@intentius/chant-lexicon-k8s 0.49.0 → 0.50.0

package/src/lint/post-synth/wk8005.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 const SENSITIVE_NAME_PATTERN = /password|token|key|secret/i;
 
@@ -18,37 +18,32 @@ export const wk8005: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          if (!Array.isArray(container.env)) continue;
-
-          for (const envVar of container.env) {
-            if (
-              typeof envVar.name === "string" &&
-              SENSITIVE_NAME_PATTERN.test(envVar.name) &&
-              envVar.value !== undefined &&
-              envVar.value !== null &&
-              typeof envVar.value === "string" &&
-              envVar.value !== "" &&
-              !envVar.valueFrom
-            ) {
-              diagnostics.push({
-                checkId: "WK8005",
-                severity: "error",
-                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        if (!Array.isArray(container.env)) continue;
+
+        for (const envVar of container.env) {
+          if (
+            typeof envVar.name === "string" &&
+            SENSITIVE_NAME_PATTERN.test(envVar.name) &&
+            envVar.value !== undefined &&
+            envVar.value !== null &&
+            typeof envVar.value === "string" &&
+            envVar.value !== "" &&
+            !envVar.valueFrom
+          ) {
+            diagnostics.push({
+              checkId: "WK8005",
+              severity: "error",
+              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has hardcoded value for sensitive env var "${envVar.name}" — use secretKeyRef instead`,
+              entity: resourceName,
+              lexicon: "k8s",
+            });
           }
         }
       }

package/src/lint/post-synth/wk8006.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8006: PostSynthCheck = {
   id: "WK8006",
@@ -15,49 +15,44 @@ export const wk8006: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          const image = container.image;
-          if (typeof image !== "string" || image === "") continue;
-
-          // Split off digest (@sha256:...) — those are pinned and fine
-          if (image.includes("@")) continue;
-
-          // Extract the tag portion (after the last colon that isn't part of a port)
-          // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
-          const slashIndex = image.lastIndexOf("/");
-          const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
-          const colonIndex = afterSlash.lastIndexOf(":");
-
-          if (colonIndex === -1) {
-            // No tag at all
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        const image = container.image;
+        if (typeof image !== "string" || image === "") continue;
+
+        // Split off digest (@sha256:...) — those are pinned and fine
+        if (image.includes("@")) continue;
+
+        // Extract the tag portion (after the last colon that isn't part of a port)
+        // Images can be: name, name:tag, registry:port/name, registry:port/name:tag
+        const slashIndex = image.lastIndexOf("/");
+        const afterSlash = slashIndex >= 0 ? image.slice(slashIndex + 1) : image;
+        const colonIndex = afterSlash.lastIndexOf(":");
+
+        if (colonIndex === -1) {
+          // No tag at all
+          diagnostics.push({
+            checkId: "WK8006",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
+        } else {
+          const tag = afterSlash.slice(colonIndex + 1);
+          if (tag === "latest") {
             diagnostics.push({
               checkId: "WK8006",
               severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses untagged image "${image}" — specify an explicit version tag`,
+              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
               entity: resourceName,
               lexicon: "k8s",
             });
-          } else {
-            const tag = afterSlash.slice(colonIndex + 1);
-            if (tag === "latest") {
-              diagnostics.push({
-                checkId: "WK8006",
-                severity: "warning",
-                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" uses :latest tag on image "${image}" — use a specific version tag`,
-                entity: resourceName,
-                lexicon: "k8s",
-              });
-            }
           }
         }
       }

package/src/lint/post-synth/wk8041.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 /**
  * Known API key patterns and their descriptions.
@@ -35,33 +35,28 @@ export const wk8041: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
 
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
+      for (const container of containers) {
+        if (!Array.isArray(container.env)) continue;
 
-        for (const container of containers) {
-          if (!Array.isArray(container.env)) continue;
+        for (const envVar of container.env) {
+          if (typeof envVar.value !== "string" || envVar.value === "") continue;
 
-          for (const envVar of container.env) {
-            if (typeof envVar.value !== "string" || envVar.value === "") continue;
-
-            for (const { pattern, label } of API_KEY_PATTERNS) {
-              if (pattern.test(envVar.value)) {
-                diagnostics.push({
-                  checkId: "WK8041",
-                  severity: "error",
-                  message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
-                  entity: resourceName,
-                  lexicon: "k8s",
-                });
-                break; // One match per env var is sufficient
-              }
+          for (const { pattern, label } of API_KEY_PATTERNS) {
+            if (pattern.test(envVar.value)) {
+              diagnostics.push({
+                checkId: "WK8041",
+                severity: "error",
+                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has a ${label} hardcoded in env var "${envVar.name ?? "(unnamed)"}" — use a Secret reference instead`,
+                entity: resourceName,
+                lexicon: "k8s",
+              });
+              break; // One match per env var is sufficient
             }
           }
         }

package/src/lint/post-synth/wk8042.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 const PRIVATE_KEY_PATTERN = /-----BEGIN\s+[\w\s]*PRIVATE KEY-----/;
 
@@ -18,27 +18,22 @@ export const wk8042: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (manifest.kind !== "ConfigMap") continue;
-
-        const resourceName = manifest.metadata?.name ?? "ConfigMap";
-        const data = manifest.data;
-        if (typeof data !== "object" || data === null) continue;
-
-        for (const [key, value] of Object.entries(data)) {
-          if (typeof value === "string" && PRIVATE_KEY_PATTERN.test(value)) {
-            diagnostics.push({
-              checkId: "WK8042",
-              severity: "error",
-              message: `ConfigMap "${resourceName}" contains a private key in data field "${key}" — use a Secret resource instead`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "ConfigMap") continue;
+
+      const resourceName = manifest.metadata?.name ?? "ConfigMap";
+      const data = manifest.data;
+      if (typeof data !== "object" || data === null) continue;
+
+      for (const [key, value] of Object.entries(data)) {
+        if (typeof value === "string" && PRIVATE_KEY_PATTERN.test(value)) {
+          diagnostics.push({
+            checkId: "WK8042",
+            severity: "error",
+            message: `ConfigMap "${resourceName}" contains a private key in data field "${key}" — use a Secret resource instead`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/src/lint/post-synth/wk8101.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8101: PostSynthCheck = {
   id: "WK8101",
@@ -16,46 +16,41 @@ export const wk8101: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (manifest.kind !== "Deployment") continue;
-
-        const resourceName = manifest.metadata?.name ?? "Deployment";
-        const spec = manifest.spec;
-        if (!spec) continue;
-
-        const selector = spec.selector as Record<string, unknown> | undefined;
-        const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
-        if (!matchLabels || typeof matchLabels !== "object") continue;
-
-        const template = spec.template as Record<string, unknown> | undefined;
-        const templateMetadata = template?.metadata as Record<string, unknown> | undefined;
-        const templateLabels = templateMetadata?.labels as Record<string, string> | undefined;
+    for (const manifest of docsToManifests(ctx)) {
+      if (manifest.kind !== "Deployment") continue;
+
+      const resourceName = manifest.metadata?.name ?? "Deployment";
+      const spec = manifest.spec;
+      if (!spec) continue;
+
+      const selector = spec.selector as Record<string, unknown> | undefined;
+      const matchLabels = selector?.matchLabels as Record<string, string> | undefined;
+      if (!matchLabels || typeof matchLabels !== "object") continue;
+
+      const template = spec.template as Record<string, unknown> | undefined;
+      const templateMetadata = template?.metadata as Record<string, unknown> | undefined;
+      const templateLabels = templateMetadata?.labels as Record<string, string> | undefined;
+
+      if (!templateLabels || typeof templateLabels !== "object") {
+        diagnostics.push({
+          checkId: "WK8101",
+          severity: "error",
+          message: `Deployment "${resourceName}" has spec.selector.matchLabels but no spec.template.metadata.labels`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
+        continue;
+      }
 
-        if (!templateLabels || typeof templateLabels !== "object") {
+      for (const [key, value] of Object.entries(matchLabels)) {
+        if (templateLabels[key] !== value) {
           diagnostics.push({
             checkId: "WK8101",
             severity: "error",
-            message: `Deployment "${resourceName}" has spec.selector.matchLabels but no spec.template.metadata.labels`,
+            message: `Deployment "${resourceName}" selector label "${key}=${value}" does not match template label "${key}=${templateLabels[key] ?? '(missing)'}"`,
             entity: resourceName,
             lexicon: "k8s",
           });
-          continue;
-        }
-
-        for (const [key, value] of Object.entries(matchLabels)) {
-          if (templateLabels[key] !== value) {
-            diagnostics.push({
-              checkId: "WK8101",
-              severity: "error",
-              message: `Deployment "${resourceName}" selector label "${key}=${value}" does not match template label "${key}=${templateLabels[key] ?? '(missing)'}"`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
         }
       }
     }

package/src/lint/post-synth/wk8102.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests } from "./k8s-helpers";
+import { docsToManifests } from "./k8s-helpers";
 
 export const wk8102: PostSynthCheck = {
   id: "WK8102",
@@ -15,25 +15,20 @@ export const wk8102: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !manifest.metadata) continue;
 
-      for (const manifest of manifests) {
-        if (!manifest.kind || !manifest.metadata) continue;
+      const resourceName = manifest.metadata.name ?? manifest.kind;
+      const labels = manifest.metadata.labels;
 
-        const resourceName = manifest.metadata.name ?? manifest.kind;
-        const labels = manifest.metadata.labels;
-
-        if (!labels || typeof labels !== "object" || Object.keys(labels).length === 0) {
-          diagnostics.push({
-            checkId: "WK8102",
-            severity: "warning",
-            message: `${manifest.kind} "${resourceName}" has no metadata.labels — add labels for organizational purposes`,
-            entity: resourceName,
-            lexicon: "k8s",
-          });
-        }
+      if (!labels || typeof labels !== "object" || Object.keys(labels).length === 0) {
+        diagnostics.push({
+          checkId: "WK8102",
+          severity: "warning",
+          message: `${manifest.kind} "${resourceName}" has no metadata.labels — add labels for organizational purposes`,
+          entity: resourceName,
+          lexicon: "k8s",
+        });
       }
     }
 

package/src/lint/post-synth/wk8103.ts

@@ -6,7 +6,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8103: PostSynthCheck = {
   id: "WK8103",
@@ -15,27 +15,22 @@ export const wk8103: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (let i = 0; i < containers.length; i++) {
-          const container = containers[i];
-          if (!container.name || typeof container.name !== "string" || container.name.trim() === "") {
-            diagnostics.push({
-              checkId: "WK8103",
-              severity: "error",
-              message: `${manifest.kind} "${resourceName}" has a container at index ${i} without a name — the name field is required`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (let i = 0; i < containers.length; i++) {
+        const container = containers[i];
+        if (!container.name || typeof container.name !== "string" || container.name.trim() === "") {
+          diagnostics.push({
+            checkId: "WK8103",
+            severity: "error",
+            message: `${manifest.kind} "${resourceName}" has a container at index ${i} without a name — the name field is required`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }

package/src/lint/post-synth/wk8104.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8104: PostSynthCheck = {
   id: "WK8104",
@@ -16,45 +16,20 @@ export const wk8104: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
+    for (const manifest of docsToManifests(ctx)) {
+      const resourceName = manifest.metadata?.name ?? manifest.kind ?? "(unknown)";
 
-      for (const manifest of manifests) {
-        const resourceName = manifest.metadata?.name ?? manifest.kind ?? "(unknown)";
-
-        // Check container ports in workloads
-        if (manifest.kind && WORKLOAD_KINDS.has(manifest.kind)) {
-          const containers = extractContainers(manifest);
-          for (const container of containers) {
-            if (!Array.isArray(container.ports)) continue;
-            for (const port of container.ports) {
-              if (typeof port === "object" && port !== null && !port.name) {
-                diagnostics.push({
-                  checkId: "WK8104",
-                  severity: "warning",
-                  message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has an unnamed port (containerPort: ${port.containerPort ?? "?"}) — add a name for clarity`,
-                  entity: resourceName,
-                  lexicon: "k8s",
-                });
-              }
-            }
-          }
-        }
-
-        // Check Service ports
-        if (manifest.kind === "Service") {
-          const spec = manifest.spec;
-          if (!spec) continue;
-          const ports = spec.ports as Array<Record<string, unknown>> | undefined;
-          if (!Array.isArray(ports)) continue;
-
-          for (const port of ports) {
+      // Check container ports in workloads
+      if (manifest.kind && WORKLOAD_KINDS.has(manifest.kind)) {
+        const containers = extractContainers(manifest);
+        for (const container of containers) {
+          if (!Array.isArray(container.ports)) continue;
+          for (const port of container.ports) {
             if (typeof port === "object" && port !== null && !port.name) {
               diagnostics.push({
                 checkId: "WK8104",
                 severity: "warning",
-                message: `Service "${resourceName}" has an unnamed port (port: ${port.port ?? "?"}) — add a name for clarity`,
+                message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has an unnamed port (containerPort: ${port.containerPort ?? "?"}) — add a name for clarity`,
                 entity: resourceName,
                 lexicon: "k8s",
               });
@@ -62,6 +37,26 @@ export const wk8104: PostSynthCheck = {
           }
         }
       }
+
+      // Check Service ports
+      if (manifest.kind === "Service") {
+        const spec = manifest.spec;
+        if (!spec) continue;
+        const ports = spec.ports as Array<Record<string, unknown>> | undefined;
+        if (!Array.isArray(ports)) continue;
+
+        for (const port of ports) {
+          if (typeof port === "object" && port !== null && !port.name) {
+            diagnostics.push({
+              checkId: "WK8104",
+              severity: "warning",
+              message: `Service "${resourceName}" has an unnamed port (port: ${port.port ?? "?"}) — add a name for clarity`,
+              entity: resourceName,
+              lexicon: "k8s",
+            });
+          }
+        }
+      }
     }
 
     return diagnostics;

package/src/lint/post-synth/wk8105.ts

@@ -7,7 +7,7 @@
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { getPrimaryOutput, parseK8sManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
+import { docsToManifests, extractContainers, WORKLOAD_KINDS } from "./k8s-helpers";
 
 export const wk8105: PostSynthCheck = {
   id: "WK8105",
@@ -16,26 +16,21 @@ export const wk8105: PostSynthCheck = {
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [, output] of ctx.outputs) {
-      const yaml = getPrimaryOutput(output);
-      const manifests = parseK8sManifests(yaml);
-
-      for (const manifest of manifests) {
-        if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
-
-        const containers = extractContainers(manifest);
-        const resourceName = manifest.metadata?.name ?? manifest.kind;
-
-        for (const container of containers) {
-          if (!container.imagePullPolicy) {
-            diagnostics.push({
-              checkId: "WK8105",
-              severity: "warning",
-              message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has no explicit imagePullPolicy — set it to "Always", "IfNotPresent", or "Never"`,
-              entity: resourceName,
-              lexicon: "k8s",
-            });
-          }
+    for (const manifest of docsToManifests(ctx)) {
+      if (!manifest.kind || !WORKLOAD_KINDS.has(manifest.kind)) continue;
+
+      const containers = extractContainers(manifest);
+      const resourceName = manifest.metadata?.name ?? manifest.kind;
+
+      for (const container of containers) {
+        if (!container.imagePullPolicy) {
+          diagnostics.push({
+            checkId: "WK8105",
+            severity: "warning",
+            message: `Container "${container.name ?? "(unnamed)"}" in ${manifest.kind} "${resourceName}" has no explicit imagePullPolicy — set it to "Always", "IfNotPresent", or "Never"`,
+            entity: resourceName,
+            lexicon: "k8s",
+          });
         }
       }
     }