@docker-doctor/cli 0.5.3 → 0.6.0

package/dist/{src-D4rVJg36.cjs → src-BpAv-H0Z.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.5.3";
+var version = "0.6.0";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -89,20 +89,66 @@ const createIgnoreMatcher = (patterns) => {
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
-const walk = async (dir, fileList = []) => {
-	const files = await node_fs_promises.default.readdir(dir, { withFileTypes: true });
+const PRUNED_DIRECTORIES = [
+	".git",
+	".hg",
+	".svn",
+	"node_modules",
+	"bower_components",
+	".pnpm-store",
+	".yarn",
+	".venv",
+	"venv",
+	"__pycache__",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".turbo",
+	".next",
+	".nuxt",
+	".svelte-kit",
+	".parcel-cache",
+	".cache",
+	"coverage",
+	"dist"
+];
+const PRUNED = new Set(PRUNED_DIRECTORIES);
+const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
+const SUBTREE_SUFFIX = "/**";
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
+const walk = async (dir, options, fileList = []) => {
+	let files;
+	try {
+		files = await node_fs_promises.default.readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (dir !== options.rootDir && isPermissionError(error)) {
+			options.onSkippedDirectory?.(toPosixRelative(options.rootDir, dir));
+			return fileList;
+		}
+		throw error;
+	}
 	await Promise.all(files.map(async (file) => {
 		const filePath = node_path.default.join(dir, file.name);
+		if (file.isSymbolicLink()) {
+			fileList.push(filePath);
+			return;
+		}
 		if (file.isDirectory()) {
-			if (file.name === "node_modules" || file.name === ".git" || file.name === ".next" || file.name === "dist" || file.name === ".turbo") return;
-			await walk(filePath, fileList);
+			if (PRUNED.has(file.name) || options.isPrunedByConfig(toPosixRelative(options.rootDir, filePath))) return;
+			await walk(filePath, options, fileList);
 		} else fileList.push(filePath);
 	}));
 	return fileList;
 };
-const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
 const discoverProject = async (rootDir, options) => {
-	const allFiles = await walk(rootDir);
+	const allFiles = await walk(rootDir, {
+		isPrunedByConfig: createPrunedDirectoryMatcher(options?.ignoreFiles),
+		onSkippedDirectory: options?.onSkippedDirectory,
+		rootDir
+	});
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
@@ -287,7 +333,7 @@ const parseDockerfile = (content, file = "Dockerfile") => {
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
 		if (!insideHeredoc && trimmed.startsWith("#")) continue;
-		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
+		if (!insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -458,6 +504,13 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	severity
 });
 
+//#endregion
+//#region ../core/src/rules/package-managers.ts
+const APT_GET_INSTALL_RE = /\bapt-get(?:\s+-\S+)*\s+install\b/u;
+const APT_GET_UPDATE_RE = /\bapt-get(?:\s+-\S+)*\s+update\b/u;
+const hasAptGetInstall = (text) => APT_GET_INSTALL_RE.test(text);
+const hasAptGetUpdate = (text) => APT_GET_UPDATE_RE.test(text);
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
@@ -473,6 +526,16 @@ const requireHealthcheck = {
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
+const AUTO_EXTRACT_SUFFIXES = [
+	".tar",
+	".tar.gz",
+	".tgz",
+	".tar.bz2",
+	".tbz2",
+	".tbz",
+	".tar.xz",
+	".txz"
+];
 const preferCopyOverAdd = {
 	category: "Best Practices",
 	check(instructions, file) {
@@ -481,7 +544,7 @@ const preferCopyOverAdd = {
 			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
-			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
+			const isArchive = AUTO_EXTRACT_SUFFIXES.some((suffix) => src.toLowerCase().endsWith(suffix));
 			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -519,8 +582,8 @@ const combineAptUpdateInstall = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const hasUpdate = inst.args.includes("apt-get update");
-			const hasInstall = inst.args.includes("apt-get install");
+			const hasUpdate = hasAptGetUpdate(inst.args);
+			const hasInstall = hasAptGetInstall(inst.args);
 			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
 			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
@@ -600,18 +663,32 @@ const avoidRunCd = {
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
+const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
+const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
+const WHITESPACE_RE$1 = /\s+/u;
+const collectPackageList = (raw) => {
+	const start = PACKAGE_LIST_START_RE.exec(raw);
+	if (!start) return [];
+	const packages = [];
+	const tokens = raw.slice(start.index + start[0].length).split(WHITESPACE_RE$1);
+	for (const token of tokens) {
+		if (SHELL_SEPARATOR_RE$1.test(token)) break;
+		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
+	}
+	return packages;
+};
 const sortMultilineArgs = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { raw } = inst;
-			const isPackageInstall = raw.includes("apt-get install") || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
+			const isPackageInstall = hasAptGetInstall(raw) || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
 			const hasContinuation = raw.includes("\\\n") || raw.includes("\\\r\n");
 			if (isPackageInstall && hasContinuation) {
-				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
+				const packages = collectPackageList(raw);
 				if (packages.length > 1) {
-					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
+					const sorted = packages.toSorted();
 					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
@@ -873,7 +950,10 @@ const composeModelRules = [undefinedModelReference, pinModelVersion];
 const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
 const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
 const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
-const resolveInterpolationDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PWD_INTERPOLATION = /\$\{PWD\}|\$PWD(?![A-Za-z0-9_])/gu;
+const LEADING_INTERPOLATION_RE = /^\$(?:\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*)/u;
+const applyFoldsAndDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(PWD_INTERPOLATION, ".").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback);
+const resolveInterpolationDefaults = (value) => applyFoldsAndDefaults(value).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
 const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
 const splitShortSyntax = (spec) => {
 	const parts = [];
@@ -924,12 +1004,16 @@ const volumeMount = (volume) => {
 * The host path a bind mount reads from, with interpolation defaults
 * applied and Windows separators folded to `/`. Undefined when the entry is
 * not a bind mount (named volume, tmpfs, anonymous volume) or when the
-* source is an interpolation with no default, which names no host path.
+* source starts with an interpolation that has no default. A source such as
+* `${DATA_DIR}/pg` names no known host location, so no rule can say whether
+* it is inside the project.
 */
 const bindMountSource = (mount) => {
 	if (mount.type !== void 0 && mount.type !== "bind") return;
 	if (!mount.source) return;
-	const resolved = resolveInterpolationDefaults(mount.source).replaceAll("\\", "/");
+	const withDefaults = applyFoldsAndDefaults(mount.source);
+	if (LEADING_INTERPOLATION_RE.test(withDefaults)) return;
+	const resolved = withDefaults.replace(INTERPOLATION_WITHOUT_DEFAULT, "").replaceAll("\\", "/");
 	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
 	return resolved;
 };
@@ -937,15 +1021,16 @@ const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || ho
 const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
 /**
 * Whether the entry bind-mounts the Docker socket, under any of its host
-* spellings. A bare `${VAR}` source names no host path, but a socket target
-* still tells the story.
+* spellings. A source that starts with `${VAR}` names no known host path,
+* but a `/docker.sock` suffix or a socket target still identifies it.
 */
 const mountsDockerSocket = (mount) => {
 	const source = bindMountSource(mount);
 	if (source !== void 0) return isDockerSocketPath(source);
 	if (mount.type !== void 0 && mount.type !== "bind") return false;
 	if (!mount.source) return false;
-	return resolveInterpolationDefaults(mount.source) === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+	const remainder = resolveInterpolationDefaults(mount.source);
+	return isDockerSocketPath(remainder) || remainder === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
 };
 const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
 const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
@@ -995,7 +1080,11 @@ const SECRET_KEY_PATTERNS = [
 ];
 const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
 const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
-const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
+const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
+const isLiteralSecretValue = (value) => {
+	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !CREDENTIAL_FREE_URL.test(unquoted);
+};
 
 //#endregion
 //#region ../core/src/rules/compose-security.ts
@@ -1102,6 +1191,10 @@ const preferReadOnlyBindMount = {
 	key: "docker-doctor/prefer-read-only-bind-mount",
 	message: "Bind mounts outside the project should be read-only"
 };
+const literalValue = (value) => {
+	if (typeof value === "string") return value;
+	if (typeof value === "number") return String(value);
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -1117,15 +1210,16 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
 					index
 				]));
 			}
-			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+			else if (environment && typeof environment === "object") for (const [key, value] of Object.entries(environment)) {
+				const literal = literalValue(value);
+				if (literal !== void 0 && isSecretKey(key) && isLiteralSecretValue(literal)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -1185,7 +1279,7 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
 			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -1195,7 +1289,40 @@ const cleanPackageCache = {
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
-const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/u;
+const WHITESPACE_RE = /\s+/u;
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+const NODE_PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+]);
+const INSTALL_VERBS = /* @__PURE__ */ new Set([
+	"install",
+	"ci",
+	"i"
+]);
+const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
+	"-g",
+	"--global",
+	"--production",
+	"--omit=dev",
+	"--only=prod",
+	"--only=production",
+	"--prod",
+	"-P",
+	"-p"
+]);
+const segmentInstallsDevDependencies = (segment) => {
+	const tokens = segment.split(WHITESPACE_RE).filter(Boolean);
+	const commandStart = tokens.findIndex((token) => !ENV_ASSIGNMENT_RE.test(token));
+	if (commandStart === -1) return false;
+	const [manager, verb, ...options] = tokens.slice(commandStart);
+	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
+	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
+};
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(args).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -1241,11 +1368,12 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
+const BUILD_TOOL_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*(?:make|cmake)(?=\s|$)/u;
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(inst.args))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1304,7 +1432,8 @@ const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
 	const lastSlash = dockerfilePath.lastIndexOf("/");
 	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
 	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
-	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+	const perDockerfile = `${dockerfilePath}.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === perDockerfile || f === ".dockerignore");
 };
 const useDockerignore = {
 	category: "Performance",
@@ -1716,13 +1845,13 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 3;
+const REPORT_SCHEMA_VERSION = 4;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
 	return category;
 };
-const toJsonReport = (diagnostics, score, label, project) => ({
+const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	diagnostics: diagnostics.map((d) => ({
 		category: resolveCategory(d),
 		column: d.column,
@@ -1733,9 +1862,13 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 		rule: d.rule,
 		severity: d.severity
 	})),
+	failures: failures.map(({ file, message }) => ({
+		file,
+		message
+	})),
 	label,
 	project,
-	schemaVersion: 3,
+	schemaVersion: 4,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
@@ -1819,4 +1952,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-D4rVJg36.cjs.map
+//# sourceMappingURL=src-BpAv-H0Z.cjs.map