@intentius/chant-lexicon-helm 0.124.31 → 0.124.32

package/dist/lint/post-synth/whm005-no-empty-wrapper.js

@@ -0,0 +1,47 @@
+/**
+ * WHM005: Chart Has Sub-chart Dependencies But Generates No Templates
+ *
+ * A chart with HelmDependency entries but no templates/*.yaml files generates
+ * an empty templates/ directory. Deploying it requires `helm dependency build`
+ * as a non-obvious prerequisite.
+ *
+ * If you only need value overrides for an upstream chart, deploy it directly:
+ *   helm upgrade upstream-chart -f values-override.yaml
+ * and use ValuesOverride to generate the override file.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm005 = {
+    id: "WHM005",
+    description: "Chart with sub-chart dependencies but no templates should deploy upstream chart directly",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const chartYaml = files["Chart.yaml"];
+            if (!chartYaml)
+                continue;
+            // Check for non-empty dependencies block
+            const hasDependencies = /^dependencies:/m.test(chartYaml);
+            if (!hasDependencies)
+                continue;
+            // Check for template files (excluding _helpers.tpl and NOTES.txt)
+            const hasTemplates = Object.keys(files).some((path) => {
+                if (!path.startsWith("templates/"))
+                    return false;
+                const filename = path.slice("templates/".length);
+                if (filename === "_helpers.tpl" || filename === "NOTES.txt")
+                    return false;
+                return filename.endsWith(".yaml") || filename.endsWith(".yml");
+            });
+            if (!hasTemplates) {
+                diagnostics.push({
+                    checkId: "WHM005",
+                    severity: "warning",
+                    message: "Chart has sub-chart dependencies but generates no templates. Deploying this chart requires 'helm dependency build' first. If you only need value overrides for an upstream chart, deploy it directly with 'helm upgrade upstream-chart -f values-override.yaml' and use ValuesOverride to generate the override file.",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm101.js

@@ -0,0 +1,38 @@
+/**
+ * WHM101: Chart.yaml has required fields and valid apiVersion (v2).
+ */
+import { getChartFiles, parseChartYaml } from "./helm-helpers.js";
+export const whm101 = {
+    id: "WHM101",
+    description: "Chart.yaml must have required fields (apiVersion v2, name, version)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const chartYaml = files["Chart.yaml"];
+            if (!chartYaml) {
+                diagnostics.push({
+                    checkId: "WHM101",
+                    severity: "error",
+                    message: "Chart.yaml is missing from serializer output",
+                    lexicon: "helm",
+                });
+                continue;
+            }
+            const parsed = parseChartYaml(chartYaml);
+            if (!parsed.apiVersion) {
+                diagnostics.push({ checkId: "WHM101", severity: "error", message: "Chart.yaml missing apiVersion", lexicon: "helm" });
+            }
+            else if (parsed.apiVersion !== "v2") {
+                diagnostics.push({ checkId: "WHM101", severity: "error", message: `Chart.yaml apiVersion should be "v2", got "${parsed.apiVersion}"`, lexicon: "helm" });
+            }
+            if (!parsed.name) {
+                diagnostics.push({ checkId: "WHM101", severity: "error", message: "Chart.yaml missing name", lexicon: "helm" });
+            }
+            if (!parsed.version) {
+                diagnostics.push({ checkId: "WHM101", severity: "error", message: "Chart.yaml missing version", lexicon: "helm" });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm102.js

@@ -0,0 +1,26 @@
+/**
+ * WHM102: values.schema.json present when Values type is used.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm102 = {
+    id: "WHM102",
+    description: "values.schema.json should be present when Values are non-empty",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const valuesYaml = files["values.yaml"];
+            const valuesSchema = files["values.schema.json"];
+            // If values.yaml has content (not just "{}"), schema should exist
+            if (valuesYaml && valuesYaml.trim() !== "{}" && !valuesSchema) {
+                diagnostics.push({
+                    checkId: "WHM102",
+                    severity: "warning",
+                    message: "values.schema.json is missing — consider adding typed Values to generate a schema",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm103.js

@@ -0,0 +1,51 @@
+/**
+ * WHM103: Go template syntax valid (balanced braces, valid function names).
+ */
+import { getChartFiles, hasBalancedBraces } from "./helm-helpers.js";
+const VALID_FUNCTIONS = new Set([
+    // Built-in Go template functions
+    "if", "else", "end", "range", "with", "define", "template", "block",
+    // Helm/Sprig functions
+    "include", "required", "default", "toYaml", "toJson", "fromYaml", "fromJson",
+    "quote", "squote", "upper", "lower", "title", "trim", "trimSuffix", "trimPrefix",
+    "printf", "print", "println", "tpl", "lookup",
+    "nindent", "indent", "replace", "contains", "hasPrefix", "hasSuffix",
+    "repeat", "substr", "trunc", "abbrev", "randAlphaNum", "randAlpha",
+    "b64enc", "b64dec", "sha256sum", "now", "date",
+    "list", "dict", "get", "set", "unset", "hasKey", "pluck", "keys", "values",
+    "append", "prepend", "first", "last", "uniq", "without", "has",
+    "empty", "coalesce", "ternary", "cat", "join", "split", "splitList",
+    "toStrings", "toString", "int", "int64", "float64", "atoi",
+    "add", "sub", "mul", "div", "mod", "max", "min", "ceil", "floor", "round",
+    "and", "or", "not", "eq", "ne", "lt", "le", "gt", "ge",
+    "typeOf", "kindOf", "typeIs", "kindIs", "deepEqual",
+    "semver", "semverCompare",
+    "regexMatch", "regexFind", "regexReplaceAll",
+    "sha1sum", "derivePassword", "genPrivateKey", "buildCustomCert", "genCA", "genSignedCert",
+    "env", "expandenv",
+    "fail",
+]);
+export const whm103 = {
+    id: "WHM103",
+    description: "Go template syntax must be valid (balanced braces)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/"))
+                    continue;
+                if (!hasBalancedBraces(content)) {
+                    diagnostics.push({
+                        checkId: "WHM103",
+                        severity: "error",
+                        message: `Unbalanced template braces in ${filename}`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm104.js

@@ -0,0 +1,29 @@
+/**
+ * WHM104: NOTES.txt exists for application charts.
+ */
+import { getChartFiles, parseChartYaml } from "./helm-helpers.js";
+export const whm104 = {
+    id: "WHM104",
+    description: "NOTES.txt should exist for application charts",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const chartYaml = files["Chart.yaml"];
+            if (!chartYaml)
+                continue;
+            const parsed = parseChartYaml(chartYaml);
+            if (parsed.type === "library")
+                continue; // Libraries don't need NOTES.txt
+            if (!files["templates/NOTES.txt"]) {
+                diagnostics.push({
+                    checkId: "WHM104",
+                    severity: "info",
+                    message: "NOTES.txt is missing — consider adding installation notes for users",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm105.js

@@ -0,0 +1,23 @@
+/**
+ * WHM105: _helpers.tpl exists.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm105 = {
+    id: "WHM105",
+    description: "_helpers.tpl must exist in templates/",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            if (!files["templates/_helpers.tpl"]) {
+                diagnostics.push({
+                    checkId: "WHM105",
+                    severity: "warning",
+                    message: "templates/_helpers.tpl is missing",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm201.js

@@ -0,0 +1,29 @@
+/**
+ * WHM201: Resources should have standard Helm labels.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm201 = {
+    id: "WHM201",
+    description: "K8s resources should include standard Helm labels",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                // Check if the template references the standard labels helper
+                if (content.includes("kind:") && !content.includes(".labels") && !content.includes("helm.sh/chart")) {
+                    diagnostics.push({
+                        checkId: "WHM201",
+                        severity: "info",
+                        message: `${filename} does not include standard Helm labels — consider using include "<chart>.labels"`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm202.js

@@ -0,0 +1,42 @@
+/**
+ * WHM202: Hook weights should be defined for multi-hook charts.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm202 = {
+    id: "WHM202",
+    description: "Hook weights should be defined when multiple hooks exist",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const hooksWithWeight = [];
+            const hooksWithoutWeight = [];
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/"))
+                    continue;
+                if (content.includes("helm.sh/hook:") && !content.includes("helm.sh/hook: test")) {
+                    if (content.includes("helm.sh/hook-weight:")) {
+                        hooksWithWeight.push(filename);
+                    }
+                    else {
+                        hooksWithoutWeight.push(filename);
+                    }
+                }
+            }
+            // Only warn if there are multiple hooks and some lack weights
+            const totalHooks = hooksWithWeight.length + hooksWithoutWeight.length;
+            if (totalHooks > 1 && hooksWithoutWeight.length > 0) {
+                for (const filename of hooksWithoutWeight) {
+                    diagnostics.push({
+                        checkId: "WHM202",
+                        severity: "warning",
+                        message: `${filename} has a hook but no hook-weight — define weights to control execution order in multi-hook charts`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm203.js

@@ -0,0 +1,32 @@
+/**
+ * WHM203: Values entries should be documented.
+ *
+ * Checks that values.yaml has YAML comments or that values.schema.json
+ * provides descriptions. Since Chant generates values.yaml from code,
+ * this check looks for values.schema.json as the documentation source.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm203 = {
+    id: "WHM203",
+    description: "Values entries should be documented via schema or comments",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const valuesYaml = files["values.yaml"];
+            const schemaJson = files["values.schema.json"];
+            if (!valuesYaml || valuesYaml.trim() === "{}")
+                continue;
+            // If no schema, values are undocumented
+            if (!schemaJson) {
+                diagnostics.push({
+                    checkId: "WHM203",
+                    severity: "info",
+                    message: "Values are not documented — add a Values type to generate values.schema.json",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm204.js

@@ -0,0 +1,51 @@
+/**
+ * WHM204: Dependencies should use semver ranges.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+const SEMVER_RANGE_PATTERN = /^[~^>=<*]|\.x/;
+export const whm204 = {
+    id: "WHM204",
+    description: "Chart dependencies should use semver ranges, not pinned versions",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const chartYaml = files["Chart.yaml"];
+            if (!chartYaml)
+                continue;
+            // Simple extraction of dependency versions from Chart.yaml
+            const lines = chartYaml.split("\n");
+            let inDependencies = false;
+            let currentDep = "";
+            for (const line of lines) {
+                if (line.startsWith("dependencies:")) {
+                    inDependencies = true;
+                    continue;
+                }
+                if (inDependencies) {
+                    if (/^\S/.test(line) && !line.startsWith(" ")) {
+                        inDependencies = false;
+                        continue;
+                    }
+                    const nameMatch = line.match(/name:\s*(.+)/);
+                    if (nameMatch)
+                        currentDep = nameMatch[1].trim();
+                    const versionMatch = line.match(/version:\s*'?([^']+)'?/);
+                    if (versionMatch && currentDep) {
+                        const version = versionMatch[1].trim();
+                        if (!SEMVER_RANGE_PATTERN.test(version)) {
+                            diagnostics.push({
+                                checkId: "WHM204",
+                                severity: "info",
+                                message: `Dependency "${currentDep}" uses pinned version "${version}" — consider a semver range (e.g. "~${version}" or "^${version}")`,
+                                entity: currentDep,
+                                lexicon: "helm",
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm301.js

@@ -0,0 +1,31 @@
+/**
+ * WHM301: At least one test should be defined for application charts.
+ */
+import { getChartFiles, parseChartYaml } from "./helm-helpers.js";
+export const whm301 = {
+    id: "WHM301",
+    description: "Application charts should include at least one Helm test",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            const chartYaml = files["Chart.yaml"];
+            if (!chartYaml)
+                continue;
+            const parsed = parseChartYaml(chartYaml);
+            if (parsed.type === "library")
+                continue;
+            // Check if any template has helm.sh/hook: test
+            const hasTest = Object.entries(files).some(([filename, content]) => filename.startsWith("templates/") && content.includes("helm.sh/hook: test"));
+            if (!hasTest) {
+                diagnostics.push({
+                    checkId: "WHM301",
+                    severity: "info",
+                    message: "No Helm test defined — consider adding a HelmTest for chart validation",
+                    lexicon: "helm",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm302.js

@@ -0,0 +1,33 @@
+/**
+ * WHM302: Resource limits should be set (via values or defaults).
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm302 = {
+    id: "WHM302",
+    description: "Container resources (limits/requests) should be set via values or defaults",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                // Check for workload types with containers
+                const hasContainers = content.includes("containers:");
+                const hasResources = content.includes("resources:") || content.includes(".Values.resources");
+                if (hasContainers && !hasResources) {
+                    diagnostics.push({
+                        checkId: "WHM302",
+                        severity: "info",
+                        message: `${filename} has containers but no resource limits — consider using toYaml(values.resources) or setting defaults`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm401.js

@@ -0,0 +1,52 @@
+/**
+ * WHM401: Image uses `:latest` tag or no tag.
+ *
+ * Scans template `image:` lines for literal values (not `.Values` refs)
+ * ending in `:latest` or missing `:`.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm401 = {
+    id: "WHM401",
+    description: "Container images should not use :latest tag or omit tag entirely",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                for (const line of content.split("\n")) {
+                    const trimmed = line.trim();
+                    if (!trimmed.startsWith("image:"))
+                        continue;
+                    const value = trimmed.slice("image:".length).trim();
+                    // Skip template references
+                    if (value.includes(".Values") || value.includes("{{"))
+                        continue;
+                    // Check for :latest or no tag
+                    if (value.endsWith(":latest") || value.endsWith(":latest'") || value.endsWith(':latest"')) {
+                        diagnostics.push({
+                            checkId: "WHM401",
+                            severity: "warning",
+                            message: `${filename}: image uses :latest tag — pin to a specific version for reproducible deployments`,
+                            entity: filename,
+                            lexicon: "helm",
+                        });
+                    }
+                    else if (value && !value.includes(":") && !value.includes("{{")) {
+                        diagnostics.push({
+                            checkId: "WHM401",
+                            severity: "warning",
+                            message: `${filename}: image has no tag — defaults to :latest, pin to a specific version`,
+                            entity: filename,
+                            lexicon: "helm",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm402.js

@@ -0,0 +1,38 @@
+/**
+ * WHM402: No `runAsNonRoot` security context.
+ *
+ * For files with `containers:`, checks for `runAsNonRoot: true` or
+ * a `.Values.securityContext` reference.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm402 = {
+    id: "WHM402",
+    description: "Containers should set runAsNonRoot in security context",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                const hasContainers = content.includes("containers:");
+                if (!hasContainers)
+                    continue;
+                const hasRunAsNonRoot = content.includes("runAsNonRoot: true") || content.includes("runAsNonRoot: true");
+                const hasSecurityContextRef = content.includes(".Values.securityContext") || content.includes(".Values.podSecurityContext");
+                if (!hasRunAsNonRoot && !hasSecurityContextRef) {
+                    diagnostics.push({
+                        checkId: "WHM402",
+                        severity: "warning",
+                        message: `${filename}: containers lack runAsNonRoot — set securityContext.runAsNonRoot: true or use .Values.securityContext`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm403.js

@@ -0,0 +1,38 @@
+/**
+ * WHM403: No `readOnlyRootFilesystem` security context.
+ *
+ * For files with `containers:`, checks for `readOnlyRootFilesystem: true`
+ * or a `.Values.securityContext` reference.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm403 = {
+    id: "WHM403",
+    description: "Containers should set readOnlyRootFilesystem in security context",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                const hasContainers = content.includes("containers:");
+                if (!hasContainers)
+                    continue;
+                const hasReadOnly = content.includes("readOnlyRootFilesystem: true");
+                const hasSecurityContextRef = content.includes(".Values.securityContext") || content.includes(".Values.podSecurityContext");
+                if (!hasReadOnly && !hasSecurityContextRef) {
+                    diagnostics.push({
+                        checkId: "WHM403",
+                        severity: "info",
+                        message: `${filename}: containers lack readOnlyRootFilesystem — consider setting securityContext.readOnlyRootFilesystem: true`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm404.js

@@ -0,0 +1,30 @@
+/**
+ * WHM404: `privileged: true` found — security risk.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm404 = {
+    id: "WHM404",
+    description: "Containers must not run in privileged mode",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                if (content.includes("privileged: true")) {
+                    diagnostics.push({
+                        checkId: "WHM404",
+                        severity: "error",
+                        message: `${filename}: privileged: true detected — containers should not run in privileged mode`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/whm405.js

@@ -0,0 +1,47 @@
+/**
+ * WHM405: Resource spec missing `cpu`/`memory` in `limits`/`requests`.
+ *
+ * When `resources:` is present (not via `.Values`), validates that
+ * sub-keys `limits` and `requests` with `cpu`/`memory` exist.
+ */
+import { getChartFiles } from "./helm-helpers.js";
+export const whm405 = {
+    id: "WHM405",
+    description: "Resource specs should include cpu and memory in limits/requests",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            const files = getChartFiles(output);
+            for (const [filename, content] of Object.entries(files)) {
+                if (!filename.startsWith("templates/") || filename.endsWith("_helpers.tpl") || filename.endsWith("NOTES.txt"))
+                    continue;
+                if (filename.includes("tests/"))
+                    continue;
+                // Skip if resources are via values
+                if (!content.includes("resources:") || content.includes(".Values.resources"))
+                    continue;
+                const hasLimits = content.includes("limits:");
+                const hasRequests = content.includes("requests:");
+                if (!hasLimits && !hasRequests)
+                    continue;
+                const hasCpu = content.includes("cpu:");
+                const hasMemory = content.includes("memory:");
+                if (!hasCpu || !hasMemory) {
+                    const missing = [];
+                    if (!hasCpu)
+                        missing.push("cpu");
+                    if (!hasMemory)
+                        missing.push("memory");
+                    diagnostics.push({
+                        checkId: "WHM405",
+                        severity: "warning",
+                        message: `${filename}: resource spec missing ${missing.join(" and ")} — set both cpu and memory in limits/requests`,
+                        entity: filename,
+                        lexicon: "helm",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};