@codemod/arm-duplicate-string-literals-s1192

Scan Azure Resource Manager (ARM) JSON templates for repeated identical string literals above a configurable minimum length and threshold, then report maintainability hotspots where values should be centralized into parameters, variables, or reusable modules instead of being duplicated inline.

What It Does

• Parses ARM JSON templates and Bicep-generated ARM JSON artifacts as JSON.
• Detects duplicated decoded string literal values across the whole file, including nested Microsoft.Resources/deployments inline properties.template fragments.
• Excludes top-level $schema and common ARM schema/documentation URLs by default.
• Emits structured per-file findings and codemod:metrics counters.
• Never edits source files. This is a read-only mining codemod.

Usage

Run the local package against a target repository:

bash
Copy
pnpm dlx codemod@latest workflow run -w . -t /path/to/repository

Common parameters:

• minimal_literal_length default 5
• threshold default 3
• ignore_arm_expression_strings default false
• ignore_api_versions default false
• ignore_resource_types default false
• ignore_known_low_signal_paths default false
• require_arm_shape default false
• redact_literals default false

Example with stricter filtering and redaction:

bash
Copy
pnpm dlx codemod@latest workflow run -w . -t /path/to/repository \
  --param minimal_literal_length=8 \
  --param threshold=4 \
  --param ignore_arm_expression_strings=true \
  --param redact_literals=true

Findings

Each file with findings emits a structured warning containing:

• file
• literal or literalHash when redaction is enabled
• occurrenceCount
• jsonPaths
• semanticKinds
• minimal_literal_length
• threshold
• remediationGuidance
• estimatedMaintenanceImpact

Remediation guidance recommends centralizing repeated values into:

• parameters for environment-specific values
• variables for file-local constants
• reusable module inputs/outputs when the value spans deployment boundaries

Metrics

The codemod emits these metrics:

• arm_duplicated_string_literal_occurrences keyed by file
• arm_duplicated_string_literal_groups keyed by file
• arm_duplicated_string_literal_max_group_size keyed by file
• arm_duplicated_string_literal_files_with_findings keyed by repository
• arm_duplicated_string_literal_total_occurrences keyed by repository
• arm_duplicated_string_literal_total_groups keyed by repository
• arm_duplicated_string_literal_parse_failures keyed by repository
• arm_duplicated_string_literal_ignored_schema_urls keyed by repository
• arm_duplicated_string_literal_ignored_expression_strings keyed by repository
• arm_duplicated_string_literal_by_literal_hash keyed by literalHash

Target Files

• Included: **/*.json
• Excluded: **/node_modules/**, **/dist/**, **/build/**

If require_arm_shape=true, non-ARM JSON files are skipped without findings.

Development

bash
Copy
# Run the read-only fixture suite
pnpm test

# Validate the workflow
pnpm dlx codemod@latest workflow validate -w .

# Type-check the codemod
pnpm run check-types

# Publish to registry
pnpm dlx codemod@latest login
pnpm dlx codemod@latest publish

The fixture suite keeps input.json and expected.json identical because the codemod is analysis-only; verification focuses on successful parsing, read-only behavior, and spec-specific scenario coverage.

License

MIT