@intentius/chant-lexicon-helm 0.0.16 → 0.0.22

package/src/lint/post-synth/whm201.test.ts

@@ -0,0 +1,59 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm201 } from "./whm201";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM201: standard labels", () => {
+  test("info when template lacks labels", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: test\n",
+    });
+    const diags = whm201.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM201");
+    expect(diags[0].severity).toBe("info");
+  });
+
+  test("passes when template includes labels helper", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": 'apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels: {{ include "test.labels" . }}\n',
+    });
+    expect(whm201.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when template has helm.sh/chart annotation", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  labels:\n    helm.sh/chart: test\n",
+    });
+    expect(whm201.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips _helpers.tpl and NOTES.txt", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/_helpers.tpl": "kind: something\n",
+      "templates/NOTES.txt": "kind: something\n",
+    });
+    expect(whm201.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm202.test.ts

@@ -0,0 +1,62 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm202 } from "./whm202";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM202: hook weights", () => {
+  test("warns when multiple hooks exist and some lack weights", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/pre-install.yaml": "helm.sh/hook: pre-install\nhelm.sh/hook-weight: \"-5\"\n",
+      "templates/post-install.yaml": "helm.sh/hook: post-install\n",
+    });
+    const diags = whm202.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM202");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].message).toContain("hook-weight");
+  });
+
+  test("passes when all hooks have weights", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/pre-install.yaml": "helm.sh/hook: pre-install\nhelm.sh/hook-weight: \"-5\"\n",
+      "templates/post-install.yaml": "helm.sh/hook: post-install\nhelm.sh/hook-weight: \"5\"\n",
+    });
+    expect(whm202.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with a single hook without weight", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/pre-install.yaml": "helm.sh/hook: pre-install\n",
+    });
+    expect(whm202.check(ctx)).toHaveLength(0);
+  });
+
+  test("ignores test hooks", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/test.yaml": "helm.sh/hook: test\n",
+      "templates/pre-install.yaml": "helm.sh/hook: pre-install\n",
+    });
+    expect(whm202.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm203.test.ts

@@ -0,0 +1,58 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm203 } from "./whm203";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM203: values documentation", () => {
+  test("info when values exist but no schema", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "values.yaml": "replicaCount: 1\n",
+    });
+    const diags = whm203.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM203");
+    expect(diags[0].severity).toBe("info");
+  });
+
+  test("passes when schema exists", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "values.yaml": "replicaCount: 1\n",
+      "values.schema.json": '{"type":"object"}',
+    });
+    expect(whm203.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when values.yaml is empty object", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "values.yaml": "{}",
+    });
+    expect(whm203.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when no values.yaml exists", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+    });
+    expect(whm203.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm204.test.ts

@@ -0,0 +1,56 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm204 } from "./whm204";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM204: dependency semver ranges", () => {
+  test("info when dependency uses pinned version", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\ndependencies:\n  - name: redis\n    version: 1.2.3\n    repository: https://charts.bitnami.com\n",
+    });
+    const diags = whm204.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM204");
+    expect(diags[0].severity).toBe("info");
+    expect(diags[0].message).toContain("redis");
+    expect(diags[0].message).toContain("1.2.3");
+  });
+
+  test("passes when dependency uses tilde range", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\ndependencies:\n  - name: redis\n    version: ~1.2.3\n    repository: https://charts.bitnami.com\n",
+    });
+    expect(whm204.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when dependency uses caret range", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\ndependencies:\n  - name: redis\n    version: ^1.2.3\n    repository: https://charts.bitnami.com\n",
+    });
+    expect(whm204.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when no dependencies section", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+    });
+    expect(whm204.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm301.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm301 } from "./whm301";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM301: Helm tests", () => {
+  test("info when no tests defined for application chart", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\ntype: application\n",
+      "templates/deploy.yaml": "kind: Deployment\n",
+    });
+    const diags = whm301.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM301");
+    expect(diags[0].severity).toBe("info");
+  });
+
+  test("passes when test exists", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\ntype: application\n",
+      "templates/tests/test-connection.yaml": "helm.sh/hook: test\n",
+    });
+    expect(whm301.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips library charts", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\ntype: library\n",
+    });
+    expect(whm301.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm302.test.ts

@@ -0,0 +1,58 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm302 } from "./whm302";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM302: resource limits", () => {
+  test("info when containers lack resources", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n",
+    });
+    const diags = whm302.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM302");
+    expect(diags[0].severity).toBe("info");
+  });
+
+  test("passes when resources are set", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      resources:\n        limits:\n          cpu: 100m\n",
+    });
+    expect(whm302.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when resources use values reference", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      resources: {{ toYaml .Values.resources }}\n",
+    });
+    expect(whm302.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips test templates", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/tests/test.yaml": "containers:\n  - name: test\n",
+    });
+    expect(whm302.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm401.test.ts

@@ -0,0 +1,59 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm401 } from "./whm401";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM401: image tag", () => {
+  test("warns on :latest tag", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      image: nginx:latest\n",
+    });
+    const diags = whm401.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM401");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("warns on untagged image", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      image: nginx\n",
+    });
+    const diags = whm401.check(ctx);
+    expect(diags).toHaveLength(1);
+  });
+
+  test("passes with pinned tag", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      image: nginx:1.25.0\n",
+    });
+    expect(whm401.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with .Values reference", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      image: {{ .Values.image.repository }}:{{ .Values.image.tag }}\n",
+    });
+    expect(whm401.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm402.test.ts

@@ -0,0 +1,58 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm402 } from "./whm402";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM402: runAsNonRoot", () => {
+  test("warns when containers lack runAsNonRoot", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n",
+    });
+    const diags = whm402.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM402");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("passes with runAsNonRoot: true", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n  securityContext:\n    runAsNonRoot: true\n",
+    });
+    expect(whm402.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with .Values.securityContext ref", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n  securityContext: {{ toYaml .Values.securityContext }}\n",
+    });
+    expect(whm402.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with .Values.podSecurityContext ref", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n  securityContext: {{ toYaml .Values.podSecurityContext }}\n",
+    });
+    expect(whm402.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm403.test.ts

@@ -0,0 +1,50 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm403 } from "./whm403";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM403: readOnlyRootFilesystem", () => {
+  test("info when containers lack readOnlyRootFilesystem", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n",
+    });
+    const diags = whm403.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM403");
+    expect(diags[0].severity).toBe("info");
+  });
+
+  test("passes with readOnlyRootFilesystem: true", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n  securityContext:\n    readOnlyRootFilesystem: true\n",
+    });
+    expect(whm403.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with .Values.securityContext ref", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n  securityContext: {{ toYaml .Values.securityContext }}\n",
+    });
+    expect(whm403.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm404.test.ts

@@ -0,0 +1,50 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm404 } from "./whm404";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM404: privileged mode", () => {
+  test("error on privileged: true", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      securityContext:\n        privileged: true\n",
+    });
+    const diags = whm404.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM404");
+    expect(diags[0].severity).toBe("error");
+  });
+
+  test("passes without privileged mode", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n",
+    });
+    expect(whm404.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with privileged: false", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      securityContext:\n        privileged: false\n",
+    });
+    expect(whm404.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/whm405.test.ts

@@ -0,0 +1,60 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm405 } from "./whm405";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM405: resource spec detail", () => {
+  test("warns when resources lack cpu", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      resources:\n        limits:\n          memory: 256Mi\n",
+    });
+    const diags = whm405.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM405");
+    expect(diags[0].message).toContain("cpu");
+  });
+
+  test("passes with both cpu and memory", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      resources:\n        limits:\n          cpu: 100m\n          memory: 256Mi\n",
+    });
+    expect(whm405.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when resources use .Values", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      resources: {{ toYaml .Values.resources }}\n",
+    });
+    expect(whm405.check(ctx)).toHaveLength(0);
+  });
+
+  test("warns when resources lack memory", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\nspec:\n  containers:\n    - name: app\n      resources:\n        limits:\n          cpu: 100m\n",
+    });
+    const diags = whm405.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("memory");
+  });
+});

package/src/lint/post-synth/whm406.test.ts

@@ -0,0 +1,43 @@
+import { describe, test, expect } from "bun:test";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { whm406 } from "./whm406";
+
+function makeCtx(files: Record<string, string>): PostSynthContext {
+  const result: SerializerResult = { primary: files["Chart.yaml"] ?? "", files };
+  const outputs = new Map<string, string | SerializerResult>();
+  outputs.set("helm", result);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: {
+      outputs,
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+describe("WHM406: CRD lifecycle", () => {
+  test("info when crds/ directory exists", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "crds/my-crd.yaml": "apiVersion: apiextensions.k8s.io/v1\nkind: CustomResourceDefinition\n",
+    });
+    const diags = whm406.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WHM406");
+    expect(diags[0].severity).toBe("info");
+    expect(diags[0].message).toContain("CRD");
+  });
+
+  test("passes without crds/ directory", () => {
+    const ctx = makeCtx({
+      "Chart.yaml": "apiVersion: v2\nname: test\nversion: 0.1.0\n",
+      "templates/deploy.yaml": "kind: Deployment\n",
+    });
+    expect(whm406.check(ctx)).toHaveLength(0);
+  });
+});