Add --config flag and WARD_CONFIG env for explicit config path #38

New issue

Closed

opened 2026-06-03 22:33:03 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-03 22:33:03 +00:00

Owner

Scope

Sub-issue of #4. Add explicit config-path resolution to ward so consumers can point at a specific .ward/ward.yaml without relying on the cwd walk-up.

What

Persistent --config <path> flag on the root ward command.
WARD_CONFIG environment variable as the env-var equivalent.
Resolution order: --config > $WARD_CONFIG > existing walk-up discoverConfig(cwd).
Explicit paths bypass the walk-up entirely — if the file is missing or unreadable, ward fails with a clear error rather than silently falling back.
All commands that today call loadDefault() / discoverConfig(cwd) pick this up: exec, lint, future doctor.

Wrinkle

execCommand() builds its sub-command tree at app-construction time (before app.Run parses flags). The implementation pre-parses --config from os.Args and WARD_CONFIG from the environment before cli.Command construction, then registers --config as a real top-level flag so help and the urfave parser stay consistent.

Acceptance

ward --config /abs/path/ward.yaml exec build runs the verb from that file.
WARD_CONFIG=/abs/path/ward.yaml ward exec build same.
--config wins over WARD_CONFIG.
Missing explicit path returns a non-zero exit with the path quoted in the error.
Walk-up behavior unchanged when neither flag nor env is set.
docs/config-discovery.md documents the new resolution order.
Tests cover: flag-only, env-only, flag-over-env, explicit-missing, fallback-to-walk-up.

Out of scope

security: schema (separate sub-issue of #4).
doctor security (separate sub-issue of #4).
Hook wiring for protected binaries (separate sub-issue of #4).

## Scope Sub-issue of #4. Add explicit config-path resolution to ward so consumers can point at a specific `.ward/ward.yaml` without relying on the cwd walk-up. ## What - Persistent `--config <path>` flag on the root `ward` command. - `WARD_CONFIG` environment variable as the env-var equivalent. - Resolution order: `--config` > `$WARD_CONFIG` > existing walk-up `discoverConfig(cwd)`. - Explicit paths bypass the walk-up entirely — if the file is missing or unreadable, ward fails with a clear error rather than silently falling back. - All commands that today call `loadDefault()` / `discoverConfig(cwd)` pick this up: `exec`, `lint`, future `doctor`. ## Wrinkle `execCommand()` builds its sub-command tree at app-construction time (before `app.Run` parses flags). The implementation pre-parses `--config` from `os.Args` and `WARD_CONFIG` from the environment before `cli.Command` construction, then registers `--config` as a real top-level flag so help and the urfave parser stay consistent. ## Acceptance - `ward --config /abs/path/ward.yaml exec build` runs the verb from that file. - `WARD_CONFIG=/abs/path/ward.yaml ward exec build` same. - `--config` wins over `WARD_CONFIG`. - Missing explicit path returns a non-zero exit with the path quoted in the error. - Walk-up behavior unchanged when neither flag nor env is set. - `docs/config-discovery.md` documents the new resolution order. - Tests cover: flag-only, env-only, flag-over-env, explicit-missing, fallback-to-walk-up. ## Out of scope - `security:` schema (separate sub-issue of #4). - `doctor security` (separate sub-issue of #4). - Hook wiring for protected binaries (separate sub-issue of #4).

coilysiren referenced this issue from a commit

2026-06-03 22:38:21 +00:00

feat(config): add --config flag and WARD_CONFIG env for explicit allowlist path

coilysiren closed this issue

2026-06-03 22:38:21 +00:00

coilysiren referenced this issue

2026-06-03 22:40:17 +00:00

Surface cli-guard security: schema in ward (ward security show + lint coverage) #39

coilysiren referenced this issue

2026-06-03 22:43:04 +00:00

Collapse ward lint + security surface under ward doctor umbrella #40

coilysiren referenced this issue