@intentius/chant-lexicon-docker 0.13.1 → 0.15.0

package/dist/generated/index.d.ts

@@ -1,7 +1,7 @@
-export declare const Service: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src/declarable").Declarable & Record<string, string>;
-export declare const Volume: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src/declarable").Declarable & Record<string, string>;
-export declare const Network: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src/declarable").Declarable & Record<string, string>;
-export declare const DockerConfig: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src/declarable").Declarable & Record<string, string>;
-export declare const DockerSecret: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src/declarable").Declarable & Record<string, string>;
-export declare const Dockerfile: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src/declarable").Declarable & Record<string, string>;
+export declare const Service: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Volume: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Network: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const DockerConfig: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const DockerSecret: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const Dockerfile: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
 //# sourceMappingURL=index.d.ts.map

package/dist/generated/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,0JAA2D,CAAC;AAChF,eAAO,MAAM,MAAM,0JAA0D,CAAC;AAC9E,eAAO,MAAM,OAAO,0JAA2D,CAAC;AAChF,eAAO,MAAM,YAAY,0JAA0D,CAAC;AACpF,eAAO,MAAM,YAAY,0JAA0D,CAAC;AAEpF,eAAO,MAAM,UAAU,0JAAqD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,+IAA2D,CAAC;AAChF,eAAO,MAAM,MAAM,+IAA0D,CAAC;AAC9E,eAAO,MAAM,OAAO,+IAA2D,CAAC;AAChF,eAAO,MAAM,YAAY,+IAA0D,CAAC;AACpF,eAAO,MAAM,YAAY,+IAA0D,CAAC;AAEpF,eAAO,MAAM,UAAU,+IAAqD,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "144fa09c79a35df5f9573737ab9328c043f1e11aec2f7fbabc92d15863f23b5f",
+    "manifest.json": "d243db7d067d83ee66cd393ed8156b223d6c0038091edc1c1c30064f2b431ece",
     "meta.json": "ae27dc809e705d37a645ee83b9789c50051282f7891d21d6b9e6ce8d111624ff",
     "types/index.d.ts": "758f989ff86af54284d7f841a2db2259038d51ce1f3ed839a5d8e83fa20d95b8",
     "rules/no-latest-tag.ts": "efd060453d8ca3d5b85c3972906c6650b6f63eb5f67cb6cdb0f16a41cad91228",
@@ -15,5 +15,5 @@
     "skills/chant-docker.md": "3ff0708e3c76e245f202948949c768464563af2b60cc9aa2ca52f494ef8357f1",
     "skills/chant-docker-patterns.md": "ad1b0196d8150b2df579a699ff107f604340c799c04f3460ebf65003e287b12a"
   },
-  "composite": "cf0a4b90f4563aa373bbfca0807e223b55e5a504d60a149bb7b1ace9786031c9"
+  "composite": "d4d2a9bb431ffe9f26d52701bf0f3dc6bfb057bca2a9d7787297a6c1098f3836"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The docker lexicon's `chant audit` catalog — metadata for the DKRD*
+ * Dockerfile/Compose post-synth rules. Contributed via `dockerPlugin.auditCatalog()` (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const dockerAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA+B,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI5G,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAOvD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "docker",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Docker",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAa7F,eAAO,MAAM,YAAY,EAAE,aAkO1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAc7F,eAAO,MAAM,YAAY,EAAE,aA0O1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-docker",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "Docker lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,6 +67,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.1"
+    "@intentius/chant": "^0.15.0"
   }
 }

package/src/lint/audit-catalog.ts

@@ -0,0 +1,16 @@
+/**
+ * The docker lexicon's `chant audit` catalog — metadata for the DKRD*
+ * Dockerfile/Compose post-synth rules. Contributed via `dockerPlugin.auditCatalog()` (#687).
+ */
+import { auditRule, SCORECARD_PINNED, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
+
+const DOCKER_SEC: Authority = { name: "Docker — Security best practices", url: "https://docs.docker.com/develop/security-best-practices/" };
+
+export const dockerAuditCatalog: Record<string, RuleMeta> = {
+  DKRD001: auditRule("DKRD001", "merge-worthy", "guidance", "Service uses :latest or untagged image", "Pin the image to an explicit version tag (ideally a digest).", { authority: [SCORECARD_PINNED] }),
+  DKRD002: auditRule("DKRD002", "report-only", "guidance", "Named volume declared but unused", "Remove the unused volume or mount it in a service.", { category: "best-practice" }),
+  DKRD003: auditRule("DKRD003", "merge-worthy", "guidance", "Service exposes SSH (port 22)", "Don't expose SSH from a container; use exec/ephemeral access instead.", { authority: [DOCKER_SEC] }),
+  DKRD010: auditRule("DKRD010", "report-only", "guidance", "apt-get install without --no-install-recommends", "Add --no-install-recommends to keep images small.", { category: "best-practice" }),
+  DKRD011: auditRule("DKRD011", "report-only", "guidance", "ADD used where COPY would do", "Prefer COPY unless fetching a URL or extracting an archive.", { category: "best-practice" }),
+  DKRD012: auditRule("DKRD012", "merge-worthy", "guidance", "No USER instruction — container runs as root", "Add a non-root USER instruction.", { authority: [DOCKER_SEC] }),
+};

package/src/plugin.ts

@@ -9,6 +9,7 @@ import type { LexiconPlugin, IntrinsicDef, InitTemplateSet } from "@intentius/ch
 import { detectTemplate } from "./detect";
 import type { LintRule } from "@intentius/chant/lint/rule";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { dockerAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader, createDiffTool, createCatalogResource } from "@intentius/chant/lexicon-plugin-helpers";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -20,6 +21,14 @@ import { DockerTemplateParser, DockerTemplateGenerator } from "./import/adapter"
 
 export const dockerPlugin: LexiconPlugin = {
   name: "docker",
+  auditCatalog: () => dockerAuditCatalog,
+  // Self-upgrade: the moby/moby tag embedded in the Engine API spec URL + its upstream (#685).
+  upstreamPin: {
+    file: "src/codegen/versions.ts",
+    pattern: /moby\/moby\/([^/]+)\/api\/swagger\.yaml/,
+    replace: (v, line) => line.replace(/moby\/moby\/[^/]+\/api\/swagger\.yaml/, `moby/moby/${v}/api/swagger.yaml`),
+    upstream: { owner: "moby", repo: "moby", kind: "releases" },
+  },
   serializer: dockerSerializer,
 
   lintRules(): LintRule[] {