[BUG]: varlock audit does not detect ENV.<KEY> attribute access in Python #1266

Problem

varlock audit does not detect ENV.<KEY> attribute access in Python (the accessor @generatePythonEnv now generates)

varlock version

1.24.0

Steps to reproduce

Two-file project, no install needed:

# .env.schema
# @defaultSensitive=false @defaultRequired=infer
# @generatePythonEnv(path=./env.py, auto=false)
# ---
API_KEY=
CONTROL_VAR=

# app.py
import os

from env import ENV

a = ENV.API_KEY   # read via the generated accessor
b = os.getenv('CONTROL_VAR')   # control: an explicitly supported syntax

varlock codegen -p .env.schema   # generates env.py with the `ENV` attribute accessor
varlock audit -p .env.schema

What is expected?

No "unused in schema" entries. CONTROL_VAR is read with os.getenv(...), and SPEECHMATICS_API_KEY is read through ENV.SPEECHMATICS_API_KEY — the accessor that @generatePythonEnv itself emits and documents as the recommended way to read values:

class EnvAttrs:
    """Attribute access to the coerced env (`ENV.MY_KEY`), so editors show each item's docs on hover."""

What is actually happening?

🚨 Schema/code mismatch detected:

Unused in schema (1):
  - SPEECHMATICS_API_KEY
(Hint: If this is used by an external tool, add # @auditIgnore to the item)

The os.getenv(...) control is recognised, the ENV.<KEY> read is not. The hint suggests @auditIgnore, which would be wrong here — the item is used.

On a real project this is not a single false positive: an audit run reports every item in the schema as unused (33 of 33 in my case), so audit cannot be used as a CI gate at all.

System Info

macOS arm64, varlock 1.24.0 (standalone), Python 3.13.15. Also observed in a uv-workspace monorepo, same result.

Any additional comments?

Likely location

packages/varlock/src/cli/helpers/env-var-scanner.ts, PATTERNS_BY_LANGUAGE:

• 'js-like' already matches attribute access — /\bENV\.([A-Za-z_][A-Za-z0-9_]*)\b/g and ENV['KEY'];
• 'python' only has os.environ[...] (python.environ) and os.getenv(...) (python.getenv).

So the Python language entry is missing the attribute form that Python codegen now encourages (#952 native ENV, #1215 attribute access on the generated module).

Related

• [BUG]: audit does not detect env.get('KEY') references #1073 — [BUG]: audit does not detect env.get('KEY') references (same class of gap, JS side, closed)
• [Feature Request] Python codegen: docstrings and attribute access so item docs show on hover #1215 — Python codegen: docstrings and attribute access (ENV.<KEY>)
• Add native Python integration #952 — native Python integration with attribute access on ENV