@intentius/chant-lexicon-k8s 0.124.31 → 0.124.33

package/dist/lint/post-synth/wk8605.js

@@ -0,0 +1,124 @@
+/**
+ * WK8605: a collector config reads the node, and its workload doesn't give it the node
+ *
+ * `k8sattributes` filtering to its node by `filter.node_from_env_var`, and
+ * `kubeletstats` addressing the kubelet by `${env:K8S_NODE_NAME}`, need that
+ * variable set in the pod; unset, the filter matches no pod and the kubelet
+ * address doesn't resolve. `hostmetrics` with `root_path` needs the host root
+ * mounted there, and `filelog` needs the directories it reads mounted from
+ * the host. None of this fails at startup: the collector runs and reports
+ * the container instead of the node, or nothing.
+ *
+ * What a config needs is worked out by `collectorNodeAccess`, the function
+ * `OtelCollector` uses to add it (chant #3103), so the composite's own
+ * output passes and this fires on hand-written workloads. Only the
+ * containers that pass `--config` count (every container when none does). A variable
+ * counts as set whatever its source; a mount counts when a hostPath volume
+ * covers the path. Whether the container may read root-owned log files is
+ * not checked, since that depends on the runtime. One build root at a time
+ * (chant #1939).
+ */
+import { docsToManifests, extractContainers, extractPodSpec } from "./k8s-helpers.js";
+import { collectorPlacements, describePlacement, isOperatorCollector } from "./otel-placement-helpers.js";
+import { collectorNodeAccess } from "../../composites/otel-collector-node.js";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function within(path, dir) {
+    const d = dir.replace(/\/+$/, "");
+    return d === "" || path === d || path.startsWith(`${d}/`);
+}
+/**
+ * The containers that run a collector: those passing `--config`, or every
+ * container when none does. A sidecar's variables and mounts don't count.
+ */
+function collectorContainers(workload) {
+    // An OpenTelemetryCollector's `spec.env` and `spec.volumeMounts` are the collector container's own.
+    if (isOperatorCollector(workload))
+        return [{ env: workload.spec?.env, volumeMounts: workload.spec?.volumeMounts }];
+    const all = extractContainers(workload);
+    const withConfig = all.filter((c) => [...(Array.isArray(c.command) ? c.command : []), ...(Array.isArray(c.args) ? c.args : [])].some((a) => typeof a === "string" && (a === "--config" || a.startsWith("--config="))));
+    return withConfig.length > 0 ? withConfig : all;
+}
+/** Each container mount backed by a hostPath volume, as [host path, container path]. */
+function hostMounts(workload, containers) {
+    const pod = isOperatorCollector(workload) ? workload.spec : extractPodSpec(workload);
+    const hostPaths = new Map();
+    for (const v of Array.isArray(pod?.volumes) ? pod.volumes : []) {
+        if (isRecord(v) && typeof v.name === "string" && isRecord(v.hostPath) && typeof v.hostPath.path === "string") {
+            hostPaths.set(v.name, v.hostPath.path);
+        }
+    }
+    const out = [];
+    for (const c of containers) {
+        for (const m of Array.isArray(c.volumeMounts) ? c.volumeMounts : []) {
+            if (!isRecord(m) || typeof m.name !== "string" || typeof m.mountPath !== "string")
+                continue;
+            const host = hostPaths.get(m.name);
+            if (host !== undefined)
+                out.push([host.replace(/\/+$/, "") || "/", m.mountPath.replace(/\/+$/, "") || "/"]);
+        }
+    }
+    return out;
+}
+/** Whether some hostPath mount gives the container the host path a requirement names, at its path. */
+function covered(need, mounts) {
+    return mounts.some(([host, path]) => {
+        // hostmetrics takes the host root or parts of it anywhere at or under root_path.
+        if (need.partial && within(path, need.mountPath)) {
+            const rel = path.slice(need.mountPath.length);
+            return host === (rel || "/");
+        }
+        if (!within(need.mountPath, path))
+            return false;
+        const rel = need.mountPath.slice(path === "/" ? 0 : path.length);
+        const expected = `${host === "/" ? "" : host}${rel}` || "/";
+        return expected === need.hostPath;
+    });
+}
+function envNames(containers) {
+    const names = new Set();
+    for (const c of containers) {
+        for (const e of Array.isArray(c.env) ? c.env : []) {
+            if (isRecord(e) && typeof e.name === "string")
+                names.add(e.name);
+        }
+    }
+    return names;
+}
+export const wk8605 = {
+    id: "WK8605",
+    description: "OpenTelemetry Collector config reads the node (k8sattributes filtered to its node, kubeletstats, hostmetrics root_path, filelog) but its workload doesn't set the node name variable or mount the host paths. Sees one build root at a time (chant #1939).",
+    check(ctx) {
+        const diagnostics = [];
+        for (const p of collectorPlacements(docsToManifests(ctx))) {
+            const need = collectorNodeAccess(p.config);
+            if (need.env.length === 0 && need.mounts.length === 0)
+                continue;
+            const containers = collectorContainers(p.workload);
+            const env = envNames(containers);
+            const mounts = hostMounts(p.workload, containers);
+            const gaps = [];
+            for (const v of need.env) {
+                if (!env.has(v.name))
+                    gaps.push(`no ${v.name} variable (set it from ${v.valueFrom.fieldRef.fieldPath} with the downward API)`);
+            }
+            for (const m of need.mounts) {
+                if (!covered(m, mounts))
+                    gaps.push(`${m.component} reads host ${m.hostPath} at ${m.mountPath}, which no hostPath volume mounts`);
+            }
+            if (gaps.length === 0)
+                continue;
+            diagnostics.push({
+                checkId: "WK8605",
+                severity: "warning",
+                message: `${describePlacement(p)} runs a collector config that reads the node (${p.where}), but: ${gaps.join("; ")}. ` +
+                    `Without them the collector reports on its own container, or nothing. OtelCollector adds these from the config; ` +
+                    `in a hand-written workload, add them read-only.`,
+                entity: p.name,
+                lexicon: "k8s",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wk8606.js

@@ -0,0 +1,22 @@
+/**
+ * WK8606: the prometheus rule checks over PrometheusRule groups
+ *
+ * `PrometheusRule.spec.groups` is a rule file's `groups`. `chant build` gives
+ * each lexicon's checks only that lexicon's output, so the prometheus
+ * lexicon's PROM checks never see a rule that lives in the k8s output. This
+ * check runs them there: every PrometheusRule's groups go through the
+ * prometheus lexicon's rule-file checks (PROM101-PROM107, PROM211,
+ * PROM213-PROM219; PROM212 stays opt-in).
+ *
+ * Findings keep the PROM ids, so `lint.rules` and suppressions name one id
+ * wherever the rules live. Each message names the PrometheusRule's namespace
+ * and name. Needs only the k8s lexicon in the project.
+ */
+import { prometheusRuleDiagnostics } from "@intentius/chant-lexicon-prometheus/lint/post-synth/prom-helpers";
+export const wk8606 = {
+    id: "WK8606",
+    description: "A PrometheusRule's groups fail the prometheus lexicon's rule-file checks; findings are reported under their PROM ids, naming the PrometheusRule.",
+    check(ctx) {
+        return prometheusRuleDiagnostics(ctx);
+    },
+};

package/dist/lint/post-synth/wk8701.js

@@ -0,0 +1,31 @@
+/**
+ * WK8701: a PrometheusRule that no Prometheus or ThanosRuler selects
+ *
+ * A Prometheus or ThanosRuler runs the rules whose labels match its `ruleSelector` in the namespaces its
+ * `ruleNamespaceSelector` picks. A PrometheusRule neither selects is accepted by the API server and then
+ * never evaluated: no error, no alert.
+ *
+ * Selection is worked out from the manifests in one build root (chant #1939),
+ * by the operator's rules: a null object selector matches nothing, `{}`
+ * matches all; a null namespace selector matches only the selecting resource's
+ * own namespace, `{}` every namespace. Silent when the build has no Prometheus or ThanosRuler, since the
+ * stack is often installed separately. A selector on a namespace label the
+ * build cannot read (the Namespace is not declared in it) counts as selecting.
+ */
+import { describe, monitoringKind, nameOf, selectionContext, unselected } from "./monitoring-selection-helpers.js";
+export const wk8701 = {
+    id: "WK8701",
+    description: "A PrometheusRule that no Prometheus or ThanosRuler in the build selects through ruleSelector and ruleNamespaceSelector is never evaluated. A null selector matches nothing, {} matches all. Silent when the build has no Prometheus or ThanosRuler.",
+    check(ctx) {
+        const sc = selectionContext(ctx);
+        const selectors = [...monitoringKind(sc.manifests, "Prometheus"), ...monitoringKind(sc.manifests, "ThanosRuler")];
+        return unselected(sc, monitoringKind(sc.manifests, "PrometheusRule"), selectors, () => ["ruleSelector", "ruleNamespaceSelector"]).map((r) => ({
+            checkId: "WK8701",
+            severity: "warning",
+            message: `${describe(r)} is selected by no Prometheus or ThanosRuler in this build, so the operator never loads it and its rules are never evaluated. ` +
+                `Match its labels (and namespace) with ruleSelector and ruleNamespaceSelector: null selects nothing, {} selects all.`,
+            entity: nameOf(r),
+            lexicon: "k8s",
+        }));
+    },
+};

package/dist/lint/post-synth/wk8702.js

@@ -0,0 +1,37 @@
+/**
+ * WK8702: a ServiceMonitor, PodMonitor, Probe or ScrapeConfig that no Prometheus or PrometheusAgent selects
+ *
+ * A Prometheus or PrometheusAgent scrapes the monitors whose labels match its `serviceMonitorSelector`,
+ * `podMonitorSelector`, `probeSelector` or `scrapeConfigSelector`, in the namespaces the matching
+ * `*NamespaceSelector` picks. A monitor none selects is accepted and then never scraped.
+ *
+ * Selection is worked out from the manifests in one build root (chant #1939),
+ * by the operator's rules: a null object selector matches nothing, `{}`
+ * matches all; a null namespace selector matches only the selecting resource's
+ * own namespace, `{}` every namespace. Silent when the build has no Prometheus or PrometheusAgent, since the
+ * stack is often installed separately. A selector on a namespace label the
+ * build cannot read (the Namespace is not declared in it) counts as selecting.
+ */
+import { describe, monitoringKind, nameOf, selectionContext, unselected } from "./monitoring-selection-helpers.js";
+export const wk8702 = {
+    id: "WK8702",
+    description: "A ServiceMonitor, PodMonitor, Probe or ScrapeConfig that no Prometheus or PrometheusAgent in the build selects is never scraped. A null selector matches nothing, {} matches all. Silent when the build has no Prometheus or PrometheusAgent.",
+    check(ctx) {
+        const sc = selectionContext(ctx);
+        const selectors = [...monitoringKind(sc.manifests, "Prometheus"), ...monitoringKind(sc.manifests, "PrometheusAgent")];
+        const out = [];
+        for (const [kind, prefix] of [["ServiceMonitor", "serviceMonitor"], ["PodMonitor", "podMonitor"], ["Probe", "probe"], ["ScrapeConfig", "scrapeConfig"]]) {
+            for (const m of unselected(sc, monitoringKind(sc.manifests, kind), selectors, () => [`${prefix}Selector`, `${prefix}NamespaceSelector`])) {
+                out.push({
+                    checkId: "WK8702",
+                    severity: "warning",
+                    message: `${describe(m)} is selected by no Prometheus or PrometheusAgent in this build, so it is never scraped. ` +
+                        `Match its labels (and namespace) with ${prefix}Selector and ${prefix}NamespaceSelector: null selects nothing, {} selects all.`,
+                    entity: nameOf(m),
+                    lexicon: "k8s",
+                });
+            }
+        }
+        return out;
+    },
+};

package/dist/lint/post-synth/wk8703.js

@@ -0,0 +1,31 @@
+/**
+ * WK8703: an AlertmanagerConfig that no Alertmanager selects
+ *
+ * An Alertmanager merges the AlertmanagerConfigs whose labels match its `alertmanagerConfigSelector` in the
+ * namespaces its `alertmanagerConfigNamespaceSelector` picks. One neither selects is accepted and then
+ * never routes an alert.
+ *
+ * Selection is worked out from the manifests in one build root (chant #1939),
+ * by the operator's rules: a null object selector matches nothing, `{}`
+ * matches all; a null namespace selector matches only the selecting resource's
+ * own namespace, `{}` every namespace. Silent when the build has no Alertmanager, since the
+ * stack is often installed separately. A selector on a namespace label the
+ * build cannot read (the Namespace is not declared in it) counts as selecting.
+ */
+import { describe, monitoringKind, nameOf, selectionContext, unselected } from "./monitoring-selection-helpers.js";
+export const wk8703 = {
+    id: "WK8703",
+    description: "An AlertmanagerConfig that no Alertmanager in the build selects through alertmanagerConfigSelector and alertmanagerConfigNamespaceSelector never routes an alert. A null selector matches nothing, {} matches all. Silent when the build has no Alertmanager.",
+    check(ctx) {
+        const sc = selectionContext(ctx);
+        const configs = monitoringKind(sc.manifests, "AlertmanagerConfig");
+        return unselected(sc, configs, monitoringKind(sc.manifests, "Alertmanager"), () => ["alertmanagerConfigSelector", "alertmanagerConfigNamespaceSelector"]).map((c) => ({
+            checkId: "WK8703",
+            severity: "warning",
+            message: `${describe(c)} is selected by no Alertmanager in this build, so its routes and receivers are never used. ` +
+                `Match its labels (and namespace) with alertmanagerConfigSelector and alertmanagerConfigNamespaceSelector: null selects nothing, {} selects all.`,
+            entity: nameOf(c),
+            lexicon: "k8s",
+        }));
+    },
+};

package/dist/lint/post-synth/wk8704.js

@@ -0,0 +1,135 @@
+/**
+ * WK8704: a ServiceMonitor or PodMonitor that selects no Service or pod, or names a port that is not there
+ *
+ * A ServiceMonitor's `selector` picks Services (in its own namespace, the
+ * `namespaceSelector.matchNames` ones, or every namespace with `any: true`),
+ * and each `endpoints[].port` names a port on them. A PodMonitor's `selector`
+ * picks pods, and each `podMetricsEndpoints[].port` names a container port.
+ * When nothing matches, or the port name is on none of the matches, Prometheus
+ * scrapes nothing and says nothing. This check needs no Prometheus in the
+ * build: it reads the monitor against the Services and workloads declared
+ * beside it.
+ *
+ * Pods come from the pod templates of Deployment, StatefulSet, DaemonSet, Job
+ * and CronJob, and from Pods themselves. An empty `selector` ({}) matches
+ * everything, as the operator does. Only a port given by name is checked;
+ * `targetPort` and `portNumber` are left alone. One build root at a time
+ * (chant #1939): a Service or workload installed from another root is not seen.
+ */
+import { extractContainers } from "./k8s-helpers.js";
+import { describe, labelsOf, matchLabelSelector, monitoringKind, nameOf, namespaceOf, selectionContext } from "./monitoring-selection-helpers.js";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Whether a monitor looks in this namespace: its own, `matchNames`, or all of them with `any`. */
+function reaches(monitor, namespace) {
+    const ns = monitor.spec?.namespaceSelector;
+    if (isRecord(ns)) {
+        if (ns.any === true)
+            return true;
+        if (Array.isArray(ns.matchNames) && ns.matchNames.length > 0)
+            return ns.matchNames.includes(namespace);
+    }
+    return namespaceOf(monitor) === namespace;
+}
+/** The labels a pod from this workload carries, and its manifest to read ports from. */
+function podsOf(manifests) {
+    const out = [];
+    for (const m of manifests) {
+        const spec = (m.spec ?? {});
+        if (m.kind === "Pod") {
+            out.push({ manifest: m, labels: labelsOf(m) });
+        }
+        else if (m.kind === "Deployment" || m.kind === "StatefulSet" || m.kind === "DaemonSet" || m.kind === "Job") {
+            out.push({ manifest: m, labels: labelsOf({ metadata: spec.template?.metadata }) });
+        }
+        else if (m.kind === "CronJob") {
+            out.push({ manifest: m, labels: labelsOf({ metadata: spec.jobTemplate?.spec?.template?.metadata }) });
+        }
+    }
+    return out;
+}
+function containerPortNames(workload) {
+    const names = new Set();
+    for (const c of extractContainers(workload)) {
+        for (const p of Array.isArray(c.ports) ? c.ports : []) {
+            if (isRecord(p) && typeof p.name === "string")
+                names.add(p.name);
+        }
+    }
+    return names;
+}
+function servicePortNames(service) {
+    const names = new Set();
+    const ports = service.spec?.ports;
+    for (const p of Array.isArray(ports) ? ports : []) {
+        if (isRecord(p) && typeof p.name === "string")
+            names.add(p.name);
+    }
+    return names;
+}
+export const wk8704 = {
+    id: "WK8704",
+    description: "A ServiceMonitor whose selector matches no Service in the build, or whose endpoints[].port names no port on the matched Services; the same for a PodMonitor against pod container ports. Needs no Prometheus in the build. Sees one build root at a time (chant #1939).",
+    check(ctx) {
+        const { manifests } = selectionContext(ctx);
+        const out = [];
+        const diag = (m, message) => ({
+            checkId: "WK8704",
+            severity: "warning",
+            message,
+            entity: nameOf(m),
+            lexicon: "k8s",
+        });
+        const services = manifests.filter((m) => m.kind === "Service" && (m.apiVersion === "v1" || m.apiVersion === undefined));
+        for (const sm of monitoringKind(manifests, "ServiceMonitor")) {
+            const spec = (sm.spec ?? {});
+            // A ServiceMonitor's selector is required; treat a missing one like {}.
+            const selector = isRecord(spec.selector) ? spec.selector : {};
+            const matched = services.filter((s) => reaches(sm, namespaceOf(s)) && matchLabelSelector(selector, labelsOf(s)) !== "no");
+            if (matched.length === 0) {
+                out.push(diag(sm, `${describe(sm)} has a selector that matches no Service in this build (looking in ${where(sm)}), so Prometheus scrapes nothing for it. Make spec.selector match the labels on the Service, or fix namespaceSelector.`));
+                continue;
+            }
+            const known = new Set();
+            for (const s of matched)
+                for (const n of servicePortNames(s))
+                    known.add(n);
+            for (const e of Array.isArray(spec.endpoints) ? spec.endpoints : []) {
+                if (!isRecord(e) || typeof e.port !== "string" || known.has(e.port))
+                    continue;
+                out.push(diag(sm, `${describe(sm)} scrapes endpoint port "${e.port}", but the Service(s) it selects (${matched.map(nameOf).join(", ")}) declare no port with that name${known.size > 0 ? ` (they have: ${[...known].join(", ")})` : ""}. Name the Service port, or point the endpoint at an existing one.`));
+            }
+        }
+        const pods = podsOf(manifests);
+        for (const pm of monitoringKind(manifests, "PodMonitor")) {
+            const spec = (pm.spec ?? {});
+            const selector = isRecord(spec.selector) ? spec.selector : {};
+            const matched = pods.filter((p) => reaches(pm, namespaceOf(p.manifest)) && matchLabelSelector(selector, p.labels) !== "no");
+            if (matched.length === 0) {
+                out.push(diag(pm, `${describe(pm)} has a selector that matches no pod in this build (looking in ${where(pm)}), so Prometheus scrapes nothing for it. Make spec.selector match the pod template labels, or fix namespaceSelector.`));
+                continue;
+            }
+            const known = new Set();
+            for (const p of matched)
+                for (const n of containerPortNames(p.manifest))
+                    known.add(n);
+            for (const e of Array.isArray(spec.podMetricsEndpoints) ? spec.podMetricsEndpoints : []) {
+                if (!isRecord(e) || typeof e.port !== "string" || known.has(e.port))
+                    continue;
+                out.push(diag(pm, `${describe(pm)} scrapes container port "${e.port}", but the pods it selects (${matched.map((p) => nameOf(p.manifest)).join(", ")}) declare no container port with that name${known.size > 0 ? ` (they have: ${[...known].join(", ")})` : ""}. Name the container port, or point the endpoint at an existing one.`));
+            }
+        }
+        return out;
+    },
+};
+function where(m) {
+    const ns = m.spec?.namespaceSelector;
+    if (isRecord(ns)) {
+        if (ns.any === true)
+            return "every namespace";
+        if (Array.isArray(ns.matchNames) && ns.matchNames.length > 0)
+            return `namespace ${ns.matchNames.join(", ")}`;
+    }
+    return `namespace ${namespaceOf(m)}`;
+}

package/dist/lint/post-synth/wk8705.js

@@ -0,0 +1,38 @@
+/**
+ * WK8705: a Prometheus whose four monitor selectors are all null
+ *
+ * A Prometheus picks the ServiceMonitors, PodMonitors, Probes and
+ * ScrapeConfigs to scrape with `serviceMonitorSelector`, `podMonitorSelector`,
+ * `probeSelector` and `scrapeConfigSelector`. A null selector (absent counts
+ * as null) matches nothing, so a Prometheus with all four null selects no
+ * monitor at all and scrapes only what `additionalScrapeConfigs` and its own
+ * config hold. `{}` matches every monitor in the selected namespaces. This is
+ * the usual way a fresh Prometheus ends up scraping nothing.
+ *
+ * A Prometheus with `additionalScrapeConfigs` set still reports: that
+ * is a deliberate setup the finding names, not one it hides. The message says
+ * so, and a suppression is the way to accept it.
+ */
+import { describe, monitoringKind, nameOf, selectionContext } from "./monitoring-selection-helpers.js";
+const SELECTORS = ["serviceMonitorSelector", "podMonitorSelector", "probeSelector", "scrapeConfigSelector"];
+export const wk8705 = {
+    id: "WK8705",
+    description: "A Prometheus whose serviceMonitorSelector, podMonitorSelector, probeSelector and scrapeConfigSelector are all null selects no monitor, so the operator scrapes nothing from ServiceMonitors, PodMonitors, Probes or ScrapeConfigs.",
+    check(ctx) {
+        const { manifests } = selectionContext(ctx);
+        return monitoringKind(manifests, "Prometheus")
+            .filter((p) => {
+            const spec = (p.spec ?? {});
+            return SELECTORS.every((k) => spec[k] === null || spec[k] === undefined);
+        })
+            .map((p) => ({
+            checkId: "WK8705",
+            severity: "warning",
+            message: `${describe(p)} has ${SELECTORS.join(", ")} all null, so it selects no ServiceMonitor, PodMonitor, Probe or ScrapeConfig and scrapes only its own config` +
+                `${p.spec?.additionalScrapeConfigs ? " and additionalScrapeConfigs" : ""}. ` +
+                `Set the selector for each monitor kind it should pick up ({} selects all in the selected namespaces).`,
+            entity: nameOf(p),
+            lexicon: "k8s",
+        }));
+    },
+};

package/dist/lint/rules/argo-appset-single-project.js

@@ -0,0 +1,56 @@
+import { findResourceLiterals, getNestedObject, getNestedString, lineCol } from "./argo-ast.js";
+/**
+ * ARGO004: ApplicationSet template must scope to a single AppProject
+ *
+ * An `ApplicationSet` generates many Applications from one template. The
+ * template's `spec.project` should name a single, static `AppProject` so every
+ * generated Application lands in the same security boundary. If `project` is
+ * missing, the generated Applications fall back to whatever default and dodge
+ * project-level RBAC; if it is templated with a generator placeholder
+ * (`{{...}}`) the set sprays Applications across many projects, which defeats
+ * the point of an AppProject as a guardrail.
+ *
+ * Bad:  new ApplicationSet({ spec: { template: { spec: { repoURL: "..." } } } })          // no project
+ * Bad:  new ApplicationSet({ spec: { template: { spec: { project: "{{path.basename}}" } } } }) // templated
+ * Good: new ApplicationSet({ spec: { template: { spec: { project: "team-a" } } } })
+ */
+export const argoAppSetSingleProjectRule = {
+    id: "ARGO004",
+    severity: "warning",
+    category: "correctness",
+    description: "ApplicationSet template must scope to a single static AppProject (spec.template.spec.project)",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        for (const { literal } of findResourceLiterals(sourceFile, new Set(["ApplicationSet"]))) {
+            const templateSpec = getNestedObject(literal, ["spec", "template", "spec"]);
+            // No template/spec to inspect — leave it to other tooling.
+            if (!templateSpec)
+                continue;
+            const project = getNestedString(literal, ["spec", "template", "spec", "project"]);
+            const { line, column } = lineCol(sourceFile, templateSpec);
+            if (project === undefined) {
+                diagnostics.push({
+                    file: sourceFile.fileName,
+                    line,
+                    column,
+                    ruleId: "ARGO004",
+                    severity: "warning",
+                    message: "ApplicationSet template has no spec.project — scope it to a single AppProject so every generated Application inherits the same RBAC boundary.",
+                });
+                continue;
+            }
+            if (project.includes("{{")) {
+                diagnostics.push({
+                    file: sourceFile.fileName,
+                    line,
+                    column,
+                    ruleId: "ARGO004",
+                    severity: "warning",
+                    message: `ApplicationSet template scopes spec.project to a generator placeholder ("${project}"), spraying Applications across projects. Pin it to a single static AppProject.`,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/argo-ast.js

@@ -0,0 +1,94 @@
+/**
+ * Shared AST helpers for the Argo declarative lint rules (ARGO001, ARGO004).
+ *
+ * The Argo CRDs are constructed like any other k8s resource —
+ * `new Application({ metadata, spec })` / `new ApplicationSet({ ... })`. These
+ * helpers walk the object-literal first argument so a rule can read a nested
+ * property by path without re-implementing the traversal each time.
+ */
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * Find the object-literal first argument of every `new <Kind>(...)` expression
+ * in the file, where Kind is one of the supplied resource kinds.
+ */
+export function findResourceLiterals(sourceFile, kinds) {
+    const found = [];
+    function visit(node) {
+        if (ts.isNewExpression(node) &&
+            ts.isIdentifier(node.expression) &&
+            kinds.has(node.expression.text) &&
+            node.arguments &&
+            node.arguments.length > 0 &&
+            ts.isObjectLiteralExpression(node.arguments[0])) {
+            found.push({
+                kind: node.expression.text,
+                literal: node.arguments[0],
+                node,
+            });
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return found;
+}
+/** Read the initializer node for `key` on an object literal, if present. */
+export function getProp(obj, key) {
+    for (const prop of obj.properties) {
+        if (ts.isPropertyAssignment(prop) &&
+            (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) &&
+            prop.name.text === key) {
+            return prop.initializer;
+        }
+    }
+    return undefined;
+}
+/** Read a nested object literal by walking `path` (each segment an object). */
+export function getNestedObject(obj, path) {
+    let current = obj;
+    for (const segment of path) {
+        if (!current)
+            return undefined;
+        const next = getProp(current, segment);
+        current = next && ts.isObjectLiteralExpression(next) ? next : undefined;
+    }
+    return current;
+}
+/** Read a string-literal property value by path (last segment is the key). */
+export function getNestedString(obj, path) {
+    const key = path[path.length - 1];
+    const parent = getNestedObject(obj, path.slice(0, -1));
+    if (!parent)
+        return undefined;
+    const value = getProp(parent, key);
+    return value && ts.isStringLiteral(value) ? value.text : undefined;
+}
+/** Read a boolean-literal property value by path (last segment is the key). */
+export function getNestedBoolean(obj, path) {
+    const key = path[path.length - 1];
+    const parent = getNestedObject(obj, path.slice(0, -1));
+    if (!parent)
+        return undefined;
+    const value = getProp(parent, key);
+    if (!value)
+        return undefined;
+    if (value.kind === ts.SyntaxKind.TrueKeyword)
+        return true;
+    if (value.kind === ts.SyntaxKind.FalseKeyword)
+        return false;
+    return undefined;
+}
+/**
+ * True if the literal carries the given annotation key under
+ * `metadata.annotations`, regardless of value.
+ */
+export function hasAnnotation(obj, annotationKey) {
+    const annotations = getNestedObject(obj, ["metadata", "annotations"]);
+    if (!annotations)
+        return false;
+    return getProp(annotations, annotationKey) !== undefined;
+}
+/** Line/column (1-based) for a node, for diagnostics. */
+export function lineCol(sourceFile, node) {
+    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+    return { line: line + 1, column: character + 1 };
+}

package/dist/lint/rules/argo-automated-prune.js

@@ -0,0 +1,59 @@
+import { findResourceLiterals, getNestedBoolean, getNestedString, getProp, hasAnnotation, lineCol, } from "./argo-ast.js";
+/**
+ * ARGO001: Production Application must not enable automated prune
+ *
+ * An Argo CD `Application` whose `syncPolicy.automated.prune` is `true` lets the
+ * controller delete live resources that disappear from git. On a production
+ * Application that is a foot-gun — a bad merge can sweep away running
+ * infrastructure. Require `prune: false` for prod Applications unless the author
+ * opts in explicitly with the `argocd.chant.dev/allow-prune` annotation.
+ *
+ * "Production" is inferred from the Application name, its `metadata.namespace`,
+ * or its `spec.destination.namespace` containing `prod`.
+ *
+ * Bad:  new Application({ metadata: { name: "api-prod" }, spec: { syncPolicy: { automated: { prune: true } } } })
+ * Good: new Application({ metadata: { name: "api-prod" }, spec: { syncPolicy: { automated: { prune: false } } } })
+ * Good: new Application({ metadata: { name: "api-prod", annotations: { "argocd.chant.dev/allow-prune": "true" } }, spec: { syncPolicy: { automated: { prune: true } } } })
+ */
+export const ALLOW_PRUNE_ANNOTATION = "argocd.chant.dev/allow-prune";
+function looksProd(obj) {
+    const candidates = [
+        getNestedString(obj, ["metadata", "name"]),
+        getNestedString(obj, ["metadata", "namespace"]),
+        getNestedString(obj, ["spec", "destination", "namespace"]),
+    ];
+    return candidates.some((v) => v !== undefined && /prod/i.test(v));
+}
+export const argoAutomatedPruneRule = {
+    id: "ARGO001",
+    severity: "warning",
+    category: "correctness",
+    description: "Production Argo Application must not enable syncPolicy.automated.prune without the allow-prune override annotation",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        for (const { literal } of findResourceLiterals(sourceFile, new Set(["Application"]))) {
+            const prune = getNestedBoolean(literal, ["spec", "syncPolicy", "automated", "prune"]);
+            if (prune !== true)
+                continue;
+            if (!looksProd(literal))
+                continue;
+            if (hasAnnotation(literal, ALLOW_PRUNE_ANNOTATION))
+                continue;
+            // Anchor the diagnostic at the `prune` assignment when we can find it.
+            const automated = getProp(literal, "spec");
+            const anchor = automated ?? literal;
+            const { line, column } = lineCol(sourceFile, anchor);
+            const name = getNestedString(literal, ["metadata", "name"]) ?? "(unnamed)";
+            diagnostics.push({
+                file: sourceFile.fileName,
+                line,
+                column,
+                ruleId: "ARGO001",
+                severity: "warning",
+                message: `Production Application "${name}" enables automated prune. Set syncPolicy.automated.prune=false, or opt in explicitly with the "${ALLOW_PRUNE_ANNOTATION}" annotation.`,
+            });
+        }
+        return diagnostics;
+    },
+};