@docker-doctor/cli 0.4.3 → 0.4.4

package/dist/{src-ILbJuJmE.cjs → src-DwuAaQcq.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.4.3";
+var version = "0.4.4";
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -136,7 +136,6 @@ const processHeredocLine = (state, trimmed) => {
 };
 const processInstructionLine = (state, trimmed, lineNum) => {
 	let lineContent = trimmed;
-	if (lineContent.startsWith("#")) return;
 	const hasContinuation = lineContent.endsWith("\\");
 	if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
 	if (state.currentInstruction) state.currentArgs += (state.currentArgs ? " " : "") + lineContent;
@@ -159,7 +158,8 @@ const parseDockerfile = (content) => {
 		const trimmed = rawLine.trim();
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
-		if (!state.currentInstruction && !insideHeredoc && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		if (!insideHeredoc && trimmed.startsWith("#")) continue;
+		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -202,6 +202,40 @@ const parseCompose = (content, filepath) => {
 		});
 	}
 };
+/**
+* Builds a {@link ComposeLocator} over the same source text a compose object
+* was parsed from, so rules can attach line numbers to their diagnostics.
+*
+* Keys pulled in via YAML merge keys (`<<: *anchor`) have no concrete node
+* at the merge site, so paths through them resolve to `undefined` — callers
+* fall back to an unnumbered diagnostic, which matches the old behavior.
+*/
+const createComposeLocator = (content) => {
+	const lineCounter = new yaml.LineCounter();
+	const doc = (0, yaml.parseDocument)(content, {
+		lineCounter,
+		merge: true
+	});
+	return (path) => {
+		let node = doc.contents;
+		let offset;
+		for (const segment of path) {
+			if ((0, yaml.isAlias)(node)) node = node.resolve(doc);
+			if ((0, yaml.isMap)(node)) {
+				const pair = node.items.find((item) => (0, yaml.isScalar)(item.key) && String(item.key.value) === String(segment));
+				if (!pair || !(0, yaml.isScalar)(pair.key)) return;
+				offset = pair.key.range?.[0];
+				node = pair.value;
+			} else if ((0, yaml.isSeq)(node) && typeof segment === "number") {
+				const item = node.items[segment];
+				if (item === void 0 || item === null) return;
+				offset = item.range?.[0];
+				node = item;
+			} else return;
+		}
+		return offset === void 0 ? void 0 : lineCounter.linePos(offset).line;
+	};
+};
 
 //#endregion
 //#region ../core/src/parsers/exec-form.ts
@@ -277,8 +311,8 @@ const collectStageAliases = (instructions) => {
 };
 
 //#endregion
-//#region ../core/src/rules/best-practices.ts
-const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+//#region ../core/src/rules/create-diagnostic.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	file,
 	help,
 	line,
@@ -286,12 +320,15 @@ const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
 		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
-		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -308,7 +345,7 @@ const preferCopyOverAdd = {
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
 			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
-			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -321,7 +358,7 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -332,7 +369,7 @@ const useExecForm = {
 const requireLabels = {
 	category: "Best Practices",
 	check(instructions, file) {
-		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "info",
@@ -347,8 +384,8 @@ const combineAptUpdateInstall = {
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const hasUpdate = inst.args.includes("apt-get update");
 			const hasInstall = inst.args.includes("apt-get install");
-			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
-			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -388,7 +425,7 @@ const usePipefail = {
 			const { args } = inst;
 			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
-			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -403,7 +440,7 @@ const absoluteWorkdir = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
 			const path = inst.args.trim();
-			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -416,7 +453,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -436,7 +473,7 @@ const sortMultilineArgs = {
 				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
 				if (packages.length > 1) {
 					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
-					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
 		}
@@ -451,7 +488,7 @@ const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
@@ -474,17 +511,10 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose.ts
-const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
-	file,
-	help,
-	message,
-	rule: ruleKey,
-	severity
-});
 const noVersionKey = {
 	category: "Compose",
-	check(composeContent, file) {
-		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+	check(composeContent, file, context) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help, context?.locate?.(["version"]))];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -494,14 +524,14 @@ const noVersionKey = {
 };
 const requireResourceLimits = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
+					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
@@ -514,7 +544,7 @@ const requireResourceLimits = {
 };
 const requireRestartPolicy = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
@@ -522,7 +552,7 @@ const requireRestartPolicy = {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const hasRestart = "restart" in config;
 					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
+					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 				}
 			}
 		}
@@ -535,14 +565,18 @@ const requireRestartPolicy = {
 };
 const useDependsOnCondition = {
 	category: "Compose",
-	check(composeContent, file) {
+	check(composeContent, file, context) {
 		const diagnostics = [];
 		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
 			const { services } = composeContent;
 			if (services && typeof services === "object") {
 				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
 					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
+					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+						"services",
+						name,
+						"depends_on"
+					]) ?? context?.locate?.(["services", name])));
 				}
 			}
 		}
@@ -562,14 +596,6 @@ const composeRules = [
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
-const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -583,7 +609,7 @@ const preferSlimBase = {
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -592,14 +618,20 @@ const preferSlimBase = {
 	key: "docker-doctor/prefer-slim-base",
 	message: "Prefer slim, alpine, or distroless base images"
 };
+const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
+const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
+const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
+const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
+const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
 const cleanPackageCache = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -636,7 +668,7 @@ const avoidDevDependencies = {
 			for (const inst of stage.runs) {
 				if (!installsDevDependencies(inst.args)) continue;
 				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -654,19 +686,11 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
-const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -690,7 +714,7 @@ const orderLayers = {
 			}
 			if (inst.instruction === "RUN" && copyAllLine !== -1) {
 				const args = inst.args.toLowerCase();
-				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
@@ -710,10 +734,10 @@ const minimizeLayers = {
 			if (consecutiveRunCount === 0) firstRunLine = inst.line;
 			consecutiveRunCount += 1;
 		} else {
-			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 			consecutiveRunCount = 0;
 		}
-		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -738,7 +762,7 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
@@ -755,14 +779,6 @@ const performanceRules = [
 
 //#endregion
 //#region ../core/src/rules/security.ts
-const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
-	file,
-	help,
-	line,
-	message,
-	rule: ruleKey,
-	severity
-});
 const isRootUser = (value) => {
 	const [user] = value.split(":");
 	return user === "root" || user === "0";
@@ -909,12 +925,12 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categ
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, locate) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
-		const ruleDiagnostics = rule.check(composeContent, file);
+		const ruleDiagnostics = rule.check(composeContent, file, { locate });
 		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
@@ -1163,6 +1179,12 @@ Object.defineProperty(exports, 'calculateScore', {
     return calculateScore;
   }
 });
+Object.defineProperty(exports, 'createComposeLocator', {
+  enumerable: true,
+  get: function () {
+    return createComposeLocator;
+  }
+});
 Object.defineProperty(exports, 'discoverProject', {
   enumerable: true,
   get: function () {
@@ -1217,4 +1239,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-ILbJuJmE.cjs.map
+//# sourceMappingURL=src-DwuAaQcq.cjs.map