@docker-doctor/cli 0.4.3 → 0.4.4

package/dist/index.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_src = require('./src-ILbJuJmE.cjs');
+const require_src = require('./src-DwuAaQcq.cjs');
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/index.d.cts

@@ -6,10 +6,11 @@ interface DockerfileInstruction {
   line: number;
   raw: string;
 }
+type DiagnosticSeverity = "error" | "warning" | "info";
 interface Diagnostic {
   file: string;
   rule: string;
-  severity: "error" | "warning" | "info";
+  severity: DiagnosticSeverity;
   message: string;
   help: string;
   line?: number;
@@ -21,14 +22,20 @@ interface ProjectInfo {
   dockerignores?: string[];
 }
 type RuleCategory = "Security" | "Performance" | "Best Practices" | "Compose" | "Image Size";
-type RuleSeverity = "error" | "warning" | "info" | "off";
+type RuleSeverity = DiagnosticSeverity | "off";
 interface RuleDefinition {
   key: string;
   category: RuleCategory;
-  defaultSeverity: RuleSeverity;
+  defaultSeverity: DiagnosticSeverity;
   message: string;
   help: string;
 }
+/**
+ * Maps a path of YAML keys/indices (e.g. `["services", "web"]`) to the
+ * 1-based line where that key is defined, or `undefined` when the path does
+ * not resolve to a concrete node in the source document.
+ */
+type ComposeLocator = (path: readonly (string | number)[]) => number | undefined;
 interface DockerDoctorConfig {
   rules?: Record<string, RuleSeverity>;
   categories?: Partial<Record<RuleCategory, RuleSeverity>>;
@@ -50,7 +57,7 @@ declare const parseCompose: (content: string, filepath: string) => unknown;
 declare const runDockerfileRules: (instructions: DockerfileInstruction[], file: string, projectFiles: string[], rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
 //#endregion
 //#region ../core/src/runners/compose-runner.d.ts
-declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
+declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>, locate?: ComposeLocator) => Diagnostic[];
 //#endregion
 //#region ../core/src/rules/index.d.ts
 declare const allRules: RuleDefinition[];

package/dist/index.d.mts

@@ -6,10 +6,11 @@ interface DockerfileInstruction {
   line: number;
   raw: string;
 }
+type DiagnosticSeverity = "error" | "warning" | "info";
 interface Diagnostic {
   file: string;
   rule: string;
-  severity: "error" | "warning" | "info";
+  severity: DiagnosticSeverity;
   message: string;
   help: string;
   line?: number;
@@ -21,14 +22,20 @@ interface ProjectInfo {
   dockerignores?: string[];
 }
 type RuleCategory = "Security" | "Performance" | "Best Practices" | "Compose" | "Image Size";
-type RuleSeverity = "error" | "warning" | "info" | "off";
+type RuleSeverity = DiagnosticSeverity | "off";
 interface RuleDefinition {
   key: string;
   category: RuleCategory;
-  defaultSeverity: RuleSeverity;
+  defaultSeverity: DiagnosticSeverity;
   message: string;
   help: string;
 }
+/**
+ * Maps a path of YAML keys/indices (e.g. `["services", "web"]`) to the
+ * 1-based line where that key is defined, or `undefined` when the path does
+ * not resolve to a concrete node in the source document.
+ */
+type ComposeLocator = (path: readonly (string | number)[]) => number | undefined;
 interface DockerDoctorConfig {
   rules?: Record<string, RuleSeverity>;
   categories?: Partial<Record<RuleCategory, RuleSeverity>>;
@@ -50,7 +57,7 @@ declare const parseCompose: (content: string, filepath: string) => unknown;
 declare const runDockerfileRules: (instructions: DockerfileInstruction[], file: string, projectFiles: string[], rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
 //#endregion
 //#region ../core/src/runners/compose-runner.d.ts
-declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>) => Diagnostic[];
+declare const runComposeRules: (composeContent: unknown, file: string, rulesConfig?: Record<string, RuleSeverity>, categoriesConfig?: Record<string, RuleSeverity>, locate?: ComposeLocator) => Diagnostic[];
 //#endregion
 //#region ../core/src/rules/index.d.ts
 declare const allRules: RuleDefinition[];

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runDockerfileRules, c as parseCompose, d as version$1, i as runComposeRules, l as parseDockerfile, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as discoverProject } from "./src-TK9DRoRo.mjs";
+import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-CvOv-hL3.mjs";
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/{src-TK9DRoRo.mjs → src-CvOv-hL3.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import fs from "node:fs/promises";
 import path from "node:path";
-import { parse } from "yaml";
+import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.4.3";
+var version = "0.4.4";
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -107,7 +107,6 @@ const processHeredocLine = (state, trimmed) => {
 };
 const processInstructionLine = (state, trimmed, lineNum) => {
 	let lineContent = trimmed;
-	if (lineContent.startsWith("#")) return;
 	const hasContinuation = lineContent.endsWith("\\");
 	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
 	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
@@ -130,7 +129,8 @@ const parseDockerfile = (content) => {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
-		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		if (!insideHeredoc && trimmed.startsWith("#")) continue;
+		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -173,6 +173,40 @@ const parseCompose = (content, filepath) => {
 		});
 	}
 };
+/**
+* Builds a {@link ComposeLocator} over the same source text a compose object
+* was parsed from, so rules can attach line numbers to their diagnostics.
+*
+* Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node
+* at the merge site, so paths through them resolve to `undefined` — callers
+* fall back to an unnumbered diagnostic, which matches the old behavior.
+*/
+const createComposeLocator = (content) => {
+	const lineCounter = new LineCounter();
+	const doc = parseDocument(content, {
+		lineCounter,
+		merge: true
+	});
+	return (path) => {
+		let node = doc.contents;
+		let offset;
+		for (const segment of path) {
+			if (isAlias(node)) node = node.resolve(doc);
+			if (isMap(node)) {
+				const pair = node.items.find((item) => isScalar(item.key) && String(item.key.value) === String(segment));
+				if (!pair || !isScalar(pair.key)) return;
+				offset = pair.key.range?.[0];
+				node = pair.value;
+			} else if (isSeq(node) && typeof segment === "number") {
+				const item = node.items[segment];
+				if (item === void 0 || item === null) return;
+				offset = item.range?.[0];
+				node = item;
+			} else return;
+		}
+		return offset === void 0 ? void 0 : lineCounter.linePos(offset).line;
+	};
+};
 
 //#endregion
 //#region ../core/src/parsers/exec-form.ts
@@ -248,8 +282,8 @@ const collectStageAliases = (instructions) => {
 };
 
 //#endregion
-//#region ../core/src/rules/best-practices.ts
-const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+//#region ../core/src/rules/create-diagnostic.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	file,
 	help,
 	line,
@@ -257,12 +291,15 @@ const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
 		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
-		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -279,7 +316,7 @@ const preferCopyOverAdd = {
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
-			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -292,7 +329,7 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -303,7 +340,7 @@ const useExecForm = {
 const requireLabels = {
 	category: "Best Practices",
 	check(instructions, file) {
-		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -318,8 +355,8 @@ const combineAptUpdateInstall = {
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const hasUpdate = inst.args.includes("apt-get update");
 			const hasInstall = inst.args.includes("apt-get install");
-			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
-			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -359,7 +396,7 @@ const usePipefail = {
 			const { args } = inst;
 			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
-			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -374,7 +411,7 @@ const absoluteWorkdir = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
 			const path = inst.args.trim();
-			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -387,7 +424,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -407,7 +444,7 @@ const sortMultilineArgs = {
 				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
 				if (packages.length > 1) {
 					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
-					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
 		}
@@ -422,7 +459,7 @@ const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -445,17 +482,10 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose.ts
-const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
-	file,
-	help,
-	message,
-	rule: ruleKey,
-	severity
-});
 const noVersionKey = {
 	category: "Compose",
-	check(composeContent, file) {
-		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+	check(composeContent, file, context) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help, context?.locate?.(["version"]))];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -465,14 +495,14 @@ const noVersionKey = {
 };
 const requireResourceLimits = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
+					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
@@ -485,7 +515,7 @@ const requireResourceLimits = {
 };
 const requireRestartPolicy = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
@@ -493,7 +523,7 @@ const requireRestartPolicy = {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const hasRestart = "restart" in config;
 					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
+					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
@@ -506,14 +536,18 @@ const requireRestartPolicy = {
 };
 const useDependsOnCondition = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
+					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+						"services",
+						name,
+						"depends_on"
+					]) ?? context?.locate?.(["services", name])));
 				}
 			}
 		}
@@ -533,14 +567,6 @@ const composeRules = [
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
-const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -554,7 +580,7 @@ const preferSlimBase = {
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -563,14 +589,20 @@ const preferSlimBase = {
 	key: "docker-doctor/prefer-slim-base",
 	message: "Prefer slim, alpine, or distroless base images"
 };
+const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
+const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
+const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
+const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
+const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
 const cleanPackageCache = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -607,7 +639,7 @@ const avoidDevDependencies = {
 			for (const inst of stage.runs) {
 				if (!installsDevDependencies(inst.args)) continue;
 				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -625,19 +657,11 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
-const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -661,7 +685,7 @@ const orderLayers = {
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
-				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -681,10 +705,10 @@ const minimizeLayers = {
 			if (consecutiveRunCount === 0) firstRunLine = inst.line;
 			consecutiveRunCount += 1;
 		} else {
-			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 			consecutiveRunCount = 0;
 		}
-		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -709,7 +733,7 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -726,14 +750,6 @@ const performanceRules = [
 
 //#endregion
 //#region ../core/src/rules/security.ts
-const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const isRootUser = (value) => {
 	const [user] = value.split(":");
 	return user === "root" || user === "0";
@@ -880,12 +896,12 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categ
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, locate) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
-		const ruleDiagnostics = rule.check(composeContent, file);
+		const ruleDiagnostics = rule.check(composeContent, file, { locate });
 		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
@@ -1116,5 +1132,5 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 });
 
 //#endregion
-export { runDockerfileRules as a, parseCompose as c, version as d, runComposeRules as i, parseDockerfile as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, discoverProject as u };
-//# sourceMappingURL=src-TK9DRoRo.mjs.map
+export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
+//# sourceMappingURL=src-CvOv-hL3.mjs.map