Add hard-coded password detection rule for Kotlin

[claudiacodacy]

Summary

• Codacy already ships codacy.<lang>.security.hard-coded-password — a custom rule that flags a plain string literal assigned to a variable named like password/secret/pwd/key — for Java, JavaScript/TypeScript, C#, Scala, and Bash. Kotlin had no equivalent; the only Kotlin-specific password rule is scoped to build.gradle files.
• This surfaced from a customer/sales test: a hardcoded password parameter added to a Kotlin test file wasn't flagged, even though the identical pattern in a Java or JS file is caught today.
• Adds codacy.kotlin.security.hard-coded-password, mirroring the existing Java/JS rule (same message, metadata, and name-matching regex), covering val/var declarations with and without an explicit String type.
• Adds docs/multiple-tests/codacy-rules-kotlin/ fixtures (patterns.xml, results.xml, src/Program.kt), following the same structure as codacy-rules-java/codacy-rules-javascript.

Test plan

• go run ./cmd/docgen completes with no panic/errors related to the new rule (ran in a golang:1.23-alpine3.21 container matching the Dockerfile builder stage)
• go test $(go list ./... | grep -v /docs/) passes
• docker build --build-arg TOOL_VERSION=$(cat .tool_version) -t codacy-opengrep:latest . succeeds end-to-end
• Validated the exact rule pattern against the pinned opengrep v1.26.0 binary (same version as the Dockerfile's OPENGREP_VERSION arg) directly against the new fixture — all 3 expected findings fire at the expected lines
• CI plugins_test job (validates docs/multiple-tests/codacy-rules-kotlin/ end-to-end) — pending, will monitor after opening this PR

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR successfully introduces a new security rule for Kotlin, but several implementation gaps exist that limit its effectiveness compared to its Java and JavaScript counterparts. Specifically, the rule currently misses const val declarations and triple-quoted string literals, which are idiomatic in Kotlin for defining constants and secrets.

Additionally, there is a discrepancy between the rule's defined message and the test results fixture, which may lead to test failures in CI. While Codacy analysis reports the PR is up to standards, these logic gaps should be addressed to ensure the rule provides the intended level of security coverage.

About this PR

• The rule implementation is currently limited to variable declarations (val/var). Hardcoded sensitive values passed directly as function arguments (e.g., login("hardcoded_password")) will not be detected by this rule.

Test suggestions

• Detect hardcoded password in a 'val' declaration without explicit type.
• Detect hardcoded password in a 'var' declaration without explicit type.
• Detect hardcoded password in a declaration with explicit ': String' type.
• Identify multiple keyword variations (e.g., apiKey, apiSecret) case-insensitively.
• Detect hardcoded secrets assigned using const val declarations
• Detect hardcoded secrets in triple-quoted string literals ("""...""")
• Detect hardcoded values passed directly as function arguments

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Detect hardcoded secrets assigned using `const val` declarations
2. Detect hardcoded secrets in triple-quoted string literals (`"""..."""`)
3. Detect hardcoded values passed directly as function arguments

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: The current patterns do not detect secrets assigned using const val or those stored in triple-quoted string literals ("""..."""), both of which are common in Kotlin projects. It is recommended to update the rule to include these patterns for more robust detection.

[codacy-production]

_{⚪ LOW RISK}

Nitpick: The regular expression contains redundant entries. Specifically, the keyword 'clave' is duplicated, and 'secret' is potentially redundant within the current structure.

Suggested change

	regex: "(?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd|(api|secret|private|access|aws|ssh|auth|session|encryption|decryption|gcp)[_-]?key).*"
	regex: "(?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|parola|secret|pwd|(api|secret|private|access|aws|ssh|auth|session|encryption|decryption|gcp)[_-]?key).*"