fix(analyzer): make E2 whitespace-tolerant and detect all os.environ read forms

[weed33834]

Summary

The E2 (Env Variable Harvesting) regex patterns are spell-checkers, not behavior detectors. os\.environ without optional whitespace between os and . means that inserting PEP8-irrelevant whitespace — os . environ . copy () — bypasses detection entirely. A skill scoring DO_NOT_INSTALL with canonical syntax can be rewritten to SAFE by adding spaces. The same blind spot lets dict(os.environ) and {**os.environ} pass clean, even though they do exactly what the rule is meant to catch.

Changes

1. Whitespace-tolerant os.environ matching — \s* between os and \. in all Python E2 patterns, so whitespace variants no longer bypass detection.

2. New patterns — dict(os.environ) and {**os.environ} (the two most common alternative forms of reading the full environment mapping) are now detected.

3. 5 regression tests added to test_patterns.py.

Testing

$ python -m pytest tests/unit/test_patterns.py tests/nodes/analyzers/test_static_patterns.py -v
157 passed in 2.07s

$ make lint && make format
All checks passed!
157 files left unchanged

Fixes #329

[rng1995]

[Automated SkillSpector Review]

Approved. The E2 additions cover whitespace-obfuscated os.environ access plus full-environment reads through dict() and mapping unpacking without changing the rule schema. Focused E2 regressions passed (7 tests), as did Ruff lint and format checks.

[rng1995]

[Automated SkillSpector Review]

Re-review: requesting changes on the new head. The 19 focused E2 tests and Ruff lint pass, but the conflict-resolution commit broadens the malformed-Python fallback from mapping unpacking to bare ** os.environ. Exact-head verification shows 2 ** os.environ is then reported as E2 when another syntax error triggers fallback. Restore unpacking boundaries or equivalent parsing and cover the malformed negative case. GitHub also reports merge conflicts.

[rng1995]

@weed33834 - Please address review comments and resolve merge conflicts. Resolve any review comments that have been addressed

[weed33834]

Hi @rng1995 and maintainers — the DCO issue is now fixed. The branch was rewritten so all commits in this PR carry a proper Signed-off-by line (unsigned helper commits were dropped, and the merge commit with upstream main 2.9.4 is signed too).

The only remaining blocker is that CI runs on this fork PR require maintainer approval (currently action_required). Could you approve the workflow run so DCO + lint + tests can execute? In the last actual CI run (a92654b), lint, unit tests, and docker-smoke all passed — only DCO failed.

@rng1995 if possible, could you re-review the latest head (903d4c2)? The previous CHANGES_REQUESTED was against an older commit.

[rng1995]

@weed33834 - Fix the CI issues please

[weed33834]

Thanks for the heads-up @rng1995. Both CI issues are now fixed.

DCO Check

The original branch had 5 merge commits without Signed-off-by. I rebased onto the latest upstream/main so the branch now contains a single clean commit with a proper Signed-off-by trailer:

Signed-off-by: badhope <weed33834@users.noreply.github.com>

test-unit: test_e2_whitespace_tolerant_environ_access

Root cause: The test input x = os . environ [ 'API_KEY' ] is valid Python that the AST parser handles, but the AST analyzer in _analyze_python_environment_reads was missing two cases:

1. ast.Subscript nodes — os.environ['KEY'] was not detected because the AST walk only checked ast.Call, ast.Dict, and ast.For/ast.comprehension nodes, not ast.Subscript.
2. .get() method — os.environ.get('SECRET') was not detected because get was not in _ENVIRONMENT_MAPPING_METHOD_CONFIDENCE (only copy, items, keys, values).

Since the AST path succeeded (the source is valid Python), the regex fallback was never reached — so the whitespace-tolerant regex patterns also didn't help.

Fix:

• Added "get": 0.7 and "setdefault": 0.6 to _ENVIRONMENT_MAPPING_METHOD_CONFIDENCE.
• Added an ast.Subscript branch to the AST walk: when the subscripted value is os.environ (resolved through import aliases), it emits an E2 finding.

Verification: The test now expects ≥ 2 findings (subscript + .get()), and both are emitted. I also verified that the exponentiation_not_flagged test still passes — 2 ** os.environ is malformed Python (indentation error in the test case), so it falls through to the regex path, where the dict-spread pattern requires braces and doesn't match.

The force-push is live — CI should re-trigger once approved.