the registry audit (7.1 / #2104) and by the CI drift gate (7.2 / #2105) so the two can never diverge.

The reusable core lives in cmd/envscan/scan; this command is a thin CLI wrapper over it so the drift logic is importable by the TestNoEnvRegistryDrift Go test (which is what makes the check a CI gate via the go-checks `go test ./...` lane).

It detects two drift directions against the envregistry manifest registry (scripts/secrets/manifest.yaml, the locked source of truth):

• forward drift -- a var read by code that is NOT registered.
• reverse drift -- a registered var that appears NOWHERE in the repo (code / k8s / .env / dsl). Stale registry entry.

Reads are resolved by parsing, so a key named through a constant is seen (memql#3818). What cannot be resolved statically -- a key that is a parameter or a loop variable -- is REPORTED rather than dropped: every mode states the residual count, and -unresolvable lists the sites. `241 reads, no drift` would only have moved the blind spot; `241 reads, 30 unresolvable sites, no drift` is a claim a reader can check.

Usage:

envscan -list              # print every detected read (key\tfile)
envscan -check             # exit non-zero on forward or reverse drift
envscan -unregistered      # print only reads missing from the registry
envscan -unresolvable      # print the sites whose key could not be resolved
envscan -root <dir>        # module root (default: cwd)