@docker-doctor/cli 0.4.4 → 0.5.1

package/dist/{src-CvOv-hL3.mjs → src-NqSwkGiS.mjs}

@@ -4,7 +4,59 @@ import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.4.4";
+var version = "0.5.1";
+
+//#endregion
+//#region ../core/src/project-info/ignore.ts
+const GLOB_SPECIALS_RE = /[.+^${}()|[\]\\]/gu;
+/**
+* Compiles one glob pattern from `ignore.files` to a RegExp over
+* POSIX-style relative paths. Supported syntax is the subset the docs
+* promise: `**` crosses directory separators (`**` followed by `/` matches
+* zero or more whole segments), `*` and `?` stay within one segment.
+* Brace expansion and character classes are not supported.
+*/
+const globToRegExp = (pattern) => {
+	let source = "^";
+	let index = 0;
+	while (index < pattern.length) {
+		const char = pattern[index];
+		if (char === "*") {
+			if (pattern[index + 1] === "*") {
+				if (pattern[index + 2] === "/") {
+					source += "(?:[^/]*/)*";
+					index += 3;
+				} else {
+					source += ".*";
+					index += 2;
+				}
+			} else {
+				source += "[^/]*";
+				index += 1;
+			}
+		} else if (char === "?") {
+			source += "[^/]";
+			index += 1;
+		} else {
+			source += char.replace(GLOB_SPECIALS_RE, String.raw`\$&`);
+			index += 1;
+		}
+	}
+	return new RegExp(`${source}$`, "u");
+};
+/**
+* Builds a predicate over root-relative paths from `ignore.files`
+* patterns. Windows separators in the tested path are normalized to `/`
+* before matching, so patterns are always written POSIX-style.
+*/
+const createIgnoreMatcher = (patterns) => {
+	if (!patterns || patterns.length === 0) return () => false;
+	const regexps = patterns.map(globToRegExp);
+	return (relativePath) => {
+		const normalized = relativePath.replaceAll("\\", "/");
+		return regexps.some((regexp) => regexp.test(normalized));
+	};
+};
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -19,16 +71,19 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
-const discoverProject = async (rootDir) => {
+const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
+	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
+		const relative = path.relative(rootDir, file);
+		if (isIgnored(relative)) continue;
 		const base = path.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(path.relative(rootDir, file));
-		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(path.relative(rootDir, file));
-		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(path.relative(rootDir, file));
+		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
+		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
 	return {
 		composeFiles: composeFiles.toSorted(),
@@ -262,6 +317,33 @@ const parseImageRef = (ref) => {
 		tag
 	};
 };
+/**
+* Docker Hardened Images (free catalog since Dec 2025) are pulled from the
+* dhi.io registry. Enterprise mirrors live under a plain Docker Hub org
+* namespace and cannot be recognized from the ref alone, so they keep the
+* default rule behavior.
+*/
+const isHardenedImage = (imagePart) => imagePart.toLowerCase().startsWith("dhi.io/");
+/**
+* DHI runtime variants ship no shell or package manager and run as a
+* nonroot user by default. The `-dev` variants keep a shell for build
+* stages and are not assumed to be nonroot.
+*/
+const isHardenedRuntimeImage = (imagePart) => {
+	if (!isHardenedImage(imagePart)) return false;
+	const { tag } = parseImageRef(imagePart);
+	return !(tag === "dev" || tag?.endsWith("-dev"));
+};
+/**
+* Why a reference would resolve differently over time: no tag at all, or
+* the mutable `latest` tag without a digest. `undefined` means the ref is
+* pinned. Shared by every pinning rule (base images, service images,
+* models) so they agree on what counts as pinned.
+*/
+const mutableRefIssue = (ref) => {
+	if (!(ref.tag || ref.digest)) return "untagged";
+	if (ref.tag === "latest" && !ref.digest) return "latest";
+};
 const parseFromArgs = (args) => {
 	const parts = args.split(/\s+/u).filter(Boolean);
 	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
@@ -480,6 +562,25 @@ const bestPracticesRules = [
 	useraddNoLogInit
 ];
 
+//#endregion
+//#region ../core/src/rules/compose-services.ts
+/**
+* Narrows an unknown compose document to its service entries. A service
+* with a null body (`web:` with nothing under it) is returned as an empty
+* config so rules still check it: it is the least-configured service in
+* the file, not a service to skip. Scalar and array bodies are invalid
+* compose and are dropped.
+*/
+const composeServices = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
+	const { services } = composeContent;
+	if (!services || typeof services !== "object") return [];
+	const entries = [];
+	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
+	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
+	return entries;
+};
+
 //#endregion
 //#region ../core/src/rules/compose.ts
 const noVersionKey = {
@@ -497,14 +598,11 @@ const requireResourceLimits = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const limits = (config.deploy?.resources)?.limits;
-					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const limits = (config.deploy?.resources)?.limits;
+			const hasDeployLimits = Boolean(limits?.cpus || limits?.memory);
+			const hasServiceLevelLimits = Boolean(config.mem_limit || config.cpus || config.cpu_quota);
+			if (!(hasDeployLimits || hasServiceLevelLimits)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -517,15 +615,10 @@ const requireRestartPolicy = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const hasRestart = "restart" in config;
-					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
-					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const hasRestart = "restart" in config;
+			const hasDeployRestart = config.deploy?.restart_policy !== void 0;
+			if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help, context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -538,18 +631,13 @@ const useDependsOnCondition = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
-			const { services } = composeContent;
-			if (services && typeof services === "object") {
-				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
-					const dependsOn = config.depends_on;
-					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
-						"services",
-						name,
-						"depends_on"
-					]) ?? context?.locate?.(["services", name])));
-				}
-			}
+		for (const [name, config] of composeServices(composeContent)) {
+			const dependsOn = config.depends_on;
+			if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"depends_on"
+			]) ?? context?.locate?.(["services", name])));
 		}
 		return diagnostics;
 	},
@@ -558,11 +646,281 @@ const useDependsOnCondition = {
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
+const pinServiceImage = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { image } = config;
+			if (typeof image !== "string" || "build" in config) continue;
+			const ref = parseImageRef(image);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `Service '${name}' image '${image}' does not specify a tag.` : `Service '${name}' image '${image}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch a different image.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"image"
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the image to a specific tag or digest (e.g. `nginx:1.27-alpine`) so deploys are reproducible and a rollback actually rolls back.",
+	key: "docker-doctor/pin-service-image",
+	message: "Pin service images to a specific tag or digest"
+};
 const composeRules = [
 	noVersionKey,
 	requireResourceLimits,
 	requireRestartPolicy,
-	useDependsOnCondition
+	useDependsOnCondition,
+	pinServiceImage
+];
+
+//#endregion
+//#region ../core/src/rules/compose-models.ts
+/**
+* Narrows an unknown compose document to its top-level `models:` entries
+* (Docker Model Runner, Compose ≥ 2.35).
+*/
+const topLevelModels = (composeContent) => {
+	if (!composeContent || typeof composeContent !== "object" || !("models" in composeContent)) return {};
+	const { models } = composeContent;
+	if (!models || typeof models !== "object" || Array.isArray(models)) return {};
+	return models;
+};
+const undefinedModelReference = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const defined = new Set(Object.keys(topLevelModels(composeContent)));
+		const flag = (serviceName, modelName, pathTail) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${serviceName}' references model '${modelName}', which is not declared in the top-level models section. Compose cannot resolve it.`, this.help, context?.locate?.([
+				"services",
+				serviceName,
+				"models",
+				pathTail
+			])));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { models } = config;
+			if (Array.isArray(models)) {
+				for (const [index, entry] of models.entries()) if (typeof entry === "string" && !defined.has(entry)) flag(name, entry, index);
+			} else if (models && typeof models === "object") {
+				for (const modelName of Object.keys(models)) if (!defined.has(modelName)) flag(name, modelName, modelName);
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Every name under a service's `models:` must match an entry in the top-level `models:` element. Declare the model there (with its `model:` OCI artifact) or fix the reference.",
+	key: "docker-doctor/undefined-model-reference",
+	message: "Service model references must be declared in top-level models"
+};
+const collectModelBindings = (composeContent) => {
+	const bindings = [];
+	for (const [name, config] of Object.entries(topLevelModels(composeContent))) {
+		if (!config || typeof config !== "object") continue;
+		const { model } = config;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"models",
+				name,
+				"model"
+			],
+			subject: `Model '${name}' artifact`
+		});
+	}
+	for (const [name, config] of composeServices(composeContent)) {
+		const { provider } = config;
+		if (!provider || typeof provider !== "object") continue;
+		const { type, options } = provider;
+		if (type !== "model" || !options || typeof options !== "object") continue;
+		const { model } = options;
+		if (typeof model === "string") bindings.push({
+			model,
+			path: [
+				"services",
+				name,
+				"provider",
+				"options",
+				"model"
+			],
+			subject: `Service '${name}' model provider`
+		});
+	}
+	return bindings;
+};
+const pinModelVersion = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const { subject, model, path } of collectModelBindings(composeContent)) {
+			const ref = parseImageRef(model);
+			if (ref.isVariable) continue;
+			const issue = mutableRefIssue(ref);
+			if (!issue) continue;
+			const detail = issue === "untagged" ? `${subject} '${model}' does not specify a tag.` : `${subject} '${model}' uses the mutable 'latest' tag.`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} Every pull may fetch different weights.`, this.help, context?.locate?.(path)));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pin the model to a specific tag (e.g. `ai/gemma3:4B-Q4_0`) so every environment runs the same weights. Model behavior differences are far harder to debug than software version drift.",
+	key: "docker-doctor/pin-model-version",
+	message: "Pin models to a specific tag or digest"
+};
+const composeModelRules = [undefinedModelReference, pinModelVersion];
+
+//#endregion
+//#region ../core/src/rules/secret-keywords.ts
+const SECRET_KEY_PATTERNS = [
+	/password(?:[_-]|$)/iu,
+	/(?:^|[_-])secret(?:[_-]|$)/iu,
+	/(?:^|[_-])token(?:[_-]|$)/iu,
+	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])apikey(?:[_-]|$)/iu,
+	/(?:^|[_-])private_key(?:[_-]|$)/iu,
+	/(?:^|[_-])auth(?:[_-]|$)/iu,
+	/(?:^|[_-])pat(?:[_-]|$)/iu
+];
+const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
+
+//#endregion
+//#region ../core/src/rules/compose-security.ts
+const noPrivilegedService = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+			"services",
+			name,
+			"privileged"
+		])));
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
+	key: "docker-doctor/no-privileged-service",
+	message: "Do not run services in privileged mode"
+};
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
+const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
+const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
+const isDockerSocketPath = (rawPath) => {
+	const normalized = rawPath.replaceAll("\\", "/");
+	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
+};
+const splitShortSyntax = (spec) => {
+	const parts = [];
+	let depth = 0;
+	let current = "";
+	for (const char of spec) {
+		if (char === "{") depth += 1;
+		else if (char === "}") depth = Math.max(0, depth - 1);
+		if (char === ":" && depth === 0) {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += char;
+	}
+	parts.push(current);
+	return parts;
+};
+const volumeMount = (volume) => {
+	if (typeof volume === "string") {
+		const [source, target] = splitShortSyntax(volume);
+		return target === void 0 ? void 0 : {
+			source,
+			target
+		};
+	}
+	if (volume && typeof volume === "object") {
+		const { source, target } = volume;
+		return {
+			source: typeof source === "string" ? source : void 0,
+			target: typeof target === "string" ? target : void 0
+		};
+	}
+};
+const mountsDockerSocket = (volume) => {
+	const mount = volumeMount(volume);
+	if (!mount?.source) return false;
+	const resolvedSource = resolveInterpolationDefaults(mount.source);
+	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
+	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const noDockerSocketMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+				"services",
+				name,
+				"volumes",
+				index
+			])));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "If the service genuinely needs the Docker API (agent tooling like MCP gateways often does), prefer `use_api_socket: true` or a filtering socket proxy over a raw bind mount of `/var/run/docker.sock`.",
+	key: "docker-doctor/no-docker-socket-mount",
+	message: "Do not bind-mount the Docker socket into services"
+};
+const noPlaintextSecrets = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		const flag = (name, key, line) => {
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret in service '${name}' environment: '${key}'. A literal value here lives in version control in plain text.`, this.help, line));
+		};
+		for (const [name, config] of composeServices(composeContent)) {
+			const { environment } = config;
+			if (Array.isArray(environment)) for (const [index, entry] of environment.entries()) {
+				if (typeof entry !== "string") continue;
+				const eqIndex = entry.indexOf("=");
+				if (eqIndex <= 0) continue;
+				const key = entry.slice(0, eqIndex);
+				const value = entry.slice(eqIndex + 1);
+				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					index
+				]));
+			}
+			else if (environment && typeof environment === "object") {
+				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+					"services",
+					name,
+					"environment",
+					key
+				]));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Move the value to an `env_file` kept out of version control, interpolate it from the host environment (`${VAR}`), or use Compose `secrets:`.",
+	key: "docker-doctor/no-plaintext-secrets",
+	message: "Avoid literal secret values in Compose environment"
+};
+const composeSecurityRules = [
+	noPrivilegedService,
+	noDockerSocketMount,
+	noPlaintextSecrets
 ];
 
 //#endregion
@@ -577,6 +935,7 @@ const preferSlimBase = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
+			if (isHardenedImage(imagePart)) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
@@ -763,7 +1122,8 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
+			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
 			if (currentStage) stageUser.set(currentStage, lastUser);
@@ -784,21 +1144,13 @@ const noSecretsInEnv = {
 	category: "Security",
 	check(instructions, file) {
 		const diagnostics = [];
-		const secretKeywords = [
-			/(?:^|[_-])password(?:[_-]|$)/iu,
-			/(?:^|[_-])secret(?:[_-]|$)/iu,
-			/(?:^|[_-])token(?:[_-]|$)/iu,
-			/(?:^|[_-])api_key(?:[_-]|$)/iu,
-			/(?:^|[_-])private_key(?:[_-]|$)/iu,
-			/(?:^|[_-])auth(?:[_-]|$)/iu
-		];
 		for (const inst of instructions) if (inst.instruction === "ENV" || inst.instruction === "ARG") {
 			const args = inst.args.trim();
 			if (inst.instruction === "ENV" && !args.includes("=")) {
 				const match = args.match(/^(?<key>[^\s]+)\s+(?<value>.*)$/u);
 				if (match?.groups) {
 					const { key, value } = match.groups;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			} else {
 				const parts = args.split(/\s+/u);
@@ -810,7 +1162,7 @@ const noSecretsInEnv = {
 						key = part.slice(0, eqIndex);
 						value = part.slice(eqIndex + 1);
 					} else key = part;
-					if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+					if (isSecretKey(key) && isLiteralSecretValue(value) && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
 				}
 			}
 		}
@@ -831,8 +1183,11 @@ const pinImageVersion = {
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
-			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
-			else if (ref.tag === "latest" && !ref.digest) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
+			const issue = mutableRefIssue(ref);
+			if (issue) {
+				const detail = issue === "untagged" ? `Base image '${imagePart}' does not specify a tag.` : `Base image '${imagePart}' uses the mutable 'latest' tag.`;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `${detail} This makes builds non-deterministic.`, this.help, inst.line));
+			}
 		}
 		return diagnostics;
 	},
@@ -872,7 +1227,11 @@ const allDockerfileRules = [
 	...bestPracticesRules,
 	...imageSizeRules
 ];
-const allComposeRules = [...composeRules];
+const allComposeRules = [
+	...composeRules,
+	...composeSecurityRules,
+	...composeModelRules
+];
 const allRules = [...allDockerfileRules, ...allComposeRules];
 const findRule = (key) => allRules.find((rule) => rule.key === key);
 
@@ -1133,4 +1492,4 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-CvOv-hL3.mjs.map
+//# sourceMappingURL=src-NqSwkGiS.mjs.map