@docker-doctor/cli 0.4.4 → 0.5.1

package/dist/index.d.mts

@@ -45,7 +45,9 @@ interface DockerDoctorConfig {
 }
 //#endregion
 //#region ../core/src/project-info/discover.d.ts
-declare const discoverProject: (rootDir: string) => Promise<ProjectInfo>;
+declare const discoverProject: (rootDir: string, options?: {
+  ignoreFiles?: readonly string[];
+}) => Promise<ProjectInfo>;
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.d.ts
 declare const parseDockerfile: (content: string) => DockerfileInstruction[];

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-CvOv-hL3.mjs";
+import { a as runDockerfileRules, d as discoverProject, f as version$1, i as runComposeRules, l as parseCompose, n as calculateScore, o as allRules, r as loadConfig, s as findRule, t as toJsonReport, u as parseDockerfile } from "./src-NqSwkGiS.mjs";
 
 //#region ../core/src/config/define-config.ts
 const defineConfig = (config) => config;

package/dist/{src-DwuAaQcq.cjs → src-DYLANvt2.cjs}

@@ -33,7 +33,59 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.4.4";
+var version = "0.5.1";
+
+//#endregion
+//#region ../core/src/project-info/ignore.ts
+const GLOB_SPECIALS_RE = /[.+^${}()|[\]\\]/gu;
+/**
+* Compiles one glob pattern from `ignore.files` to a RegExp over
+* POSIX-style relative paths. Supported syntax is the subset the docs
+* promise: `**` crosses directory separators (`**` followed by `/` matches
+* zero or more whole segments), `*` and `?` stay within one segment.
+* Brace expansion and character classes are not supported.
+*/
+const globToRegExp = (pattern) => {
+	let source = "^";
+	let index = 0;
+	while (index < pattern.length) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				if (pattern[index + 2] === "/") {
+					source += "(?:[^/]*/)*";
+					index += 3;
+				} else {
+					source += ".*";
+					index += 2;
+				}
+			} else {
+				source += "[^/]*";
+				index += 1;
+			}
+		} else if (char === "?") {
+			source += "[^/]";
+			index += 1;
+		} else {
+			source += char.replace(GLOB_SPECIALS_RE, String.raw`\$&`);
+			index += 1;
+		}
+	}
+	return new RegExp(`${source}$`, "u");
+};
+/**
+* Builds a predicate over root-relative paths from `ignore.files`
+* patterns. Windows separators in the tested path are normalized to `/`
+* before matching, so patterns are always written POSIX-style.
+*/
+const createIgnoreMatcher = (patterns) => {
+	if (!patterns || patterns.length === 0) return () => false;
+	const regexps = patterns.map(globToRegExp);
+	return (relativePath) => {
+		const normalized = relativePath.replaceAll("\\", "/");
+		return regexps.some((regexp) => regexp.test(normalized));
+	};
+};
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -48,16 +100,19 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
-const discoverProject = async (rootDir) => {
+const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
+	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
+		const relative = node_path.default.relative(rootDir, file);
+		if (isIgnored(relative)) continue;
 		const base = node_path.default.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(node_path.default.relative(rootDir, file));
-		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(node_path.default.relative(rootDir, file));
-		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(node_path.default.relative(rootDir, file));
+		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
+		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
 	return {
 		composeFiles: composeFiles.toSorted(),
@@ -291,6 +346,33 @@ const parseImageRef = (ref) => {
 		tag
 	};
 };
+/**
+* Docker Hardened Images (free catalog since Dec 2025) are pulled from the
+* dhi.io registry. Enterprise mirrors live under a plain Docker Hub org
+* namespace and cannot be recognized from the ref alone, so they keep the
+* default rule behavior.
+*/
+const isHardenedImage = (imagePart) => imagePart.toLowerCase().startsWith("dhi.io/");
+/**
+* DHI runtime variants ship no shell or package manager and run as a
+* nonroot user by default. The `-dev` variants keep a shell for build
+* stages and are not assumed to be nonroot.
+*/
+const isHardenedRuntimeImage = (imagePart) => {
+	if (!isHardenedImage(imagePart)) return false;
+	const { tag } = parseImageRef(imagePart);
+	return !(tag === "dev" || tag?.endsWith("-dev"));
+};
+/**
+* Why a reference would resolve differently over time: no tag at all, or
+* the mutable `latest` tag without a digest. `undefined` means the ref is
+* pinned. Shared by every pinning rule (base images, service images,
+* models) so they agree on what counts as pinned.
+*/
+const mutableRefIssue = (ref) => {
+	if (!(ref.tag || ref.digest)) return "untagged";
+	if (ref.tag === "latest" && !ref.digest) return "latest";
+};
 const parseFromArgs = (args) => {
 	const parts = args.split(/\s+/u).filter(Boolean);
 	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
@@ -509,6 +591,25 @@ const bestPracticesRules = [
 	useraddNoLogInit
 ];
 
+//#endregion
+//#region ../core/src/rules/compose-services.ts
+/**
+* Narrows an unknown compose document to its service entries. A service
+* with a null body (`web:` with nothing under it) is returned as an empty
+* config so rules still check it: it is the least-configured service in
+* the file, not a service to skip. Scalar and array bodies are invalid
+* compose and are dropped.
+*/
+const composeServices = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
+	const { services } = composeContent;
+	if (!services || typeof services !== "object") return [];
+	const entries = [];
+	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
+	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
+	return entries;
+};
+
 //#endregion
 //#region ../core/src/rules/compose.ts
 const noVersionKey = {
@@ -526,14 +627,11 @@ const requireResourceLimits = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const limits = (config.deploy?.resources)?.limits;
+			const hasDeployLimits = Boolean(limits?.cpus || limits?.memory);
+			const hasServiceLevelLimits = Boolean(config.mem_limit || config.cpus || config.cpu_quota);
+			if (!(hasDeployLimits || hasServiceLevelLimits)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -546,15 +644,10 @@ const requireRestartPolicy = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const hasRestart = "restart" in config;
-					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const hasRestart = "restart" in config;
+			const hasDeployRestart = config.deploy?.restart_policy !== void 0;
+			if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -567,18 +660,13 @@ const useDependsOnCondition = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
-						"services",
-						name,
-						"depends_on"
-					]) ?? context?.locate?.(["services", name])));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const dependsOn = config.depends_on;
+			if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"depends_on"
+			]) ?? context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -587,11 +675,281 @@ const useDependsOnCondition = {
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
+const pinServiceImage = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { image } = config;
+			if (typeof image !== "string" || "build" in config) continue;
+			const ref = parseImageRef(image);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `Service '${name}' image '${image}' does not specify a tag.` : `Service '${name}' image '${image}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch a different image.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"image"
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the image to a specific tag or digest (e.g. `nginx:1.27-alpine`) so deploys are reproducible and a rollback actually rolls back.",
+	key: "docker-doctor/pin-service-image",
+	message: "Pin service images to a specific tag or digest"
+};
 const composeRules = [
 	noVersionKey,
 	requireResourceLimits,
 	requireRestartPolicy,
-	useDependsOnCondition
+	useDependsOnCondition,
+	pinServiceImage
+];
+
+//#endregion
+//#region ../core/src/rules/compose-models.ts
+/**
+* Narrows an unknown compose document to its top-level `models:` entries
+* (Docker Model Runner, Compose ≥ 2.35).
+*/
+const topLevelModels = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("models" in composeContent)) return {};
+	const { models } = composeContent;
+	if (!models || typeof models !== "object" || Array.isArray(models)) return {};
+	return models;
+};
+const undefinedModelReference = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const defined = new Set(Object.keys(topLevelModels(composeContent)));
+		const flag = (serviceName, modelName, pathTail) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${serviceName}' references model '${modelName}', which is not declared in the top-level models section. Compose cannot resolve it.`, this.help, context?.locate?.([
+				"services",
+				serviceName,
+				"models",
+				pathTail
+			])));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { models } = config;
+			if (Array.isArray(models)) {
+				for (const [index, entry] of models.entries()) if (typeof entry === "string" && !defined.has(entry)) flag(name, entry, index);
+			} else if (models && typeof models === "object") {
+				for (const modelName of Object.keys(models)) if (!defined.has(modelName)) flag(name, modelName, modelName);
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Every name under a service's `models:` must match an entry in the top-level `models:` element. Declare the model there (with its `model:` OCI artifact) or fix the reference.",
+	key: "docker-doctor/undefined-model-reference",
+	message: "Service model references must be declared in top-level models"
+};
+const collectModelBindings = (composeContent) => {
+	const bindings = [];
+	for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
+		if (!config || typeof config !== "object") continue;
+		const { model } = config;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"models",
+				name,
+				"model"
+			],
+			subject: `Model '${name}' artifact`
+		});
+	}
+	for (const [name, config] of composeServices(composeContent)) {
+		const { provider } = config;
+		if (!provider || typeof provider !== "object") continue;
+		const { type, options } = provider;
+		if (type !== "model" || !options || typeof options !== "object") continue;
+		const { model } = options;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"services",
+				name,
+				"provider",
+				"options",
+				"model"
+			],
+			subject: `Service '${name}' model provider`
+		});
+	}
+	return bindings;
+};
+const pinModelVersion = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const { subject, model, path } of collectModelBindings(composeContent)) {
+			const ref = parseImageRef(model);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `${subject} '${model}' does not specify a tag.` : `${subject} '${model}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.(path)));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the model to a specific tag (e.g. `ai/gemma3:4B-Q4_0`) so every environment runs the same weights. Model behavior differences are far harder to debug than software version drift.",
+	key: "docker-doctor/pin-model-version",
+	message: "Pin models to a specific tag or digest"
+};
+const composeModelRules = [undefinedModelReference, pinModelVersion];
+
+//#endregion
+//#region ../core/src/rules/secret-keywords.ts
+const SECRET_KEY_PATTERNS = [
+	/password(?:[_-]|$)/iu,
+	/(?:^|[_-])secret(?:[_-]|$)/iu,
+	/(?:^|[_-])token(?:[_-]|$)/iu,
+	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])apikey(?:[_-]|$)/iu,
+	/(?:^|[_-])private_key(?:[_-]|$)/iu,
+	/(?:^|[_-])auth(?:[_-]|$)/iu,
+	/(?:^|[_-])pat(?:[_-]|$)/iu
+];
+const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
+
+//#endregion
+//#region ../core/src/rules/compose-security.ts
+const noPrivilegedService = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+			"services",
+			name,
+			"privileged"
+		])));
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
+	key: "docker-doctor/no-privileged-service",
+	message: "Do not run services in privileged mode"
+};
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const isDockerSocketPath = (rawPath) => {
+	const normalized = rawPath.replaceAll("\\", "/");
+	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
+};
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target] = splitShortSyntax(volume);
+		return target === void 0 ? void 0 : {
+			source,
+			target
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { source, target } = volume;
+		return {
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0
+		};
+	}
+};
+const mountsDockerSocket = (volume) => {
+	const mount = volumeMount(volume);
+	if (!mount?.source) return false;
+	const resolvedSource = resolveInterpolationDefaults(mount.source);
+	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
+	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const noDockerSocketMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"volumes",
+				index
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "If the service genuinely needs the Docker API (agent tooling like MCP gateways often does), prefer `use_api_socket: true` or a filtering socket proxy over a raw bind mount of `/var/run/docker.sock`.",
+	key: "docker-doctor/no-docker-socket-mount",
+	message: "Do not bind-mount the Docker socket into services"
+};
+const noPlaintextSecrets = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const flag = (name, key, line) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret in service '${name}' environment: '${key}'. A literal value here lives in version control in plain text.`, this.help, line));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { environment } = config;
+			if (Array.isArray(environment)) for (const [index, entry] of environment.entries()) {
+				if (typeof entry !== "string") continue;
+				const eqIndex = entry.indexOf("=");
+				if (eqIndex <= 0) continue;
+				const key = entry.slice(0, eqIndex);
+				const value = entry.slice(eqIndex + 1);
+				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					index
+				]));
+			}
+			else if (environment && typeof environment === "object") {
+				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					key
+				]));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Move the value to an `env_file` kept out of version control, interpolate it from the host environment (`${VAR}`), or use Compose `secrets:`.",
+	key: "docker-doctor/no-plaintext-secrets",
+	message: "Avoid literal secret values in Compose environment"
+};
+const composeSecurityRules = [
+	noPrivilegedService,
+	noDockerSocketMount,
+	noPlaintextSecrets
 ];
 
 //#endregion
@@ -606,6 +964,7 @@ const preferSlimBase = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
+			if (isHardenedImage(imagePart)) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
@@ -792,7 +1151,8 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
+			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
 			if (currentStage) stageUser.set(currentStage, lastUser);
@@ -813,21 +1173,13 @@ const noSecretsInEnv = {
 	category: "Security",
 	check(instructions, file) {
 		const diagnostics = [];
-		const secretKeywords = [
-			/(?:^|[_-])password(?:[_-]|$)/iu,
-			/(?:^|[_-])secret(?:[_-]|$)/iu,
-			/(?:^|[_-])token(?:[_-]|$)/iu,
-			/(?:^|[_-])api_key(?:[_-]|$)/iu,
-			/(?:^|[_-])private_key(?:[_-]|$)/iu,
-			/(?:^|[_-])auth(?:[_-]|$)/iu
-		];
 		for (const inst of instructions) if (inst.instruction === "ENV" || inst.instruction === "ARG") {
 			const args = inst.args.trim();
 			if (inst.instruction === "ENV" && !args.includes("=")) {
 				const match = args.match(/^(?<key>[^\s]+)\s+(?<value>.*)$/u);
 				if (match?.groups) {
 					const { key, value } = match.groups;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			} else {
 				const parts = args.split(/\s+/u);
@@ -839,7 +1191,7 @@ const noSecretsInEnv = {
 						key = part.slice(0, eqIndex);
 						value = part.slice(eqIndex + 1);
 					} else key = part;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			}
 		}
@@ -860,8 +1212,11 @@ const pinImageVersion = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
-			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
-			else if (ref.tag === "latest" && !ref.digest) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
+			const issue = mutableRefIssue(ref);
+			if (issue) {
+				const detail = issue === "untagged" ? `Base image '${imagePart}' does not specify a tag.` : `Base image '${imagePart}' uses the mutable 'latest' tag.`;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} This makes builds non-deterministic.`, this.help, inst.line));
+			}
 		}
 		return diagnostics;
 	},
@@ -901,7 +1256,11 @@ const allDockerfileRules = [
 	...bestPracticesRules,
 	...imageSizeRules
 ];
-const allComposeRules = [...composeRules];
+const allComposeRules = [
+	...composeRules,
+	...composeSecurityRules,
+	...composeModelRules
+];
 const allRules = [...allDockerfileRules, ...allComposeRules];
 const findRule = (key) => allRules.find((rule) => rule.key === key);
 
@@ -1239,4 +1598,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-DwuAaQcq.cjs.map
+//# sourceMappingURL=src-DYLANvt2.cjs.map