[shrsv]

Adds the same convenience API client as a companion PR, but sourcing the credential from an environment variable instead of a hardcoded constant.

Simulated for this demo: same no-secrets blocking ruleset configured on this org as the companion PR -- but nothing here trips it.

[livereviewbot]

LiveReview automated review

Scanned 2 changed files (+17/-0). Credential is sourced from the environment, never committed to source, with an explicit error when it's missing rather than a silent empty default. No findings.

[livereviewbot]

Auto-approve policy evaluation

Stage	Result
Eligibility	✅ pass
LLM classification (refactor-only, confidence 9)	✅ pass
Risk score vs. threshold	✅ pass
Static ruleset gate -- no-secrets: [.findings[] | select(.type == "hardcoded-secret")] | length > 0 → no match (findings list is empty)	✅ pass

Verdict: AUTO-APPROVED. Contrast with static-gate-blocks-on-tripped-ruleset: having a blocking ruleset configured doesn't mean the gate blocks by default -- it evaluates the rule's actual condition against this review's findings, and here there's nothing for no-secrets to match. A defensive "block if any ruleset exists" policy would make rulesets useless busywork; this one only blocks when the condition is actually true.

[livereviewbot]

Auto-approve policy verdict: APPROVED. The no-secrets ruleset is configured but its condition doesn't match -- no hardcoded-secret finding here.