@docker-doctor/cli 0.5.1 → 0.5.2

package/dist/{src-DYLANvt2.cjs → src-D3jzc3GX.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.5.1";
+var version = "0.5.2";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -100,6 +100,7 @@ const walk = async (dir, fileList = []) => {
 	}));
 	return fileList;
 };
+const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
 const discoverProject = async (rootDir, options) => {
 	const allFiles = await walk(rootDir);
 	const dockerfiles = [];
@@ -107,10 +108,13 @@ const discoverProject = async (rootDir, options) => {
 	const dockerignores = [];
 	const isIgnored = createIgnoreMatcher(options?.ignoreFiles);
 	for (const file of allFiles) {
-		const relative = node_path.default.relative(rootDir, file);
+		const relative = toPosixRelative(rootDir, file);
 		if (isIgnored(relative)) continue;
 		const base = node_path.default.basename(file).toLowerCase();
-		if (base === ".dockerignore") dockerignores.push(relative);
+		if (base.endsWith(".dockerignore")) {
+			dockerignores.push(relative);
+			continue;
+		}
 		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(relative);
 		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(relative);
 	}
@@ -121,6 +125,72 @@ const discoverProject = async (rootDir, options) => {
 	};
 };
 
+//#endregion
+//#region ../core/src/errors/config-error.ts
+var ConfigError = class extends Error {
+	_tag = "ConfigError";
+	constructor(options) {
+		super(options.message);
+		this.name = "ConfigError";
+	}
+};
+
+//#endregion
+//#region ../core/src/errors/parse-error.ts
+var ParseError = class extends Error {
+	_tag = "ParseError";
+	file;
+	constructor(options) {
+		super(options.message);
+		this.name = "ParseError";
+		this.file = options.file;
+	}
+};
+
+//#endregion
+//#region ../core/src/parsers/shell-quotes.ts
+/**
+* Replaces every character inside a single- or double-quoted region with a
+* space, keeping the quotes themselves and the string length, so callers can
+* run position-sensitive regexes over shell text without matching inside
+* string literals. A backslash inside double quotes escapes the next
+* character; single quotes have no escapes (POSIX sh). An unclosed quote
+* masks to the end of the text.
+*
+* What this deliberately does NOT do: it is not a tokenizer. It performs no
+* variable or command expansion, knows nothing about subshells, backslash
+* line continuations, `$'...'` or `<<` heredoc bodies, and does not split
+* words. It only blanks quoted spans so regexes keep their positions.
+*/
+const maskQuotedText = (text) => {
+	let out = "";
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (quote === null) {
+			if (char === "\"" || char === "'") quote = char;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (char === quote) {
+			quote = null;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (quote === "\"" && char === "\\" && index + 1 < text.length) {
+			out += "  ";
+			index += 2;
+			continue;
+		}
+		out += " ";
+		index += 1;
+	}
+	return out;
+};
+
 //#endregion
 //#region ../core/src/parsers/dockerfile-parser.ts
 const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
@@ -183,7 +253,10 @@ const matchInstructionKeyword = (lineContent) => {
 	};
 	return null;
 };
-const findHeredocDelimiters = (lineContent) => [...lineContent.matchAll(HEREDOC_OPENER_RE)].map((m) => m.groups?.delim ?? "");
+const findHeredocDelimiters = (lineContent) => {
+	const masked = maskQuotedText(lineContent);
+	return [...lineContent.matchAll(HEREDOC_OPENER_RE)].filter((match) => masked[match.index] === "<").map((match) => match.groups?.delim ?? "");
+};
 const processHeredocLine = (state, trimmed) => {
 	if (trimmed === state.heredocQueue[0]) state.heredocQueue.shift();
 	else state.currentArgs += (state.currentArgs ? " " : "") + trimmed;
@@ -206,7 +279,7 @@ const processInstructionLine = (state, trimmed, lineNum) => {
 	if (state.heredocQueue.length > 0) return;
 	if (!hasContinuation) closeInstruction(state);
 };
-const parseDockerfile = (content) => {
+const parseDockerfile = (content, file = "Dockerfile") => {
 	const state = createParserState();
 	const lines = content.split(/\r?\n/u);
 	for (const [i, rawLine] of lines.entries()) {
@@ -219,32 +292,14 @@ const parseDockerfile = (content) => {
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
 	}
+	if (state.heredocQueue.length > 0) throw new ParseError({
+		file,
+		message: `Unterminated heredoc: delimiter "${state.heredocQueue[0]}" (opened on line ${state.startLine}) never closed. BuildKit rejects this Dockerfile too.`
+	});
 	closeInstruction(state);
 	return state.instructions;
 };
 
-//#endregion
-//#region ../core/src/errors/config-error.ts
-var ConfigError = class extends Error {
-	_tag = "ConfigError";
-	constructor(options) {
-		super(options.message);
-		this.name = "ConfigError";
-	}
-};
-
-//#endregion
-//#region ../core/src/errors/parse-error.ts
-var ParseError = class extends Error {
-	_tag = "ParseError";
-	file;
-	constructor(options) {
-		super(options.message);
-		this.name = "ParseError";
-		this.file = options.file;
-	}
-};
-
 //#endregion
 //#region ../core/src/parsers/compose-parser.ts
 const parseCompose = (content, filepath) => {
@@ -478,6 +533,7 @@ const combineAptUpdateInstall = {
 };
 const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
 const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const CD_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*cd(?=\s|$)/u;
 const shellDirectiveEnablesPipefail = (args) => {
 	const argv = parseExecForm(args);
 	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
@@ -505,8 +561,9 @@ const usePipefail = {
 			}
 			if (inst.instruction !== "RUN") continue;
 			const { args } = inst;
-			if (!HAS_PIPE_RE.test(args)) continue;
 			const execArgv = parseExecForm(args);
+			const pipeText = execArgv === null ? maskQuotedText(args) : execArgv.join(" ");
+			if (!HAS_PIPE_RE.test(pipeText)) continue;
 			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
@@ -535,7 +592,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -598,12 +655,13 @@ const bestPracticesRules = [
 * with a null body (`web:` with nothing under it) is returned as an empty
 * config so rules still check it: it is the least-configured service in
 * the file, not a service to skip. Scalar and array bodies are invalid
-* compose and are dropped.
+* compose and are dropped. A `services:` written as a YAML sequence is
+* invalid Compose and yields no services.
 */
 const composeServices = (composeContent) => {
 	if (!composeContent || typeof composeContent !== "object" || !("services" in composeContent)) return [];
 	const { services } = composeContent;
-	if (!services || typeof services !== "object") return [];
+	if (!services || typeof services !== "object" || Array.isArray(services)) return [];
 	const entries = [];
 	for (const [name, config] of Object.entries(services)) if (config === null || config === void 0) entries.push([name, {}]);
 	else if (typeof config === "object" && !Array.isArray(config)) entries.push([name, config]);
@@ -1271,12 +1329,16 @@ const resolveSeverity = (rule, rulesConfig, categoriesConfig) => rulesConfig?.[r
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.ts
 const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categoriesConfig) => {
+	if (instructions.length === 0) return [];
 	const diagnostics = [];
 	for (const rule of allDockerfileRules) {
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1290,7 +1352,10 @@ const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig, lo
 		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
 		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(composeContent, file, { locate });
-		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
+		for (const diag of ruleDiagnostics) {
+			diag.category = rule.category;
+			if (severity !== rule.defaultSeverity) diag.severity = severity;
+		}
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -1400,6 +1465,16 @@ const parseConfigFile = async (filePath, format, parse) => {
 		throw new ConfigError({ message: `Failed to parse config ${format}: ${msg}` });
 	}
 };
+const TYPESCRIPT_CONFIG_PATTERN = /\.[cm]?ts$/u;
+const TYPE_STRIPPING_FAILURES = {
+	ERR_UNKNOWN_FILE_EXTENSION: "this Node.js is not stripping TypeScript types, which needs 22.18 or newer with stripping left on (--no-experimental-strip-types turns it off)",
+	ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING: "Node.js never strips TypeScript types for files under node_modules, on any version, so the config has to live outside it"
+};
+const typeStrippingFailure = (filePath, error) => {
+	if (!TYPESCRIPT_CONFIG_PATTERN.test(filePath)) return;
+	if (typeof error !== "object" || error === null || !("code" in error) || typeof error.code !== "string") return;
+	return TYPE_STRIPPING_FAILURES[error.code];
+};
 const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", yaml.parse);
@@ -1407,6 +1482,8 @@ const importConfig = async (filePath) => {
 		const configModule = await import(filePath);
 		return configModule.default || configModule;
 	} catch (error) {
+		const reason = typeStrippingFailure(filePath, error);
+		if (reason) throw new ConfigError({ message: `Cannot load ${filePath} on Node.js ${process.version}: ${reason}. A docker-doctor.config.yaml or .json needs no TypeScript support at all.` });
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
@@ -1501,9 +1578,15 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 2;
+const REPORT_SCHEMA_VERSION = 3;
+const resolveCategory = (diagnostic) => {
+	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
+	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
+	return category;
+};
 const toJsonReport = (diagnostics, score, label, project) => ({
 	diagnostics: diagnostics.map((d) => ({
+		category: resolveCategory(d),
 		column: d.column,
 		file: d.file,
 		help: d.help,
@@ -1514,7 +1597,7 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 	})),
 	label,
 	project,
-	schemaVersion: 2,
+	schemaVersion: 3,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
@@ -1598,4 +1681,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-DYLANvt2.cjs.map
+//# sourceMappingURL=src-D3jzc3GX.cjs.map