@intentius/chant-lexicon-prometheus 0.101.0 → 0.104.0

package/src/promql-analysis.ts

@@ -0,0 +1,365 @@
+/**
+ * Reading a parsed PromQL expression: the selectors it reads, the labels its
+ * result keeps, and whether it filters with a comparison. The rule-file
+ * checks PROM211-PROM219 (./validate-config.ts) are built on these.
+ *
+ * The tree is the one `checkPromql` (./promql.ts) parses with
+ * `@prometheus-io/lezer-promql`. Every function here returns nothing for an
+ * expression that does not parse; PROM104 reports that.
+ */
+
+import { parser } from "@prometheus-io/lezer-promql";
+import type { MatchOp } from "./matchers";
+
+type SyntaxNode = ReturnType<typeof parser.parse>["topNode"];
+
+/** The expression under the tree's `PromQL` root, or undefined when it does not parse. */
+export function parsePromql(expr: string): SyntaxNode | undefined {
+  if (typeof expr !== "string" || expr.trim() === "") return undefined;
+  const tree = parser.parse(expr);
+  let broken = false;
+  tree.iterate({
+    enter: (n) => {
+      if (n.type.isError) broken = true;
+      return broken ? false : undefined;
+    },
+  });
+  return broken ? undefined : (tree.topNode.firstChild ?? undefined);
+}
+
+function text(n: SyntaxNode, src: string): string {
+  return src.slice(n.from, n.to);
+}
+
+/** The value of a PromQL string literal: double- or single-quoted with escapes, or a raw backtick string. */
+export function stringValue(literal: string): string {
+  if (literal.startsWith("`")) return literal.slice(1, -1);
+  const body = literal.slice(1, -1);
+  try {
+    return JSON.parse(`"${literal.startsWith("'") ? body.replace(/\\'/g, "'").replace(/"/g, '\\"') : body}"`) as string;
+  } catch {
+    return body;
+  }
+}
+
+function children(n: SyntaxNode): SyntaxNode[] {
+  const out: SyntaxNode[] = [];
+  for (let c = n.firstChild; c; c = c.nextSibling) out.push(c);
+  return out;
+}
+
+/** The arguments of a function call or aggregation body, without the brackets and commas. */
+function args(body: SyntaxNode | null): SyntaxNode[] {
+  return body ? children(body).filter((c) => c.name !== "(" && c.name !== ")" && c.name !== ",") : [];
+}
+
+function unwrap(n: SyntaxNode): SyntaxNode {
+  let cur = n;
+  while (cur.name === "ParenExpr" && cur.firstChild) cur = children(cur).find((c) => c.name !== "(" && c.name !== ")") ?? cur;
+  return cur;
+}
+
+export interface SelectorMatcher {
+  name: string;
+  op: MatchOp;
+  value: string;
+}
+
+/** One vector selector in an expression. */
+export interface Selector {
+  /** The metric name, from the identifier or a `__name__="..."` matcher; undefined when neither names one. */
+  name?: string;
+  matchers: SelectorMatcher[];
+  /** The selector as written. */
+  text: string;
+  /** The functions it sits inside, innermost first, e.g. `["rate", "sum"]` for `sum(rate(x[5m]))`. */
+  within: string[];
+}
+
+function selectorOf(n: SyntaxNode, src: string, within: string[]): Selector {
+  const matchers: SelectorMatcher[] = [];
+  const list = n.getChild("LabelMatchers");
+  for (const c of list ? children(list) : []) {
+    if (c.name !== "UnquotedLabelMatcher" && c.name !== "QuotedLabelMatcher") continue;
+    const label = c.getChild("LabelName") ?? c.getChild("QuotedLabelName");
+    const op = c.getChild("MatchOp");
+    const value = c.getChild("StringLiteral");
+    if (!label || !op || !value) continue;
+    const name = label.name === "QuotedLabelName" ? stringValue(text(label, src)) : text(label, src);
+    matchers.push({ name, op: text(op, src) as MatchOp, value: stringValue(text(value, src)) });
+  }
+  const ident = n.getChild("Identifier");
+  const byName = matchers.find((m) => m.name === "__name__" && m.op === "=");
+  const name = ident ? text(ident, src) : byName?.value;
+  return { name, matchers, text: text(n, src), within };
+}
+
+/** The name of a function call or aggregation node, e.g. `rate` or `sum`. */
+function callName(n: SyntaxNode, src: string): string | undefined {
+  if (n.name === "FunctionCall") {
+    const id = n.getChild("FunctionIdentifier");
+    return id ? text(id, src) : undefined;
+  }
+  if (n.name === "AggregateExpr") {
+    const op = n.getChild("AggregateOp");
+    return op ? text(op, src) : undefined;
+  }
+  return undefined;
+}
+
+/** Every vector selector in the expression, with the functions around it. */
+export function selectors(expr: string): Selector[] {
+  const top = parsePromql(expr);
+  if (!top) return [];
+  const out: Selector[] = [];
+  const walk = (n: SyntaxNode, within: string[]) => {
+    if (n.name === "VectorSelector") {
+      out.push(selectorOf(n, expr, within));
+      return;
+    }
+    const fn = callName(n, expr);
+    const inner = fn ? [fn, ...within] : within;
+    for (const c of children(n)) walk(c, inner);
+  };
+  walk(top, []);
+  return out;
+}
+
+const COMPARISON = new Set(["Gtr", "Lss", "Gte", "Lte", "Eql", "Neq"]);
+
+function binaryParts(n: SyntaxNode): { lhs: SyntaxNode; op: SyntaxNode; rhs: SyntaxNode; bool: boolean; modifier?: SyntaxNode } {
+  const parts = children(n);
+  return {
+    lhs: parts[0],
+    op: parts[1],
+    rhs: parts[parts.length - 1],
+    bool: parts.some((p) => p.name === "BoolModifier"),
+    modifier: parts.find((p) => p.name === "MatchingModifierClause"),
+  };
+}
+
+/** Functions whose result is itself a condition: they return a series only when something is missing. */
+const CONDITION_FUNCTIONS = new Set(["absent", "absent_over_time"]);
+
+/**
+ * Whether the expression filters its result: a comparison without `bool`,
+ * `absent()`/`absent_over_time()`, or `unless`, anywhere a series can pass
+ * through to the result. An expression without one returns every series it
+ * reads, so an alert on it fires for all of them (pint alerts/comparison).
+ * `or` needs a condition on both sides, since either side alone reaches the
+ * result.
+ */
+export function hasCondition(expr: string): boolean | undefined {
+  const top = parsePromql(expr);
+  if (!top) return undefined;
+  const walk = (raw: SyntaxNode): boolean => {
+    const n = unwrap(raw);
+    switch (n.name) {
+      case "BinaryExpr": {
+        const { lhs, op, rhs, bool } = binaryParts(n);
+        if (COMPARISON.has(op.name)) return !bool || walk(lhs) || walk(rhs);
+        if (op.name === "Unless") return true;
+        if (op.name === "Or") return walk(lhs) && walk(rhs);
+        return walk(lhs) || walk(rhs);
+      }
+      case "FunctionCall": {
+        const fn = callName(n, expr) ?? "";
+        if (CONDITION_FUNCTIONS.has(fn)) return true;
+        return args(n.getChild("FunctionCallBody")).some(walk);
+      }
+      case "AggregateExpr":
+        return args(n.getChild("FunctionCallBody")).some(walk);
+      case "UnaryExpr":
+      case "OffsetExpr":
+      case "StepInvariantExpr":
+        return children(n).some(walk);
+      case "SubqueryExpr":
+      case "MatrixSelector":
+        return n.firstChild ? walk(n.firstChild) : false;
+      default:
+        return false;
+    }
+  };
+  return walk(top);
+}
+
+/**
+ * The labels an expression's result carries, as far as the expression says:
+ * `{ only }` when it keeps exactly these labels (`sum by (job)`), `{ except }`
+ * when it keeps every label but these (`sum without (instance)`), or
+ * undefined when it keeps whatever the series it reads carry.
+ */
+export type LabelScope = { only: Set<string> } | { except: Set<string> };
+
+const KEEPS_INPUT_LABELS = new Set(["topk", "bottomk", "limitk", "limit_ratio"]);
+const NO_LABELS = new Set(["vector", "time", "scalar", "pi"]);
+
+function grouping(mod: SyntaxNode | null, src: string): { by: boolean; labels: string[] } | undefined {
+  if (!mod) return undefined;
+  const labels = (mod.getChild("GroupingLabels")?.getChildren("LabelName") ?? []).map((l) => text(l, src));
+  return { by: !!mod.getChild("By"), labels };
+}
+
+function minus(scope: LabelScope | undefined, drop: string[]): LabelScope {
+  if (!scope) return { except: new Set(drop) };
+  if ("only" in scope) return { only: new Set([...scope.only].filter((l) => !drop.includes(l))) };
+  return { except: new Set([...scope.except, ...drop]) };
+}
+
+function plus(scope: LabelScope | undefined, add: string[]): LabelScope | undefined {
+  if (!scope) return undefined;
+  if ("only" in scope) return { only: new Set([...scope.only, ...add]) };
+  return { except: new Set([...scope.except].filter((l) => !add.includes(l))) };
+}
+
+/** The labels the expression's result keeps; see {@link LabelScope}. */
+export function resultLabels(expr: string): LabelScope | undefined {
+  const top = parsePromql(expr);
+  if (!top) return undefined;
+  const walk = (raw: SyntaxNode): LabelScope | undefined => {
+    const n = unwrap(raw);
+    switch (n.name) {
+      case "NumberDurationLiteral":
+      case "StringLiteral":
+        return { only: new Set() };
+      case "AggregateExpr": {
+        const op = callName(n, expr) ?? "";
+        const body = args(n.getChild("FunctionCallBody"));
+        const last = body[body.length - 1];
+        const inner = last ? walk(last) : undefined;
+        if (KEEPS_INPUT_LABELS.has(op)) return inner;
+        if (op === "count_values") return undefined;
+        const g = grouping(n.getChild("AggregateModifier"), expr);
+        if (!g) return { only: new Set() };
+        return g.by ? { only: new Set(g.labels) } : minus(inner, g.labels);
+      }
+      case "FunctionCall": {
+        const fn = callName(n, expr) ?? "";
+        if (NO_LABELS.has(fn)) return { only: new Set() };
+        const a = args(n.getChild("FunctionCallBody"));
+        if (fn === "histogram_quantile" || fn === "histogram_fraction") return minus(walk(a[a.length - 1]), ["le"]);
+        if (fn === "label_replace" || fn === "label_join") {
+          const dst = a[1]?.name === "StringLiteral" ? stringValue(text(a[1], expr)) : undefined;
+          return dst === undefined ? undefined : plus(walk(a[0]), [dst]);
+        }
+        if (CONDITION_FUNCTIONS.has(fn)) return undefined;
+        const vector = a.find((x) => x.name !== "NumberDurationLiteral" && x.name !== "StringLiteral");
+        return vector ? walk(vector) : { only: new Set() };
+      }
+      case "BinaryExpr": {
+        const { lhs, op, rhs, modifier } = binaryParts(n);
+        const l = walk(lhs);
+        const r = walk(rhs);
+        const lScalar = unwrap(lhs).name === "NumberDurationLiteral";
+        const rScalar = unwrap(rhs).name === "NumberDurationLiteral";
+        if (lScalar && !rScalar) return r;
+        if (rScalar) return l;
+        if (op.name === "And" || op.name === "Unless") return l;
+        if (op.name === "Or") {
+          if (l && r && "only" in l && "only" in r) return { only: new Set([...l.only, ...r.only]) };
+          return undefined;
+        }
+        if (!modifier) return l;
+        const on = !!modifier.getChild("On");
+        const groupLabels = modifier.getChildren("GroupingLabels").map((g) => g.getChildren("LabelName").map((x) => text(x, expr)));
+        const matching = groupLabels[0] ?? [];
+        const extra = groupLabels[1] ?? [];
+        if (modifier.getChild("GroupLeft")) return plus(l, extra);
+        if (modifier.getChild("GroupRight")) return plus(r, extra);
+        // One-to-one: `on` keeps only the matching labels, `ignoring` drops them.
+        return on ? { only: new Set(matching.filter((x) => !l || ("only" in l ? l.only.has(x) : !l.except.has(x)))) } : minus(l, matching);
+      }
+      case "UnaryExpr":
+      case "OffsetExpr":
+      case "StepInvariantExpr":
+        return walk(children(n).find((c) => c.name !== "UnaryOp" && c.name !== "Offset" && c.name !== "OffsetDurationExpr") ?? n.firstChild!);
+      default:
+        return undefined;
+    }
+  };
+  return walk(top);
+}
+
+/** Whether a label survives a scope. An undefined scope keeps every label. */
+export function keepsLabel(scope: LabelScope | undefined, label: string): boolean {
+  if (!scope) return true;
+  return "only" in scope ? scope.only.has(label) : !scope.except.has(label);
+}
+
+/** One `histogram_quantile` call and what is wrong with its histogram argument. */
+export interface HistogramProblem {
+  call: string;
+  problem: "no-bucket" | "no-le";
+}
+
+/** `histogram_quantile` calls over a selector with no `_bucket` in its name, or an aggregation that drops `le`. */
+export function histogramProblems(expr: string): HistogramProblem[] {
+  const top = parsePromql(expr);
+  if (!top) return [];
+  const out: HistogramProblem[] = [];
+  const walk = (n: SyntaxNode) => {
+    if (n.name === "FunctionCall" && callName(n, expr) === "histogram_quantile") {
+      const a = args(n.getChild("FunctionCallBody"));
+      const histogram = a[1];
+      if (histogram) {
+        const call = text(n, expr);
+        const names = selectors(text(histogram, expr)).flatMap((s) => (s.name ? [s.name] : []));
+        if (names.some((x) => !x.includes("_bucket"))) out.push({ call, problem: "no-bucket" });
+        else if (!keepsLabel(resultLabels(text(histogram, expr)), "le")) out.push({ call, problem: "no-le" });
+      }
+    }
+    for (const c of children(n)) walk(c);
+  };
+  walk(top);
+  return out;
+}
+
+const COUNTER_FUNCTIONS = new Set(["rate", "irate", "increase"]);
+const COUNTER_SUFFIX = /_(total|count|sum|bucket)$/;
+
+/** `rate`, `irate` or `increase` read straight from a named selector whose name does not end in a counter suffix. */
+export function nonCounterRates(expr: string): Array<{ fn: string; name: string }> {
+  return selectors(expr).flatMap((s) => {
+    const fn = s.within[0];
+    if (!fn || !COUNTER_FUNCTIONS.has(fn) || !s.name || COUNTER_SUFFIX.test(s.name)) return [];
+    return [{ fn, name: s.name }];
+  });
+}
+
+const REGEX_META = /[.+*?()[\]{}|\\^$]/;
+
+/** A regex matcher that could be an equality matcher, or that carries anchors Prometheus already adds. */
+export interface RegexProblem {
+  matcher: string;
+  problem: "literal" | "anchored";
+}
+
+/** The `=~` and `!~` matchers in an expression that need no regex, or that are anchored (pint promql/regexp). */
+export function regexProblems(expr: string): RegexProblem[] {
+  const out: RegexProblem[] = [];
+  for (const s of selectors(expr)) {
+    for (const m of s.matchers) {
+      if (m.op !== "=~" && m.op !== "!~") continue;
+      const shown = `${m.name}${m.op}${JSON.stringify(m.value)}`;
+      if (!REGEX_META.test(m.value)) out.push({ matcher: shown, problem: "literal" });
+      else if (m.value.startsWith("^") || (m.value.endsWith("$") && !m.value.endsWith("\\$"))) out.push({ matcher: shown, problem: "anchored" });
+    }
+  }
+  return out;
+}
+
+/** Whether every selector in the expression is read through a `*_over_time` function, so the expression already spans a window. */
+export function readsOnlyOverTime(expr: string): boolean {
+  const all = selectors(expr);
+  return all.length > 0 && all.every((s) => s.within.some((fn) => fn.endsWith("_over_time")));
+}
+
+/** Whether the expression is two conditions joined by `and`: the multi-window form, where the short window does what `for` would. */
+export function isMultiWindow(expr: string): boolean {
+  const top = parsePromql(expr);
+  if (!top) return false;
+  const n = unwrap(top);
+  if (n.name !== "BinaryExpr") return false;
+  const { lhs, op, rhs } = binaryParts(n);
+  return op.name === "And" && hasCondition(text(lhs, expr)) === true && hasCondition(text(rhs, expr)) === true;
+}

package/src/skills/chant-prometheus-alertmanager.md

@@ -57,6 +57,8 @@ Import it rather than retyping it: `chant import alertmanager.yml --output src`
 - Routes name receivers and time intervals that exist (PROM201, PROM204). Reference the entity rather than a string and TypeScript does most of this.
 - Every `severity` an alert in the same build root carries is matched by some route below the root (PROM202). The check only sees one build root (chant #1939): keep the rules and the Alertmanager config in the same one, or it goes quiet.
 - Credentials go in `*_file` fields. Alertmanager does not expand environment variables in its config, and a literal `api_url`, `routing_key` or `auth_password` is flagged (PROM001).
-- Each integration has somewhere to send (PROM209): a webhook `url`, a Slack `api_url` (or `global.slack_api_url`), a PagerDuty key, an email `to`/`smarthost`/`from` (or the global SMTP defaults).
+- Each integration has its destination, credential and required fields, or the `global` default it falls back to (PROM209): a webhook `url`, a Slack `api_url` or app token, an Opsgenie `api_key`, a Telegram `chat_id` and bot token, a Webex `room_id` and `http_config.authorization`, one SNS target, a Jira `project` and `issue_type`, an email `to`/`smarthost`/`from`, and so on.
+- No setting Alertmanager rejects (PROM210): a value and its `*_file` both set, a Slack `api_url` with an app token, `update_message` without `api_url: https://slack.com/api/chat.postMessage`, a WeChat `message_type` other than `text`/`markdown`, a Telegram `parse_mode` other than `Markdown`/`MarkdownV2`/`HTML`.
+- Durations parse (PROM208). Route timers and `resolve_timeout` take `1d`; the integration `timeout`s and Pushover `retry`/`expire`/`ttl` are Go durations and take `24h`, not `1d`.
 
 Run `amtoolCheckConfig(alertmanagerYaml(entities))` in a test to have `amtool check-config` confirm it when installed.

package/src/testdata/integration-cases.ts

@@ -0,0 +1,96 @@
+/**
+ * Alertmanager receiver integrations that pass and fail PROM208-PROM210: at
+ * least one of each per integration, after Alertmanager v0.34.1's
+ * UnmarshalYAML validations (sources in ../validate-integrations.ts).
+ * post-synth.test.ts checks the codes; tools.test.ts has amtool reject the
+ * failing ones when it is installed.
+ *
+ * Each case: a label, the receiver key, one entry, an optional `global:`,
+ * and the PROM208-PROM210 codes it produces, sorted.
+ */
+
+export type IntegrationCase = [label: string, key: string, entry: Record<string, unknown>, global: Record<string, unknown> | undefined, codes: string[]];
+const PD = "https://events.pagerduty.com/v2/enqueue";
+export const SLACK_APP_URL = "https://slack.com/api/chat.postMessage";
+export const INTEGRATION_CASES: IntegrationCase[] = [
+  ["discord ok", "discord_configs", { webhook_url_file: "/s" }, undefined, []],
+  ["discord without a webhook", "discord_configs", {}, undefined, ["PROM209"]],
+  ["discord with url and file", "discord_configs", { webhook_url: "https://d/x", webhook_url_file: "/s" }, undefined, ["PROM210"]],
+  ["email ok", "email_configs", { to: "a@b.c", from: "am@b.c", smarthost: "smtp:25" }, undefined, []],
+  ["email on global SMTP", "email_configs", { to: "a@b.c" }, { smtp_smarthost: "smtp:25", smtp_from: "am@b.c" }, []],
+  ["email with nothing", "email_configs", {}, undefined, ["PROM209", "PROM209", "PROM209"]],
+  ["email smarthost without port", "email_configs", { to: "a@b.c", from: "am@b.c", smarthost: "smtp" }, undefined, ["PROM210"]],
+  ["email duplicate header", "email_configs", { to: "a@b.c", from: "f@b.c", smarthost: "s:25", headers: { subject: "a", Subject: "b" } }, undefined, ["PROM210"]],
+  ["email threading without thread_by_date", "email_configs", { to: "a@b.c", from: "f@b.c", smarthost: "s:25", threading: { enabled: true } }, undefined, ["PROM210"]],
+  ["email threading with References", "email_configs", { to: "a@b.c", from: "f@b.c", smarthost: "s:25", headers: { references: "x" }, threading: { enabled: true, thread_by_date: "daily" } }, undefined, ["PROM210"]],
+  ["incident.io ok", "incidentio_configs", { url: "https://i/x", alert_source_token_file: "/t", timeout: "1.5s" }, undefined, []],
+  ["incident.io without url", "incidentio_configs", {}, undefined, ["PROM209"]],
+  ["incident.io http_config without a credential", "incidentio_configs", { url: "https://i/x", http_config: { follow_redirects: true } }, undefined, ["PROM209"]],
+  ["incident.io token and authorization", "incidentio_configs", { url: "https://i/x", alert_source_token_file: "/t", http_config: { authorization: { credentials_file: "/c" } } }, undefined, ["PROM210"]],
+  ["incident.io Prometheus-only duration", "incidentio_configs", { url_file: "/u", timeout: "1d" }, undefined, ["PROM208"]],
+  ["jira ok", "jira_configs", { api_url: "https://j/x", project: "OPS", issue_type: "Bug", reopen_duration: "1d" }, undefined, []],
+  ["jira on global api_url", "jira_configs", { project: "OPS", issue_type: "Bug" }, { jira_api_url: "https://j/x" }, []],
+  ["jira with nothing", "jira_configs", {}, undefined, ["PROM209", "PROM209", "PROM209"]],
+  ["jira api_type", "jira_configs", { api_url: "https://j/x", project: "OPS", issue_type: "Bug", api_type: "server" }, undefined, ["PROM210"]],
+  ["jira Go-only duration", "jira_configs", { api_url: "https://j/x", project: "OPS", issue_type: "Bug", reopen_duration: "1.5h" }, undefined, ["PROM208"]],
+  ["mattermost ok", "mattermost_configs", { webhook_url_file: "/m" }, undefined, []],
+  ["mattermost on global webhook", "mattermost_configs", {}, { mattermost_webhook_url_file: "/m" }, []],
+  ["mattermost without a webhook", "mattermost_configs", {}, undefined, ["PROM209"]],
+  ["mattermost field without value", "mattermost_configs", { webhook_url_file: "/m", attachments: [{ fields: [{ title: "a" }] }] }, undefined, ["PROM210"]],
+  ["msteams ok", "msteams_configs", { webhook_url_file: "/t" }, undefined, []],
+  ["msteams without a webhook", "msteams_configs", {}, undefined, ["PROM209"]],
+  ["msteamsv2 ok", "msteamsv2_configs", { webhook_url_file: "/t" }, undefined, []],
+  ["msteamsv2 with url and file", "msteamsv2_configs", { webhook_url: "https://t/x", webhook_url_file: "/t" }, undefined, ["PROM210"]],
+  ["opsgenie ok", "opsgenie_configs", { api_key_file: "/k", responders: [{ name: "ops", type: "Team" }, { id: "1", type: "{{ .CommonLabels.kind }}" }] }, undefined, []],
+  ["opsgenie on global api_key", "opsgenie_configs", {}, { opsgenie_api_key_file: "/k" }, []],
+  ["opsgenie without api_key", "opsgenie_configs", {}, undefined, ["PROM209"]],
+  ["opsgenie responders", "opsgenie_configs", { api_key_file: "/k", responders: [{ type: "team" }, { name: "x", type: "group" }, { name: "y" }] }, undefined, ["PROM209", "PROM209", "PROM210"]],
+  ["pagerduty ok", "pagerduty_configs", { routing_key_file: "/k", url: PD, timeout: "30s" }, undefined, []],
+  ["pagerduty without a key", "pagerduty_configs", {}, undefined, ["PROM209"]],
+  ["pagerduty key and file", "pagerduty_configs", { service_key: "x", service_key_file: "/k" }, undefined, ["PROM210"]],
+  ["pagerduty timeout without unit", "pagerduty_configs", { routing_key_file: "/k", timeout: "10" }, undefined, ["PROM208"]],
+  ["pushover ok", "pushover_configs", { user_key_file: "/u", token_file: "/t", retry: "30s", expire: "1h", ttl: "1h30m" }, undefined, []],
+  ["pushover without credentials", "pushover_configs", {}, undefined, ["PROM209", "PROM209"]],
+  ["pushover html and monospace", "pushover_configs", { user_key_file: "/u", token_file: "/t", html: true, monospace: true }, undefined, ["PROM210"]],
+  ["pushover retry in days", "pushover_configs", { user_key_file: "/u", token_file: "/t", retry: "1d" }, undefined, ["PROM208"]],
+  ["rocketchat ok", "rocketchat_configs", { token_id_file: "/i", token_file: "/t" }, undefined, []],
+  ["rocketchat on global tokens", "rocketchat_configs", {}, { rocketchat_token_id_file: "/i", rocketchat_token_file: "/t" }, []],
+  ["rocketchat without tokens", "rocketchat_configs", {}, undefined, ["PROM209", "PROM209"]],
+  ["rocketchat token and file", "rocketchat_configs", { token_id_file: "/i", token: "x", token_file: "/t" }, undefined, ["PROM210"]],
+  ["slack ok", "slack_configs", { api_url_file: "/s", timeout: "500ms" }, undefined, []],
+  ["slack on global app token", "slack_configs", {}, { slack_app_token_file: "/t" }, []],
+  ["slack update_message with the app URL", "slack_configs", { api_url: SLACK_APP_URL, update_message: true, http_config: { authorization: { credentials_file: "/t" } } }, undefined, []],
+  ["slack without a url or token", "slack_configs", { channel: "#a" }, undefined, ["PROM209"]],
+  ["slack local authorization blocks the global token", "slack_configs", { http_config: { authorization: { credentials_file: "/t" } } }, { slack_app_token_file: "/t" }, ["PROM209"]],
+  ["slack url and token", "slack_configs", { api_url_file: "/s", app_token_file: "/t" }, undefined, ["PROM210"]],
+  ["slack update_message on a webhook", "slack_configs", { api_url_file: "/s", update_message: true }, undefined, ["PROM210"]],
+  ["slack app token and authorization", "slack_configs", { app_token_file: "/t", http_config: { bearer_token_file: "/b" } }, undefined, ["PROM210"]],
+  ["slack fields and actions", "slack_configs", { api_url_file: "/s", fields: [{ title: "a" }], actions: [{ type: "button", text: "x" }, { type: "button", text: "y", name: "n", confirm: {} }] }, undefined, ["PROM210", "PROM210", "PROM210"]],
+  ["slack timeout", "slack_configs", { api_url_file: "/s", timeout: "5 s" }, undefined, ["PROM208"]],
+  ["sns ok", "sns_configs", { topic_arn: "arn:aws:sns:x" }, undefined, []],
+  ["sns without a target", "sns_configs", {}, undefined, ["PROM209"]],
+  ["sns with two targets", "sns_configs", { topic_arn: "arn:aws:sns:x", target_arn: "arn:aws:sns:y" }, undefined, ["PROM210"]],
+  ["telegram ok", "telegram_configs", { bot_token_file: "/t", chat_id: 12, parse_mode: "MarkdownV2" }, undefined, []],
+  ["telegram on global bot token", "telegram_configs", { chat_id_file: "/c" }, { telegram_bot_token_file: "/t" }, []],
+  ["telegram with nothing", "telegram_configs", {}, undefined, ["PROM209", "PROM209"]],
+  ["telegram chat_id and file, bad parse_mode", "telegram_configs", { bot_token_file: "/t", chat_id: 12, chat_id_file: "/c", parse_mode: "markdown" }, undefined, ["PROM210", "PROM210"]],
+  ["victorops ok", "victorops_configs", { routing_key: "ops", api_key_file: "/k" }, undefined, []],
+  ["victorops on global api_key", "victorops_configs", { routing_key: "ops" }, { victorops_api_key_file: "/k" }, []],
+  ["victorops with nothing", "victorops_configs", {}, undefined, ["PROM209", "PROM209"]],
+  ["victorops reserved custom field", "victorops_configs", { routing_key: "ops", api_key_file: "/k", custom_fields: { entity_id: "x" } }, undefined, ["PROM210"]],
+  ["webex ok", "webex_configs", { room_id: "r", http_config: { bearer_token_file: "/t" } }, undefined, []],
+  ["webex with nothing", "webex_configs", {}, undefined, ["PROM209", "PROM209"]],
+  ["webex with only a global authorization", "webex_configs", { room_id: "r" }, { http_config: { authorization: { credentials_file: "/t" } } }, ["PROM209"]],
+  ["webhook ok", "webhook_configs", { url: "http://sink/", timeout: "1m30s" }, undefined, []],
+  ["webhook without url", "webhook_configs", {}, undefined, ["PROM209"]],
+  ["webhook url and file", "webhook_configs", { url: "http://sink/", url_file: "/u" }, undefined, ["PROM210"]],
+  ["webhook timeout in days", "webhook_configs", { url: "http://sink/", timeout: "1d" }, undefined, ["PROM208"]],
+  ["wechat ok", "wechat_configs", { api_secret_file: "/s", corp_id: "c", message_type: "markdown" }, undefined, []],
+  ["wechat on global secret and corp", "wechat_configs", {}, { wechat_api_secret_file: "/s", wechat_api_corp_id: "c" }, []],
+  ["wechat with nothing", "wechat_configs", {}, undefined, ["PROM209", "PROM209"]],
+  ["wechat message_type", "wechat_configs", { api_secret_file: "/s", corp_id: "c", message_type: "html" }, undefined, ["PROM210"]],
+];
+
+/** An `alertmanager.yml`, as JSON, with one receiver `r` holding `entry` under `key`. */
+export const amWith = (key: string, entry: unknown, global?: Record<string, unknown>): string =>
+  JSON.stringify({ ...(global ? { global } : {}), route: { receiver: "r" }, receivers: [{ name: "r", [key]: [entry] }] });

package/src/tools.test.ts

@@ -17,6 +17,7 @@ import {
   promtoolCheckRules,
   ruleFileYaml,
 } from "./index";
+import { INTEGRATION_CASES, amWith } from "./testdata/integration-cases";
 
 const PROMTOOL = process.env.PROMTOOL ?? "promtool";
 const AMTOOL = process.env.AMTOOL ?? "amtool";
@@ -113,6 +114,11 @@ describe("amtool check-config", () => {
     expect(r.ok).toBe(false);
   });
 
+  test.skipIf(!hasAmtool).each(INTEGRATION_CASES.filter((c) => c[4].length > 0))("rejects what PROM208-PROM210 flag: %s", (_label, key, entry, global) => {
+    const r = amtoolCheckConfig(amWith(key, entry, global), AMTOOL);
+    expect(r.ok, r.output).toBe(false);
+  });
+
   test("reports ran: false when the binary is missing", () => {
     expect(amtoolCheckConfig("route: {}\n", "/nonexistent/amtool").ran).toBe(false);
   });