@intentius/chant-lexicon-docker 0.57.0 → 0.59.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5d297d1ba49f1bf5f8569452bafa23b0bb639c1baba4b37e72e1b10bc2631e0f",
+    "manifest.json": "c78b187acb14b2a51ca815402546a0d4c8a57b0e89592f687deda58c8c4e7e0f",
     "meta.json": "ae27dc809e705d37a645ee83b9789c50051282f7891d21d6b9e6ce8d111624ff",
     "types/index.d.ts": "758f989ff86af54284d7f841a2db2259038d51ce1f3ed839a5d8e83fa20d95b8",
     "rules/no-latest-tag.ts": "efd060453d8ca3d5b85c3972906c6650b6f63eb5f67cb6cdb0f16a41cad91228",
@@ -15,5 +15,5 @@
     "skills/chant-docker.md": "3ff0708e3c76e245f202948949c768464563af2b60cc9aa2ca52f494ef8357f1",
     "skills/chant-docker-patterns.md": "ad1b0196d8150b2df579a699ff107f604340c799c04f3460ebf65003e287b12a"
   },
-  "composite": "5868ae7ef4bd97f89e655d92cc7df97de49a7514713ff35ea7eadfd33b5df040"
+  "composite": "102ceb56c06e72263fbe4d7519db4a84fac12ec341c4254ff3d0536b9c0fb66a"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA+B,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI5G,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAOvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA+B,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AAK1H,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAOvD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const dockerAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAwBxD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "docker",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Docker",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-docker",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "description": "Docker lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,7 +67,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.57.0",
+    "@intentius/chant": "^0.59.0",
     "typescript": "^5.9.3"
   }
 }

package/src/lint/audit-catalog.ts

@@ -2,7 +2,8 @@
  * The docker lexicon's `chant audit` catalog — metadata for the DKRD*
  * Dockerfile/Compose post-synth rules. Contributed via `dockerPlugin.auditCatalog()` (#687).
  */
-import { auditRule, SCORECARD_PINNED, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
+import { auditRule, SCORECARD_PINNED, type RuleMeta, type Authority, applyLineage } from "@intentius/chant/audit/catalog";
+import { dockerAuditLineage } from "./audit-lineage";
 
 const DOCKER_SEC: Authority = { name: "Docker — Security best practices", url: "https://docs.docker.com/develop/security-best-practices/" };
 
@@ -14,3 +15,6 @@ export const dockerAuditCatalog: Record<string, RuleMeta> = {
   DKRD011: auditRule("DKRD011", "report-only", "guidance", "ADD used where COPY would do", "Prefer COPY unless fetching a URL or extracting an archive.", { category: "best-practice" }),
   DKRD012: auditRule("DKRD012", "merge-worthy", "guidance", "No USER instruction — container runs as root", "Add a non-root USER instruction.", { authority: [DOCKER_SEC] }),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(dockerAuditCatalog, dockerAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,34 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const dockerAuditLineage: Record<string, Lineage[]> = {
+  DKRD001: [
+    { tool: "hadolint", rule: "DL3007", url: "https://github.com/hadolint/hadolint/wiki/DL3007", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_DOCKER_7", url: "https://www.checkov.io/5.Policy%20Index/dockerfile.html", relation: "overlaps" },
+    { tool: "kics", rule: "image_version_using_latest", url: "https://docs.kics.io/latest/queries/dockerfile-queries/f45ea400-6bbe-4501-9fc7-1c3d75c32067/", relation: "overlaps" },
+  ],
+  DKRD003: [
+    { tool: "checkov", rule: "CKV_DOCKER_1", url: "https://www.checkov.io/5.Policy%20Index/dockerfile.html", relation: "overlaps" },
+    { tool: "kics", rule: "Exposing Port 22 (SSH)", url: "https://docs.kics.io/latest/queries/dockerfile-queries/5907595b-5b6d-4142-b173-dbb0e73fbff8/", relation: "overlaps" },
+  ],
+  DKRD010: [
+    { tool: "hadolint", rule: "DL3015", url: "https://github.com/hadolint/hadolint/wiki/DL3015", relation: "equivalent" },
+    { tool: "kics", rule: "apt_get_not_avoiding_additional_packages", url: "https://docs.kics.io/latest/queries/dockerfile-queries/7384dfb2-fcd1-4fbf-91cd-6c44c318c33c/", relation: "equivalent" },
+  ],
+  DKRD011: [
+    { tool: "hadolint", rule: "DL3020", url: "https://github.com/hadolint/hadolint/wiki/DL3020", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_DOCKER_4", url: "https://www.checkov.io/5.Policy%20Index/dockerfile.html", relation: "overlaps" },
+    { tool: "dockle", rule: "CIS-DI-0009", url: "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#cis-di-0009", relation: "overlaps" },
+  ],
+  DKRD012: [
+    { tool: "checkov", rule: "CKV_DOCKER_3", url: "https://www.checkov.io/5.Policy%20Index/dockerfile.html", relation: "equivalent" },
+    { tool: "kics", rule: "missing_user_instruction", url: "https://docs.kics.io/latest/queries/dockerfile-queries/fd54f200-402c-4333-a5a4-36ef6709af2f/", relation: "equivalent" },
+    { tool: "dockle", rule: "CIS-DI-0001", url: "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#cis-di-0001", relation: "overlaps" },
+  ],
+};