@intentius/chant-lexicon-helm 0.13.0 → 0.15.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b0be35edf9d26eb7bfd1eaefb678c7e1090b063afb2650fcf7bd4dec32bafc21",
+    "manifest.json": "e9c45b71032df595b1ec2b896d2d415658e96303870f93d6633570f1dd70fc2d",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -34,5 +34,5 @@
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "0b2b503e309bb233fbf8e404968e72919f47d1c897adeba9c735260e915de664"
+  "composite": "ddee3d896fa76b48a1f3ce60db8bb60356aab56fd43a9a50e53e1446c9de7e0e"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The helm lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WHM Helm-chart rules). Contributed via helmPlugin.auditCatalog() (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const helmAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAsBrD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAS7F,eAAO,MAAM,UAAU,EAAE,aAsWxB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAU7F,eAAO,MAAM,UAAU,EAAE,aAuWxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -69,6 +69,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.0"
+    "@intentius/chant": "^0.15.0"
   }
 }

package/src/lint/audit-catalog.ts

@@ -0,0 +1,29 @@
+/**
+ * The helm lexicon's chant audit catalog — metadata for its post-synth rules
+ * (WHM Helm-chart rules). Contributed via helmPlugin.auditCatalog() (#687).
+ */
+import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+
+export const helmAuditCatalog: Record<string, RuleMeta> = {
+  WHM005: auditRule("WHM005", "report-only", "guidance", "Sub-chart wrapper with no templates", "Deploy the upstream chart directly instead of an empty wrapper.", { category: "best-practice" }),
+  WHM101: auditRule("WHM101", "merge-worthy", "guidance", "Chart.yaml missing required fields", "Set apiVersion (v2), name, and version in Chart.yaml.", { category: "correctness" }),
+  WHM102: auditRule("WHM102", "report-only", "guidance", "Missing values.schema.json", "Add a values.schema.json to validate values.", { category: "best-practice" }),
+  WHM103: auditRule("WHM103", "merge-worthy", "guidance", "Invalid Go template syntax", "Fix the unbalanced template braces.", { category: "correctness" }),
+  WHM104: auditRule("WHM104", "report-only", "guidance", "Missing NOTES.txt", "Add templates/NOTES.txt for application charts.", { category: "best-practice" }),
+  WHM105: auditRule("WHM105", "report-only", "guidance", "Missing _helpers.tpl", "Add templates/_helpers.tpl.", { category: "best-practice" }),
+  WHM201: auditRule("WHM201", "report-only", "guidance", "Missing standard Helm labels", "Add the recommended app.kubernetes.io labels.", { category: "best-practice" }),
+  WHM202: auditRule("WHM202", "report-only", "guidance", "Hook weights undefined", "Define hook weights when multiple hooks exist.", { category: "best-practice" }),
+  WHM203: auditRule("WHM203", "report-only", "guidance", "Undocumented values", "Document values via schema or comments.", { category: "best-practice" }),
+  WHM204: auditRule("WHM204", "report-only", "guidance", "Dependencies pinned, not ranged", "Use semver ranges for chart dependencies.", { category: "best-practice" }),
+  WHM301: auditRule("WHM301", "report-only", "guidance", "No Helm test", "Add at least one Helm test for application charts.", { category: "best-practice" }),
+  WHM302: auditRule("WHM302", "report-only", "guidance", "Container resources not set", "Set limits/requests via values or defaults.", { category: "best-practice" }),
+  WHM401: auditRule("WHM401", "merge-worthy", "guidance", "Container image uses :latest or no tag", "Pin the image to an explicit version tag.", { authority: [SCORECARD_PINNED] }),
+  WHM402: auditRule("WHM402", "merge-worthy", "guidance", "Container may run as root", "Set runAsNonRoot in the security context.", { authority: [K8S_PSS] }),
+  WHM403: auditRule("WHM403", "merge-worthy", "guidance", "Root filesystem writable", "Set readOnlyRootFilesystem.", { authority: [K8S_PSS] }),
+  WHM404: auditRule("WHM404", "merge-worthy", "guidance", "Privileged container", "Remove privileged mode.", { authority: [K8S_PSS] }),
+  WHM405: auditRule("WHM405", "report-only", "guidance", "Resource specs missing cpu/memory", "Set cpu and memory in limits/requests.", { category: "best-practice" }),
+  WHM406: auditRule("WHM406", "report-only", "guidance", "CRDs in crds/ are never upgraded", "Manage CRD upgrades outside Helm or via a separate chart.", { category: "best-practice" }),
+  WHM407: auditRule("WHM407", "merge-worthy", "guidance", "Inline Secret data", "Use ExternalSecret/SealedSecret instead of inline Secret data.", { authority: [K8S_SECRETS] }),
+  WHM501: auditRule("WHM501", "report-only", "guidance", "Unused values key", "Remove values defined but never referenced.", { category: "best-practice" }),
+  WHM502: auditRule("WHM502", "merge-worthy", "guidance", "Deprecated/invalid Kubernetes API version", "Update to a supported apiVersion.", { category: "correctness" }),
+};

package/src/lsp/completions.test.ts

@@ -42,7 +42,7 @@ describe.skipIf(!hasGenerated)("helmCompletions", () => {
     }
   });
 
-  test("limits results to 50", async () => {
+  test("caps the unfiltered `new ` dump", async () => {
     const { helmCompletions } = await import("./completions");
     const ctx = {
       uri: "file:///test.ts",
@@ -53,7 +53,8 @@ describe.skipIf(!hasGenerated)("helmCompletions", () => {
     };
 
     const items = helmCompletions(ctx);
-    expect(items.length).toBeLessThanOrEqual(50);
+    // Bare `new ` returns a bounded sample; a typed prefix returns all matches (#600).
+    expect(items.length).toBeLessThanOrEqual(100);
   });
 
   test("returns empty for non-matching context", async () => {

package/src/plugin.ts

@@ -9,6 +9,7 @@ import type { LexiconPlugin, IntrinsicDef, InitTemplateSet } from "@intentius/ch
 import { detectTemplate } from "./detect";
 import { discoverLintRules } from "@intentius/chant/lint/discover";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { helmAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader, createDiffTool } from "@intentius/chant/lexicon-plugin-helpers";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
@@ -16,6 +17,7 @@ import { helmSerializer } from "./serializer";
 
 export const helmPlugin: LexiconPlugin = {
   name: "helm",
+  auditCatalog: () => helmAuditCatalog,
   serializer: helmSerializer,
 
   lintRules() {