@intentius/chant-lexicon-cpln 0.53.0

package/src/lint/post-synth/cpl042-gvc-placement.ts

@@ -0,0 +1,57 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray, readPath, readString } from "../../entity-props";
+import { GVC, entitiesOfType } from "./helpers";
+
+/** Location links look like `/org/ORG/location/aws-us-east-1` or `//location/aws-us-east-1`. */
+const LOCATION_LINK = /\/location\/((aws|gcp|azure)-[a-z0-9-]+|[a-z0-9-]+)$/;
+
+/**
+ * CPL042: a GVC with nowhere to run.
+ *
+ * Placement is a GVC-level decision, and a GVC with neither `locationLinks` nor
+ * a `locationQuery` accepts workloads and schedules them nowhere. The workloads
+ * apply cleanly and never become ready.
+ */
+export const gvcPlacementCheck: PostSynthCheck = {
+  id: "CPL042",
+  description: "A GVC must declare where its workloads run",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [entityName, entity] of entitiesOfType(ctx.entities, GVC)) {
+      const name = readString(entity, "name") ?? entityName;
+      const links = readArray(entity, "spec", "staticPlacement", "locationLinks");
+      const query = readPath(entity, "spec", "staticPlacement", "locationQuery");
+
+      if (links.length === 0 && query === undefined) {
+        diagnostics.push({
+          checkId: "CPL042",
+          severity: "error",
+          message:
+            `GVC "${name}" declares no placement. Set spec.staticPlacement.locationLinks (or a ` +
+            `locationQuery) — without one, its workloads apply cleanly and are scheduled nowhere.`,
+          entity: entityName,
+          lexicon: "cpln",
+        });
+        continue;
+      }
+
+      for (const link of links) {
+        if (typeof link !== "string") continue;
+        if (LOCATION_LINK.test(link)) continue;
+        diagnostics.push({
+          checkId: "CPL042",
+          severity: "warning",
+          message:
+            `GVC "${name}" has location link "${link}", which does not look like a location. Expected ` +
+            `/org/<org>/location/<provider>-<region>, e.g. /org/acme/location/aws-us-east-1.`,
+          entity: entityName,
+          lexicon: "cpln",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/helpers.ts

@@ -0,0 +1,114 @@
+/**
+ * Shared reading and parsing for the CPL post-synth checks.
+ *
+ * Each check lives in its own file named for its id, so `CPL027` is greppable
+ * to one place. What they have in common lands here rather than being repeated
+ * or, worse, drifting: the workload-type default, the port enumeration that has
+ * to span both `port` and `ports`, and the quantity parsers.
+ *
+ * Named `helpers.ts` deliberately — the completeness checker's post-synth count
+ * excludes that filename, so a support module is not miscounted as a check.
+ */
+
+import type { Declarable } from "@intentius/chant/declarable";
+import { readArray, readNumber, readPath, readString } from "../../entity-props";
+import { kindByName } from "../../kinds";
+
+export const WORKLOAD = kindByName("workload")!.typeName;
+export const GVC = kindByName("gvc")!.typeName;
+export const POLICY = kindByName("policy")!.typeName;
+export const DOMAIN = kindByName("domain")!.typeName;
+export const VOLUMESET = kindByName("volumeset")!.typeName;
+
+/** Control Plane defaults an unset workload type to `serverless`. */
+export function workloadType(entity: unknown): string {
+  return readString(entity, "spec", "type") ?? "serverless";
+}
+
+/** The autoscaling block from `defaultOptions`. */
+export function autoscalingOf(entity: unknown): unknown {
+  return readPath(entity, "spec", "defaultOptions", "autoscaling");
+}
+
+/** Every port a workload's containers expose, across both `port` and `ports`. */
+export function exposedPorts(entity: unknown): number[] {
+  const ports: number[] = [];
+  for (const container of readArray(entity, "spec", "containers")) {
+    const single = readNumber(container, "port");
+    if (single !== undefined) ports.push(single);
+    for (const port of readArray(container, "ports")) {
+      const number = readNumber(port, "number");
+      if (number !== undefined) ports.push(number);
+    }
+  }
+  return ports;
+}
+
+/** Parse a CPU quantity (`"50m"`, `"1"`, `"1.5"`) to millicores. */
+export function parseCpuMillicores(value: string | undefined): number | undefined {
+  if (!value) return undefined;
+  const match = /^(\d+(?:\.\d+)?)(m?)$/.exec(value.trim());
+  if (!match) return undefined;
+  const amount = Number(match[1]);
+  return match[2] === "m" ? amount : amount * 1000;
+}
+
+/** Parse a memory quantity (`"128Mi"`, `"1Gi"`, `"512M"`) to MiB. */
+export function parseMemoryMib(value: string | undefined): number | undefined {
+  if (!value) return undefined;
+  const match = /^(\d+(?:\.\d+)?)(Ki|Mi|Gi|Ti|K|M|G|T)?$/.exec(value.trim());
+  if (!match) return undefined;
+  const amount = Number(match[1]);
+  const factors: Record<string, number> = {
+    Ki: 1 / 1024,
+    Mi: 1,
+    Gi: 1024,
+    Ti: 1024 * 1024,
+    // Decimal suffixes, converted to MiB so one comparison covers both families.
+    K: 1000 / (1024 * 1024),
+    M: 1_000_000 / (1024 * 1024),
+    G: 1_000_000_000 / (1024 * 1024),
+    T: 1_000_000_000_000 / (1024 * 1024),
+  };
+  const suffix = match[2];
+  if (!suffix) return amount / (1024 * 1024); // bare bytes
+  return amount * factors[suffix];
+}
+
+/**
+ * The tag of an image reference, or undefined when untagged.
+ *
+ * A colon in a registry host's port (`registry:5000/app`) is not a tag, so only
+ * a colon after the last slash counts.
+ */
+export function imageTag(image: string): string | undefined {
+  const lastSlash = image.lastIndexOf("/");
+  const colon = image.indexOf(":", lastSlash + 1);
+  return colon === -1 ? undefined : image.slice(colon + 1);
+}
+
+export interface ParsedLink {
+  kind: string;
+  name: string;
+  gvc?: string;
+}
+
+/** `//gvc/prod/identity/api` → kind `identity`, name `api`, gvc `prod`. */
+const GVC_SCOPED_LINK = /^\/\/gvc\/([^/]+)\/([a-z]+)\/([^/]+)$/;
+/** `//secret/db-password` → kind `secret`, name `db-password`. */
+const ORG_SCOPED_LINK = /^\/\/([a-z]+)\/([^/]+)$/;
+
+/** Parse a Control Plane link, or return undefined if it is not one. */
+export function parseLink(value: string): ParsedLink | undefined {
+  const scoped = GVC_SCOPED_LINK.exec(value);
+  if (scoped) return { gvc: scoped[1], kind: scoped[2], name: scoped[3] };
+
+  const org = ORG_SCOPED_LINK.exec(value);
+  if (org) return { kind: org[1], name: org[2] };
+
+  return undefined;
+}
+
+/** Iterate entities of one type. Re-exported so checks import one module. */
+export { entitiesOfType } from "../../entity-props";
+export type { Declarable };

package/src/lint/post-synth/index.ts

@@ -0,0 +1,45 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { unrestrictedOutboundCheck } from "./cpl010-unrestricted-outbound";
+import { internalFirewallScopeCheck } from "./cpl011-internal-firewall-scope";
+import { noLiteralCredentialEnvCheck } from "./cpl012-no-literal-credential-env";
+import { qualifiedIdentityPrincipalCheck } from "./cpl013-qualified-identity-principal";
+import { qualifiedSecretRefCheck } from "./cpl014-qualified-secret-ref";
+import { serverlessSinglePortCheck } from "./cpl020-serverless-single-port";
+import { cronJobShapeCheck } from "./cpl021-cron-job-shape";
+import { containerPortsCheck } from "./cpl022-container-ports";
+import { containerResourcesCheck } from "./cpl023-container-resources";
+import { probeHandlerCheck } from "./cpl024-probe-handler";
+import { autoscalingShapeCheck } from "./cpl025-autoscaling-shape";
+import { scaleToZeroCheck } from "./cpl026-scale-to-zero";
+import { capacityAiConflictCheck } from "./cpl027-capacity-ai-conflict";
+import { volumeSetCheck } from "./cpl028-volume-set";
+import { linkTargetsCheck } from "./cpl029-link-targets";
+import { domainRoutingCheck } from "./cpl030-domain-routing";
+import { pinnedImageCheck } from "./cpl040-pinned-image";
+import { imageReferenceFormCheck } from "./cpl041-image-reference-form";
+import { gvcPlacementCheck } from "./cpl042-gvc-placement";
+import { policyScopeCheck } from "./cpl043-policy-scope";
+
+export const postSynthChecks: PostSynthCheck[] = [
+  unrestrictedOutboundCheck,
+  internalFirewallScopeCheck,
+  noLiteralCredentialEnvCheck,
+  qualifiedIdentityPrincipalCheck,
+  qualifiedSecretRefCheck,
+  serverlessSinglePortCheck,
+  cronJobShapeCheck,
+  containerPortsCheck,
+  containerResourcesCheck,
+  probeHandlerCheck,
+  autoscalingShapeCheck,
+  scaleToZeroCheck,
+  capacityAiConflictCheck,
+  volumeSetCheck,
+  linkTargetsCheck,
+  domainRoutingCheck,
+  pinnedImageCheck,
+  imageReferenceFormCheck,
+  gvcPlacementCheck,
+  policyScopeCheck,
+];