@intentius/chant-lexicon-helm 0.124.30 → 0.124.32

package/dist/lint/post-synth/whm406.js

@@ -0,0 +1,27 @@
+/**
+ * WHM406: Chart uses `crds/` directory — warn that Helm never upgrades/deletes CRDs.
+ *
+ * Suggests using `HelmCRDLifecycle` composite for managed CRD lifecycle.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm406 = {
+    id: "WHM406",
+    description: "CRDs in crds/ directory are never upgraded or deleted by Helm",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const hasCrdDir = Object.keys(files).some((f) => f.startsWith("crds/"));
+            if (hasCrdDir) {
+                diagnostics.push({
+                    checkId: "WHM406",
+                    severity: "info",
+                    message: "Chart uses crds/ directory — Helm installs CRDs but never upgrades or deletes them. Consider using HelmCRDLifecycle composite for managed CRD lifecycle.",
+                    entity: "crds/",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm407.js

@@ -0,0 +1,72 @@
+/**
+ * WHM407: `kind: Secret` with inline `data:` values and no ExternalSecret/SealedSecret.
+ *
+ * Warns when secrets contain inline data values (not `.Values` refs) and the chart
+ * does not use ExternalSecret or SealedSecret resources.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm407 = {
+    id: "WHM407",
+    description: "Secrets with inline data should use ExternalSecret or SealedSecret",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            // Check if chart uses ExternalSecret or SealedSecret anywhere
+            const allContent = Object.values(files).join("\n");
+            const hasExternalSecret = allContent.includes("ExternalSecret") || allContent.includes("SealedSecret");
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                if (!content.includes("kind: Secret"))
+                    continue;
+                // Scan for inline data values in data: or stringData: sections
+                const lines = content.split("\n");
+                let inData = false;
+                let dataIndent = -1;
+                let hasLiteralValues = false;
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (!trimmed || trimmed.startsWith("#"))
+                        continue;
+                    const indent = line.length - line.trimStart().length;
+                    if (trimmed === "data:" || trimmed === "stringData:") {
+                        inData = true;
+                        dataIndent = indent;
+                        continue;
+                    }
+                    if (inData) {
+                        // If we've returned to the same or lower indent level, exit data section
+                        if (indent <= dataIndent && trimmed) {
+                            inData = false;
+                            dataIndent = -1;
+                            continue;
+                        }
+                        // Check if value is a literal (not a template expression)
+                        if (!trimmed.includes("{{") && !trimmed.includes(".Values")) {
+                            const colonIdx = trimmed.indexOf(":");
+                            if (colonIdx > 0 && trimmed.length > colonIdx + 1 && trimmed[colonIdx + 1] === " ") {
+                                const val = trimmed.slice(colonIdx + 1).trim();
+                                if (val) {
+                                    hasLiteralValues = true;
+                                }
+                            }
+                        }
+                    }
+                }
+                if (hasLiteralValues && !hasExternalSecret) {
+                    diagnostics.push({
+                        checkId: "WHM407",
+                        severity: "warning",
+                        message: `${filename}: Secret with inline data values — consider using ExternalSecret or SealedSecret for secret management`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm501.js

@@ -0,0 +1,89 @@
+/**
+ * WHM501: Unused values keys.
+ *
+ * Parses values.yaml key paths and scans all template files for
+ * `.Values.` references. Keys defined but never referenced produce
+ * an info diagnostic.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+/** Keys that are always implicitly used (e.g. in _helpers.tpl). */
+const IMPLICIT_KEYS = new Set(["nameOverride", "fullnameOverride"]);
+/**
+ * Extract all top-level and nested key paths from values.yaml content.
+ * Uses indentation to track nesting (2-space indent per level).
+ */
+function extractValuePaths(content) {
+    const paths = [];
+    const stack = [];
+    let prevIndent = -1;
+    for (const line of content.split("\n")) {
+        const trimmed = line.trimStart();
+        if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("-"))
+            continue;
+        const indent = line.length - trimmed.length;
+        const match = trimmed.match(/^([a-zA-Z_][a-zA-Z0-9_]*)\s*:/);
+        if (!match)
+            continue;
+        const key = match[1];
+        // Adjust stack based on indentation
+        while (stack.length > 0 && indent <= prevIndent) {
+            stack.pop();
+            prevIndent -= 2;
+        }
+        stack.push(key);
+        paths.push(stack.join("."));
+        prevIndent = indent;
+    }
+    return paths;
+}
+export const whm501 = {
+    id: "WHM501",
+    description: "Detect values keys that are defined but never referenced in templates",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const valuesContent = files["values.yaml"];
+            if (!valuesContent || valuesContent.trim() === "{}" || valuesContent.trim() === "")
+                continue;
+            const definedPaths = extractValuePaths(valuesContent);
+            if (definedPaths.length === 0)
+                continue;
+            // Collect all .Values references from templates
+            const referencedPaths = new Set();
+            const valuesRegex = /\.Values\.([a-zA-Z0-9_.]+)/g;
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/"))
+                    continue;
+                let match;
+                while ((match = valuesRegex.exec(content)) !== null) {
+                    referencedPaths.add(match[1]);
+                }
+            }
+            for (const path of definedPaths) {
+                if (IMPLICIT_KEYS.has(path))
+                    continue;
+                // Check if this path or any child is referenced
+                const isReferenced = referencedPaths.has(path) ||
+                    [...referencedPaths].some((ref) => ref.startsWith(path + "."));
+                // Check if any parent of this path is referenced (parent consumed entirely)
+                const parts = path.split(".");
+                const parentReferenced = parts.some((_, i) => {
+                    if (i === parts.length - 1)
+                        return false;
+                    return referencedPaths.has(parts.slice(0, i + 1).join("."));
+                });
+                if (!isReferenced && !parentReferenced) {
+                    diagnostics.push({
+                        checkId: "WHM501",
+                        severity: "info",
+                        message: `values.yaml defines "${path}" but it is never referenced in templates`,
+                        entity: "values.yaml",
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm502.js

@@ -0,0 +1,85 @@
+/**
+ * WHM502: K8s API version/kind validation.
+ *
+ * Checks for deprecated or invalid Kubernetes API versions in templates
+ * and suggests replacements.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+/**
+ * Deprecated API versions with their replacements.
+ */
+const DEPRECATED_APIS = {
+    "extensions/v1beta1": {
+        replacement: "networking.k8s.io/v1",
+        kinds: ["Ingress"],
+    },
+    "networking.k8s.io/v1beta1": {
+        replacement: "networking.k8s.io/v1",
+        kinds: ["Ingress", "IngressClass"],
+    },
+    "apps/v1beta1": {
+        replacement: "apps/v1",
+        kinds: ["Deployment", "StatefulSet"],
+    },
+    "apps/v1beta2": {
+        replacement: "apps/v1",
+        kinds: ["Deployment", "StatefulSet", "DaemonSet", "ReplicaSet"],
+    },
+    "rbac.authorization.k8s.io/v1beta1": {
+        replacement: "rbac.authorization.k8s.io/v1",
+        kinds: ["ClusterRole", "ClusterRoleBinding", "Role", "RoleBinding"],
+    },
+    "admissionregistration.k8s.io/v1beta1": {
+        replacement: "admissionregistration.k8s.io/v1",
+        kinds: ["MutatingWebhookConfiguration", "ValidatingWebhookConfiguration"],
+    },
+    "batch/v1beta1": {
+        replacement: "batch/v1",
+        kinds: ["CronJob"],
+    },
+    "policy/v1beta1": {
+        replacement: "policy/v1",
+        kinds: ["PodDisruptionBudget", "PodSecurityPolicy"],
+    },
+    "autoscaling/v2beta1": {
+        replacement: "autoscaling/v2",
+        kinds: ["HorizontalPodAutoscaler"],
+    },
+    "autoscaling/v2beta2": {
+        replacement: "autoscaling/v2",
+        kinds: ["HorizontalPodAutoscaler"],
+    },
+};
+export const whm502 = {
+    id: "WHM502",
+    description: "Detect deprecated or invalid Kubernetes API versions",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                // Extract apiVersion from template
+                const apiVersionMatch = content.match(/apiVersion:\s*(.+)/);
+                if (!apiVersionMatch)
+                    continue;
+                const apiVersion = apiVersionMatch[1].trim();
+                // Skip template expressions
+                if (apiVersion.includes("{{"))
+                    continue;
+                const deprecation = DEPRECATED_APIS[apiVersion];
+                if (deprecation) {
+                    diagnostics.push({
+                        checkId: "WHM502",
+                        severity: "warning",
+                        message: `${filename}: apiVersion "${apiVersion}" is deprecated — use "${deprecation.replacement}" instead`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm503.js

@@ -0,0 +1,82 @@
+/**
+ * WHM503: Pinned render artifact carries Secret data.
+ *
+ * WHM407 covers the pre-render concern — a chart TEMPLATE with an inline,
+ * literal `data`/`stringData` value baked into `templates/`. This rule
+ * covers a different concern (#1241, epic #1228 Phase 3): the STORED,
+ * POST-RENDER artifact (`render-store.ts`, #1238). A pinned render is
+ * durable, promoted, and pushed to a registry — unlike a normal `helm
+ * upgrade`, whose rendered bytes are computed at deploy time and discarded.
+ * By the time a render lands in the store, every `.Values` reference and
+ * `{{ }}` expression is resolved, so a `kind: Secret` document with
+ * populated `data`/`stringData` there is a live credential baked into
+ * something that outlives the deploy that produced it.
+ *
+ * Scans every pinned render recorded so far in this process
+ * (`getHelmRenderRecords()` from `../../render`) that carries a
+ * `contentDigest`, loads its manifest + canonical content from the render
+ * store, and flags any `Secret` document whose `data` or `stringData` is
+ * non-empty.
+ */
+import yaml from "js-yaml";
+import { getHelmRenderRecords } from "../../render-records.js";
+import { loadRenderManifest, readRenderDocument } from "../../render-store.js";
+/** True when a `data`/`stringData` map carries at least one key. */
+function isPopulated(value) {
+    return typeof value === "object" && value !== null && Object.keys(value).length > 0;
+}
+/**
+ * Scan a set of `HelmRenderRecord`s for pinned renders whose stored artifact
+ * carries a `Secret` document with populated `data`/`stringData`. Exported
+ * separately from `whm503` so tests can drive it directly with hand-built
+ * records — no real `helm` binary required, unlike a `HelmRender()` call.
+ * `opts.root` overrides the render store root (test isolation).
+ */
+export function checkRenderRecordsForSecrets(records, opts) {
+    const diagnostics = [];
+    for (const record of records) {
+        if (!record.contentDigest)
+            continue; // unpinned — no stored artifact to scan
+        const manifest = loadRenderManifest(record.contentDigest, opts);
+        if (!manifest)
+            continue; // recorded but not (or no longer) in the store
+        for (const doc of manifest.documents) {
+            if (doc.kind !== "Secret")
+                continue;
+            const found = readRenderDocument(record.contentDigest, { kind: doc.kind, name: doc.name, namespace: doc.namespace }, opts);
+            if (!found)
+                continue;
+            let parsed;
+            try {
+                parsed = (yaml.load(found.text) ?? {});
+            }
+            catch {
+                continue; // unparseable — not this check's problem to diagnose
+            }
+            if (!isPopulated(parsed.data) && !isPopulated(parsed.stringData))
+                continue;
+            const locator = doc.namespace ? `${doc.namespace}/${doc.name}` : doc.name;
+            diagnostics.push({
+                checkId: "WHM503",
+                severity: "error",
+                message: `pinned render "${record.name}" (${record.chart}, ${record.contentDigest}): Secret "${locator}" ` +
+                    `carries populated data/stringData — a pinned render is stored, promoted, and pushed to a registry, ` +
+                    `so this bakes a live credential into a durable artifact. Declare the value with runtimeSlot() so ` +
+                    `it is supplied per environment, or replace this Secret with HelmExternalSecret.`,
+                entity: locator,
+                lexicon: "helm",
+            });
+        }
+    }
+    return diagnostics;
+}
+export const whm503 = {
+    id: "WHM503",
+    description: "Pinned render artifact must not carry populated Secret data/stringData",
+    // This check's data source is the render store (#1238), not `ctx.outputs`
+    // (the un-rendered chart template files WHM005-WHM502 read) — see the file
+    // doc comment. `ctx` is accepted to satisfy `PostSynthCheck` and is unused.
+    check(_ctx) {
+        return checkRenderRecordsForSecrets(getHelmRenderRecords());
+    },
+};

package/dist/lint/post-synth/whm504.js

@@ -0,0 +1,47 @@
+/**
+ * WHM504: Dead value assignment (#1252, epic #1228 Phase 7).
+ *
+ * A supplied value that never survives coalescing is a lie in the config:
+ * it reads as if it configures something, and nothing ever sees it. The
+ * coalesced-values probe (#1251, ../../values-probe.ts) knows three ways a
+ * supplied value dies — shadowed by a later supplied layer, targeting a
+ * dependency a `condition:` disabled, or a values map under a top-level key
+ * that names no dependency at all (the silently-ignored subchart typo).
+ *
+ * The check reports over the probe records of the current process
+ * (`getValuesProbeRecords`): whatever ran the probe — the pinned-render
+ * build path, a test, a direct call — this check turns its dead assignments
+ * into diagnostics. No probe run, nothing to report; the probe itself needs
+ * the helm binary and the chart source, which a post-synth check must not
+ * require on its own.
+ */
+import { getValuesProbeRecords } from "../../values-probe.js";
+function describe(dead) {
+    switch (dead.reason) {
+        case "shadowed":
+            return `supplied value "${dead.path}" (${dead.origin}) never survives coalescing — shadowed by ${dead.shadowedBy}`;
+        case "disabled-subchart":
+            return `supplied value "${dead.path}" (${dead.origin}) targets a disabled subchart — ${dead.shadowedBy}`;
+        case "unknown-subchart":
+            return `supplied values under "${dead.path}" (${dead.origin}) target no subchart — ${dead.shadowedBy}`;
+    }
+}
+export const whm504 = {
+    id: "WHM504",
+    description: "Detect supplied values that never survive coalescing (shadowed, disabled subchart, unknown subchart)",
+    check(_ctx) {
+        const diagnostics = [];
+        for (const record of getValuesProbeRecords()) {
+            for (const dead of record.probe.deadAssignments) {
+                diagnostics.push({
+                    checkId: "WHM504",
+                    severity: "warning",
+                    message: describe(dead),
+                    entity: record.name,
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/chart-metadata.js

@@ -0,0 +1,53 @@
+/**
+ * WHM001: Chart Metadata Required
+ *
+ * Detects Chart constructors missing required fields: name, version, apiVersion.
+ *
+ * Bad:  new Chart({})
+ * Good: new Chart({ apiVersion: "v2", name: "my-app", version: "0.1.0" })
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const REQUIRED_FIELDS = ["name", "version", "apiVersion"];
+export const chartMetadataRule = {
+    id: "WHM001",
+    severity: "error",
+    category: "correctness",
+    description: "Chart must have name, version, and apiVersion fields",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for `new Chart({ ... })`
+            if (ts.isNewExpression(node) &&
+                ts.isIdentifier(node.expression) &&
+                node.expression.text === "Chart" &&
+                node.arguments &&
+                node.arguments.length > 0) {
+                const arg = node.arguments[0];
+                if (ts.isObjectLiteralExpression(arg)) {
+                    const presentKeys = new Set();
+                    for (const prop of arg.properties) {
+                        if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
+                            presentKeys.add(prop.name.text);
+                        }
+                    }
+                    const missing = REQUIRED_FIELDS.filter((f) => !presentKeys.has(f));
+                    if (missing.length > 0) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "WHM001",
+                            severity: "error",
+                            message: `Chart is missing required fields: ${missing.join(", ")}`,
+                        });
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/no-hardcoded-image.js

@@ -0,0 +1,50 @@
+/**
+ * WHM003: Container Images Should Use Values References
+ *
+ * Detects container image strings that are hardcoded in K8s resource
+ * constructors instead of using values references. In Helm charts, images
+ * should be parameterized via values.yaml so they can be overridden at
+ * install time.
+ *
+ * Bad:  image: "nginx:1.19"
+ * Good: image: printf("%s:%s", values.image.repository, values.image.tag)
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * Pattern matching common container image references.
+ * Matches strings like "nginx:1.19", "registry.io/app:latest", etc.
+ */
+const IMAGE_PATTERN = /^[a-z0-9][a-z0-9._/-]*:[a-z0-9][a-z0-9._-]*$/i;
+export const noHardcodedImageRule = {
+    id: "WHM003",
+    severity: "warning",
+    category: "correctness",
+    description: "Container images should use values references, not hardcoded tags",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for property assignments: `image: "nginx:1.19"`
+            if (ts.isPropertyAssignment(node) &&
+                ts.isIdentifier(node.name) &&
+                node.name.text === "image" &&
+                ts.isStringLiteral(node.initializer)) {
+                const value = node.initializer.text;
+                if (IMAGE_PATTERN.test(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.initializer.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WHM003",
+                        severity: "warning",
+                        message: `Hardcoded image "${value}" — use values references (e.g. printf("%s:%s", values.image.repository, values.image.tag)) for Helm chart parameterization`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/values-no-helm-tpl.js

@@ -0,0 +1,78 @@
+/**
+ * WHM004: HelmTpl Expression Has No Effect in Values Constructor
+ *
+ * Detects Values constructor props that use `v.xxx` (the `values` proxy)
+ * or any HelmTpl-like expression. values.yaml is static YAML — it is NOT
+ * processed as a Go template by Helm. These expressions silently become ''.
+ *
+ * Bad:  new Values({ host: v.pgHost })
+ * Good: new Values({ host: runtimeSlot("Cloud SQL private IP") })
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+export const valuesNoHelmTplRule = {
+    id: "WHM004",
+    severity: "warning",
+    category: "correctness",
+    description: "HelmTpl expression has no effect in values.yaml — use runtimeSlot() for deploy-time values",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isNewExpression(node) &&
+                ts.isIdentifier(node.expression) &&
+                node.expression.text === "Values" &&
+                node.arguments &&
+                node.arguments.length > 0) {
+                const arg = node.arguments[0];
+                if (ts.isObjectLiteralExpression(arg)) {
+                    checkObjectLiteral(arg, [], sourceFile, diagnostics);
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};
+/**
+ * Get the root identifier name of a property access / call chain.
+ * v.foo → "v"; values.x.pipe("fn") → "values"; runtimeSlot() → "runtimeSlot"
+ */
+function getRootIdentifier(node) {
+    if (ts.isIdentifier(node))
+        return node.text;
+    if (ts.isPropertyAccessExpression(node))
+        return getRootIdentifier(node.expression);
+    if (ts.isCallExpression(node))
+        return getRootIdentifier(node.expression);
+    return null;
+}
+function isHelmTplExpr(node) {
+    const root = getRootIdentifier(node);
+    return root === "v" || root === "values";
+}
+function checkObjectLiteral(obj, path, sourceFile, diagnostics) {
+    for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop))
+            continue;
+        const keyName = ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)
+            ? prop.name.text
+            : undefined;
+        const propPath = keyName ? [...path, keyName] : path;
+        if (isHelmTplExpr(prop.initializer)) {
+            const { line, character } = sourceFile.getLineAndCharacterOfPosition(prop.getStart());
+            const pathStr = propPath.join(".");
+            diagnostics.push({
+                file: sourceFile.fileName,
+                line: line + 1,
+                column: character + 1,
+                ruleId: "WHM004",
+                severity: "warning",
+                message: `HelmTpl expression has no effect in values.yaml (values.yaml is not a Go template). Use runtimeSlot() for deploy-time values or a static default.${pathStr ? ` (path: ${pathStr})` : ""}`,
+            });
+        }
+        else if (ts.isObjectLiteralExpression(prop.initializer)) {
+            checkObjectLiteral(prop.initializer, propPath, sourceFile, diagnostics);
+        }
+    }
+}

package/dist/lint/rules/values-no-secrets.js

@@ -0,0 +1,65 @@
+/**
+ * WHM002: Values Should Not Contain Bare Secrets
+ *
+ * Detects Values constructor props that contain keys suggesting sensitive
+ * data (password, token, key, secret, apiKey) without an `existingSecret`
+ * pattern — hardcoded secrets in values.yaml are a security anti-pattern.
+ *
+ * Bad:  new Values({ dbPassword: "hunter2" })
+ * Good: new Values({ existingSecret: "", dbPasswordKey: "password" })
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+const SENSITIVE_KEY_PATTERN = /^(password|secret|token|apiKey|api_key|private_key|privateKey)$/i;
+const SAFE_PATTERNS = /existing|ref|key_name|keyName|secretName/i;
+export const valuesNoSecretsRule = {
+    id: "WHM002",
+    severity: "warning",
+    category: "security",
+    description: "Values should not contain bare secrets — use existingSecret pattern instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            // Look for `new Values({ ... })`
+            if (ts.isNewExpression(node) &&
+                ts.isIdentifier(node.expression) &&
+                node.expression.text === "Values" &&
+                node.arguments &&
+                node.arguments.length > 0) {
+                const arg = node.arguments[0];
+                if (ts.isObjectLiteralExpression(arg)) {
+                    checkObjectLiteral(arg, sourceFile, diagnostics);
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};
+function checkObjectLiteral(obj, sourceFile, diagnostics) {
+    for (const prop of obj.properties) {
+        if (ts.isPropertyAssignment(prop) && ts.isIdentifier(prop.name)) {
+            const key = prop.name.text;
+            // Check if the key looks sensitive
+            if (SENSITIVE_KEY_PATTERN.test(key) && !SAFE_PATTERNS.test(key)) {
+                // Check if the value is a string literal (hardcoded secret)
+                if (ts.isStringLiteral(prop.initializer) && prop.initializer.text !== "") {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(prop.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WHM002",
+                        severity: "warning",
+                        message: `Values key "${key}" contains a hardcoded secret — use existingSecret pattern or leave empty as default`,
+                    });
+                }
+            }
+            // Recurse into nested objects
+            if (ts.isObjectLiteralExpression(prop.initializer)) {
+                checkObjectLiteral(prop.initializer, sourceFile, diagnostics);
+            }
+        }
+    }
+}