@intentius/chant-lexicon-prometheus 0.102.0 → 0.104.1

package/src/lint/post-synth/checks.test.ts

@@ -0,0 +1,257 @@
+/**
+ * PROM211-PROM224 (#3363): one failing and one passing case each, and the
+ * lexicon's own composites, init templates and examples reporting none.
+ */
+import { describe, expect, test } from "vitest";
+import { join } from "path";
+import { readdirSync } from "fs";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
+import { build } from "@intentius/chant/build";
+import { runPostSynthChecks } from "@intentius/chant/lint/post-synth";
+import { genAiMetrics } from "@intentius/chant-lexicon-otel/genai";
+import { postSynthChecks } from "./index";
+import { OPT_IN_CHECKS } from "../audit-catalog";
+import { prometheusSerializer } from "../../serializer";
+import { emitYaml } from "../../build";
+import { ruleGroupConfig } from "../../rules";
+import { GenAiRules, type GenAiAlerting } from "../../composites/genai";
+import { Slo } from "../../composites/slo";
+import type { RuleGroupConfig } from "../../model";
+
+const NEW_CHECKS = postSynthChecks.filter((c) => c.id >= "PROM211" && c.id <= "PROM224");
+
+/** The PROM211-PROM224 findings on a document, by check id. */
+function found(text: string, ids?: string[]): string[] {
+  const ctx = makePostSynthCtx("prometheus", text);
+  return NEW_CHECKS.filter((c) => !ids || ids.includes(c.id))
+    .flatMap((c) => c.check(ctx))
+    .map((d) => d.checkId);
+}
+
+/** A rule file of one group holding `rule`, as YAML. */
+function rules(rule: Record<string, unknown>, groupLabels?: Record<string, string>): string {
+  return JSON.stringify({ groups: [{ name: "g", ...(groupLabels ? { labels: groupLabels } : {}), rules: [rule] }] });
+}
+
+/** An alert that passes every check but the one a case varies. */
+function alert(over: Record<string, unknown> = {}): string {
+  return rules({
+    alert: "A",
+    expr: "sum by (job) (rate(errors_total[5m])) > 1",
+    for: "5m",
+    labels: { severity: "page" },
+    annotations: { summary: "errors on {{ $labels.job }}", runbook_url: "https://runbooks/a" },
+    ...over,
+  });
+}
+
+const record = (name: string, expr: string) => rules({ record: name, expr });
+
+const am = (over: Record<string, unknown> = {}) =>
+  JSON.stringify({ route: { receiver: "r" }, receivers: [{ name: "r", webhook_configs: [{ url: "https://hook" }] }], ...over });
+
+describe("the rule-file checks", () => {
+  test("the baseline alert and recording rule report nothing", () => {
+    expect(found(alert())).toEqual([]);
+    expect(found(record("job:errors:rate5m", "sum by (job) (rate(errors_total[5m]))"))).toEqual([]);
+  });
+
+  test("PROM211 no for, or for: 0s", () => {
+    expect(found(alert({ for: undefined }))).toEqual(["PROM211"]);
+    expect(found(alert({ for: "0s" }))).toEqual(["PROM211"]);
+    expect(found(alert({ for: "1m" }))).toEqual([]);
+  });
+
+  test("PROM211 leaves alone an expression over a window, a multi-window and, and a heartbeat", () => {
+    expect(found(alert({ for: undefined, expr: "avg_over_time(job:errors:rate5m[1h]) > 1" }))).toEqual([]);
+    expect(found(alert({ for: undefined, expr: "(job:errors:rate1h > 1) and (job:errors:rate5m > 1)" }))).toEqual([]);
+    expect(found(alert({ for: undefined, expr: "vector(1)" }), ["PROM211", "PROM213"])).toEqual([]);
+    // A for that is not a duration is PROM103's alone.
+    expect(found(alert({ for: "1.5h" }))).toEqual([]);
+  });
+
+  test("PROM212 is the only finding on an alert with no runbook_url", () => {
+    expect(found(alert({ annotations: { summary: "x" } }))).toEqual(["PROM212"]);
+    expect(found(record("job:errors:rate5m", "sum by (job) (rate(errors_total[5m]))"), ["PROM212"])).toEqual([]);
+  });
+
+  test("PROM213 no comparison", () => {
+    expect(found(alert({ expr: "sum by (job) (rate(errors_total[5m]))" }))).toEqual(["PROM213"]);
+    expect(found(alert({ expr: "sum by (job) (rate(errors_total[5m])) > bool 1" }))).toEqual(["PROM213"]);
+    expect(found(alert({ expr: "job:errors:rate5m > 1 or job:errors:rate1h" }))).toEqual(["PROM213"]);
+    expect(found(alert({ expr: "absent(up{job=\"api\"})" }))).toEqual([]);
+    expect(found(alert({ expr: "up{job=\"api\"} unless on (instance) maintenance" }))).toEqual([]);
+    expect(found(alert({ expr: "sum by (job) (up == 0)" }))).toEqual([]);
+  });
+
+  test("PROM214 a template label the aggregation drops", () => {
+    const reads = (expr: string) => alert({ expr, annotations: { summary: "{{ $labels.instance }} on {{ .Labels.job }}", runbook_url: "u" } });
+    expect(found(reads("sum by (job) (up) == 0"))).toEqual(["PROM214"]);
+    expect(found(reads("sum without (instance) (up) == 0"))).toEqual(["PROM214"]);
+    expect(found(reads("sum by (job, instance) (up) == 0"))).toEqual([]);
+    expect(found(reads("up == 0"))).toEqual([]);
+    expect(found(reads("sum without (pod) (up) == 0"))).toEqual([]);
+    // One-to-one matching on (job) keeps only job.
+    expect(found(reads("sum by (job, instance) (up) / on (job) sum by (job) (up) < 0.5"))).toEqual(["PROM214"]);
+    // A label the rule sets itself is left alone.
+    expect(found(alert({ expr: "sum(up) == 0", labels: { severity: "page", instance: "all" }, annotations: { summary: "{{ $labels.instance }}", runbook_url: "u" } }))).toEqual([]);
+  });
+
+  test("PROM215 rate over a name that is not a counter's", () => {
+    expect(found(record("job:mem:rate5m", "sum by (job) (rate(process_resident_memory_bytes[5m]))"))).toEqual(["PROM215"]);
+    expect(found(record("job:mem:rate5m", "sum by (job) (increase(queue_depth[5m]))"))).toEqual(["PROM215"]);
+    for (const name of ["errors_total", "req_seconds_count", "req_seconds_sum", "req_seconds_bucket"]) {
+      expect(found(record("job:x:rate5m", `sum by (job) (rate(${name}[5m]))`))).toEqual([]);
+    }
+    expect(found(record("job:mem:deriv5m", "sum by (job) (deriv(process_resident_memory_bytes[5m]))"))).toEqual([]);
+  });
+
+  test("PROM216 histogram_quantile without _bucket or without le", () => {
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum by (job) (rate(req_seconds_bucket[5m])))"))).toEqual(["PROM216"]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum without (le) (rate(req_seconds_bucket[5m])))"))).toEqual(["PROM216"]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum by (job, le) (rate(req_seconds_count[5m])))"))).toEqual(["PROM216"]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum by (job, le) (rate(req_seconds_bucket[5m])))"))).toEqual([]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, rate(req_seconds_bucket[5m]))"))).toEqual([]);
+  });
+
+  test("PROM217 recording rule names", () => {
+    expect(found(record("errors_rate", "sum(rate(errors_total[5m]))"))).toEqual(["PROM217"]);
+    expect(found(record("job:errors", "sum by (job) (rate(errors_total[5m]))"))).toEqual(["PROM217"]);
+    expect(found(record("job::rate5m", "sum by (job) (rate(errors_total[5m]))"))).toEqual(["PROM217"]);
+    expect(found(record("instance_path:requests:rate5m", "sum by (instance, path) (rate(requests_total[5m]))"))).toEqual([]);
+  });
+
+  test("PROM218 a regex that needs none, or is anchored", () => {
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"api"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job!~"api"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"^api.*"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"api.*$"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"api|web", code=~"5.."}[5m]))'))).toEqual([]);
+  });
+
+  test("PROM219 alertname set on the rule or the group", () => {
+    expect(found(alert({ labels: { severity: "page", alertname: "B" } }))).toEqual(["PROM219"]);
+    expect(found(rules(JSON.parse(alert()).groups[0].rules[0], { alertname: "B" }))).toEqual(["PROM219"]);
+  });
+
+  test("an expression that does not parse is PROM104's alone", () => {
+    expect(found(alert({ expr: "sum by (job) (rate(x[5m]) >" }))).toEqual([]);
+  });
+});
+
+describe("the alertmanager.yml checks", () => {
+  test("the baseline config reports nothing", () => {
+    expect(found(am())).toEqual([]);
+  });
+
+  test("PROM220 insecure_skip_verify on a receiver or in global", () => {
+    const insecure = { url: "https://hook", http_config: { tls_config: { insecure_skip_verify: true } } };
+    expect(found(am({ receivers: [{ name: "r", webhook_configs: [insecure] }] }))).toEqual(["PROM220"]);
+    expect(found(am({ global: { http_config: { tls_config: { insecure_skip_verify: true } } } }))).toEqual(["PROM220"]);
+    expect(found(am({ receivers: [{ name: "r", email_configs: [{ to: "a@b.c", smarthost: "s:25", from: "x@b.c", tls_config: { insecure_skip_verify: true } }] }] }))).toEqual(["PROM220"]);
+    expect(found(am({ receivers: [{ name: "r", webhook_configs: [{ url: "https://hook", http_config: { tls_config: { insecure_skip_verify: false } } }] }] }))).toEqual([]);
+  });
+
+  test("PROM221 SMTP auth with require_tls false", () => {
+    const email = (entry: Record<string, unknown>, global: Record<string, unknown> = {}) =>
+      am({ global, receivers: [{ name: "r", email_configs: [{ to: "a@b.c", smarthost: "s:25", from: "x@b.c", ...entry }] }] });
+    expect(found(email({ require_tls: false, auth_username: "u", auth_password_file: "/p" }))).toEqual(["PROM221"]);
+    expect(found(email({ auth_username: "u" }, { smtp_require_tls: false, smtp_auth_password_file: "/p" }))).toEqual(["PROM221"]);
+    expect(found(email({ require_tls: false }))).toEqual([]);
+    expect(found(email({ auth_password_file: "/p" }))).toEqual([]);
+    expect(found(email({ require_tls: false, auth_password_file: "/p", force_implicit_tls: true }))).toEqual([]);
+  });
+
+  test("PROM222 credentials sent to an http:// URL", () => {
+    const hook = (entry: Record<string, unknown>, global: Record<string, unknown> = {}) => am({ global, receivers: [{ name: "r", webhook_configs: [entry] }] });
+    expect(found(hook({ url: "http://user:pass@hook/" }))).toEqual(["PROM222"]);
+    expect(found(hook({ url: "http://hook/", http_config: { bearer_token_file: "/t" } }))).toEqual(["PROM222"]);
+    expect(found(hook({ url: "http://hook/" }, { http_config: { basic_auth: { username: "u", password_file: "/p" } } }))).toEqual(["PROM222"]);
+    expect(found(hook({ url: "http://hook/" }))).toEqual([]);
+    expect(found(hook({ url: "https://hook/", http_config: { bearer_token_file: "/t" } }))).toEqual([]);
+    const opsgenie = (global: Record<string, unknown>) => am({ global, receivers: [{ name: "r", opsgenie_configs: [{ api_key_file: "/k" }] }] });
+    expect(found(opsgenie({ opsgenie_api_url: "http://opsgenie.internal/" }))).toEqual(["PROM222"]);
+    expect(found(opsgenie({}))).toEqual([]);
+  });
+
+  test("PROM223 repeat_interval under group_interval, inherited down the tree", () => {
+    expect(found(am({ route: { receiver: "r", group_interval: "10m", repeat_interval: "5m" } }))).toEqual(["PROM223"]);
+    expect(found(am({ route: { receiver: "r", repeat_interval: "1m" } }))).toEqual(["PROM223"]);
+    expect(found(am({ route: { receiver: "r", group_interval: "1h", routes: [{ receiver: "r", repeat_interval: "30m" }] } }))).toEqual(["PROM223"]);
+    expect(found(am({ route: { receiver: "r", group_interval: "5m", repeat_interval: "1h" } }))).toEqual([]);
+  });
+
+  test("PROM224 an inhibit rule whose sides can match one alert, with no equal", () => {
+    const inhibit = (rule: Record<string, unknown>) => am({ inhibit_rules: [rule] });
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['team="db"'] }))).toEqual(["PROM224"]);
+    expect(found(inhibit({ source_matchers: ['severity=~"page|ticket"'], target_matchers: ['severity="ticket"'] }))).toEqual(["PROM224"]);
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['team="db"'], equal: ["alertname"] }))).toEqual([]);
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['severity="ticket"'] }))).toEqual([]);
+    expect(found(inhibit({ source_matchers: ['severity=~"critical"'], target_matchers: ['severity=~"warning|info"'] }))).toEqual([]);
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['severity!="page"'] }))).toEqual([]);
+  });
+});
+
+/** Every finding the `recommended` preset reports (PROM212, opt-in, is left out). */
+function recommended(text: string): string[] {
+  const ctx = makePostSynthCtx("prometheus", text);
+  return postSynthChecks
+    .filter((c) => !OPT_IN_CHECKS.has(c.id))
+    .flatMap((c) => c.check(ctx))
+    .map((d) => `${d.checkId} ${d.message}`);
+}
+
+const groupYaml = (group: RuleGroupConfig) => emitYaml({ groups: [group] });
+
+describe("the lexicon's own rules report none of the checks", () => {
+  const prices = [{ provider: "anthropic", model: "m1", inputPerMTok: 3, outputPerMTok: 15, currency: "USD", source: "https://example.com", asOf: "2026-09-29" }];
+  const alerts: GenAiAlerting = {
+    errorRatio: true,
+    latency: true,
+    toolErrorRatio: true,
+    budgets: [
+      { amount: 5, currency: "USD", per: "hour" },
+      { amount: 50, currency: "USD", per: "day" },
+    ],
+  };
+
+  test.each([
+    ["spans", genAiMetrics()],
+    ["client", genAiMetrics({ clientMetrics: "derive" })],
+  ] as const)("GenAiRules over the %s metrics, with and without its alerts", (_label, genAi) => {
+    expect(recommended(groupYaml(ruleGroupConfig(GenAiRules({ genAi, prices }).rules)))).toEqual([]);
+    expect(recommended(groupYaml(ruleGroupConfig(GenAiRules({ genAi, prices, alerts }).rules)))).toEqual([]);
+  });
+
+  test("Slo, with each SLI form and with tickets off", () => {
+    const calls = "traces_span_metrics_calls_total";
+    const slos = [
+      Slo({
+        name: "a",
+        objective: 0.995,
+        window: "28d",
+        sli: { good: `sum(rate(${calls}{status_code!="STATUS_CODE_ERROR"}[{{window}}]))`, total: `sum(rate(${calls}[{{window}}]))` },
+      }),
+      Slo({
+        name: "b",
+        objective: 0.999,
+        window: "30d",
+        sli: { errors: `sum(rate(${calls}{status_code="STATUS_CODE_ERROR"}[{{window}}]))`, total: `sum(rate(${calls}[{{window}}]))` },
+        alerting: { ticket: false },
+      }),
+    ];
+    for (const slo of slos) expect(recommended(groupYaml(ruleGroupConfig(slo.rules)))).toEqual([]);
+  });
+
+  const examplesDir = join(import.meta.dirname, "..", "..", "..", "examples");
+  const examples = readdirSync(examplesDir, { withFileTypes: true })
+    .filter((d) => d.isDirectory())
+    .map((d) => d.name);
+
+  test.each(examples)("the %s example", async (name) => {
+    const result = await build(join(examplesDir, name, "src"), [prometheusSerializer]);
+    expect(result.errors).toEqual([]);
+    const diags = runPostSynthChecks(postSynthChecks, result).filter((d) => !OPT_IN_CHECKS.has(d.checkId));
+    expect(diags).toEqual([]);
+  });
+});

package/src/lint/post-synth/index.ts

@@ -17,6 +17,21 @@ import { prom207 } from "./prom207";
 import { prom208 } from "./prom208";
 import { prom209 } from "./prom209";
 import { prom210 } from "./prom210";
+import { prom211 } from "./prom211";
+import { prom212 } from "./prom212";
+import { prom213 } from "./prom213";
+import { prom214 } from "./prom214";
+import { prom215 } from "./prom215";
+import { prom216 } from "./prom216";
+import { prom217 } from "./prom217";
+import { prom218 } from "./prom218";
+import { prom219 } from "./prom219";
+import { prom220 } from "./prom220";
+import { prom221 } from "./prom221";
+import { prom222 } from "./prom222";
+import { prom223 } from "./prom223";
+import { prom224 } from "./prom224";
+import { prom301 } from "./prom301";
 
 export const postSynthChecks: PostSynthCheck[] = [
   prom101,
@@ -36,4 +51,19 @@ export const postSynthChecks: PostSynthCheck[] = [
   prom208,
   prom209,
   prom210,
+  prom211,
+  prom212,
+  prom213,
+  prom214,
+  prom215,
+  prom216,
+  prom217,
+  prom218,
+  prom219,
+  prom220,
+  prom221,
+  prom222,
+  prom223,
+  prom224,
+  prom301,
 ];

package/src/lint/post-synth/post-synth.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "vitest";
 import { makePostSynthCtx, makePostSynthCtxFromFiles } from "@intentius/chant-test-utils";
 import { postSynthChecks } from "./index";
+import { OPT_IN_CHECKS } from "../audit-catalog";
 import { RECEIVER_INTEGRATION_TYPES } from "../../integrations";
 import { INTEGRATION_CASES, SLACK_APP_URL, amWith } from "../../testdata/integration-cases";
 import { prom101 } from "./prom101";
@@ -76,7 +77,8 @@ const rulesOnly = (rules: string) => makePostSynthCtx("prometheus", rules);
 const amOnly = (am: string) => makePostSynthCtx("prometheus", am);
 
 describe("a clean rule file and alertmanager.yml", () => {
-  test.each(postSynthChecks.map((c) => [c.id, c] as const))("%s finds nothing", (_id, check) => {
+  // PROM212 (no runbook_url) is opt-in and RULES carries none; see checks.test.ts.
+  test.each(postSynthChecks.filter((c) => !OPT_IN_CHECKS.has(c.id)).map((c) => [c.id, c] as const))("%s finds nothing", (_id, check) => {
     expect(check.check(both())).toEqual([]);
   });
 });

package/src/lint/post-synth/prom-helpers.ts

@@ -13,10 +13,12 @@
 import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import type { SerializerResult } from "@intentius/chant/serializer";
 import { loadAll } from "js-yaml";
+import { buildCollectorConfigs, collectorMetricIssues, collectorMetrics } from "../../collector-metrics";
 import { looksLikeAlertmanagerConfig, looksLikeRuleFile, type AlertmanagerConfig, type RuleFileConfig } from "../../model";
 import {
   validateAlertmanagerConfig,
   validateRuleFile,
+  validateRunbookUrls,
   validateSeverityRouting,
   type PrometheusIssue,
   type PrometheusIssueCode,
@@ -62,7 +64,7 @@ function toDiagnostic(issue: PrometheusIssue, source: string): PostSynthDiagnost
   };
 }
 
-/** Diagnostics for one rule-file code (PROM101-PROM107) across every rule file in the output. */
+/** Diagnostics for one rule-file code (PROM101-PROM107, PROM211, PROM213-PROM219) across every rule file in the output. */
 export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) =>
     validateRuleFile(config)
@@ -71,7 +73,7 @@ export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssue
   );
 }
 
-/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210) across every `alertmanager.yml` in the output. */
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210, PROM220-PROM224) across every `alertmanager.yml` in the output. */
 export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) =>
     validateAlertmanagerConfig(config)
@@ -80,6 +82,43 @@ export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusI
   );
 }
 
+/** PROM212 across every rule file in the output. Opt-in: the lexicon's `recommended` lint preset leaves it out (see ../../plugin.ts). */
+export function runbookDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRunbookUrls(config).map((i) => toDiagnostic(i, source)));
+}
+
+/**
+ * PROM301: every rule expression in the output against the metrics the
+ * build's collector configs emit. Silent when the build has none.
+ */
+export function collectorMetricDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const { ruleFiles } = prometheusDocs(ctx);
+  if (ruleFiles.length === 0) return [];
+  const emitted = collectorMetrics(buildCollectorConfigs(ctx));
+  if (!emitted) return [];
+  const out: PostSynthDiagnostic[] = [];
+  for (const { source, config } of ruleFiles) {
+    for (const group of Array.isArray(config?.groups) ? config.groups : []) {
+      for (const rule of Array.isArray(group?.rules) ? group.rules : []) {
+        const r = rule as unknown as Record<string, unknown>;
+        if (typeof r.expr !== "string") continue;
+        const subject = `${group.name}/${typeof r.record === "string" ? r.record : String(r.alert ?? "")}`;
+        for (const issue of collectorMetricIssues(r.expr, emitted)) {
+          const message = `rule ${subject} ${issue.message}`;
+          out.push({
+            checkId: "PROM301",
+            severity: "warning",
+            message: source && source !== "prometheus" ? `${source}: ${message}` : message,
+            entity: subject,
+            lexicon: "prometheus",
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 /** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
 export function routingDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
   const { ruleFiles, alertmanager } = prometheusDocs(ctx);

package/src/lint/post-synth/prom211.ts

@@ -0,0 +1,21 @@
+/**
+ * PROM211: An alerting rule has no for, or for: 0s
+ *
+ * The alert fires on the first evaluation that matches, so one bad scrape
+ * pages. Left alone when the expression reads no series (vector(1), a dead
+ * man's switch) or already spans a window: every selector read through a
+ * *_over_time function, or two conditions joined by and (the multi-window
+ * burn-rate form, where the short window does what for would).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom211: PostSynthCheck = {
+  id: "PROM211",
+  description: "An alerting rule has no for, or for: 0s",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM211");
+  },
+};

package/src/lint/post-synth/prom212.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM212: An alerting rule has no runbook_url annotation (opt-in)
+ *
+ * Off unless enabled: the lint preset all, or a lint.rules entry for PROM212,
+ * turns it on. See validateRunbookUrls.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { runbookDiagnostics } from "./prom-helpers";
+
+export const prom212: PostSynthCheck = {
+  id: "PROM212",
+  description: "An alerting rule has no runbook_url annotation (opt-in)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return runbookDiagnostics(ctx);
+  },
+};

package/src/lint/post-synth/prom213.ts

@@ -0,0 +1,20 @@
+/**
+ * PROM213: An alert expression has no comparison
+ *
+ * Every series the expression returns is an alert, so an expression with no
+ * comparison fires for all of them. absent(), absent_over_time() and unless
+ * count as a condition; a comparison with bool does not. An expression that
+ * reads no series (vector(1), a dead man's switch) is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom213: PostSynthCheck = {
+  id: "PROM213",
+  description: "An alert expression has no comparison",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM213");
+  },
+};

package/src/lint/post-synth/prom214.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM214: An alert template reads a label the expression aggregates away
+ *
+ * A $labels.x whose x the expression's by (...) leaves out, or its without
+ * (...) names, renders empty. Labels the rule or its group set are left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom214: PostSynthCheck = {
+  id: "PROM214",
+  description: "An alert template reads a label the expression aggregates away",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM214");
+  },
+};

package/src/lint/post-synth/prom215.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM215: rate, irate or increase over a name that is not a counter's
+ *
+ * These functions treat every drop as a counter reset. A name not ending in
+ * _total, _count, _sum or _bucket is read as a gauge.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom215: PostSynthCheck = {
+  id: "PROM215",
+  description: "rate, irate or increase over a name that is not a counter's",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM215");
+  },
+};

package/src/lint/post-synth/prom216.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM216: histogram_quantile over a series without _bucket, or without le
+ *
+ * A classic histogram's quantile needs its _bucket series with the le label
+ * kept. A native histogram has no _bucket series, so this check does not apply
+ * to one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom216: PostSynthCheck = {
+  id: "PROM216",
+  description: "histogram_quantile over a series without _bucket, or without le",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM216");
+  },
+};

package/src/lint/post-synth/prom217.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM217: A recording rule name is not in level:metric:operations form
+ *
+ * Prometheus's naming convention for recorded series, e.g.
+ * job:http_requests:rate5m.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom217: PostSynthCheck = {
+  id: "PROM217",
+  description: "A recording rule name is not in level:metric:operations form",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM217");
+  },
+};

package/src/lint/post-synth/prom218.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM218: A regex matcher needs no regex, or is anchored
+ *
+ * A =~ or !~ with no regex metacharacters is an equality matcher written the
+ * slow way. Prometheus anchors every regex, so a leading ^ or trailing $ does
+ * nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom218: PostSynthCheck = {
+  id: "PROM218",
+  description: "A regex matcher needs no regex, or is anchored",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM218");
+  },
+};

package/src/lint/post-synth/prom219.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM219: An alerting rule sets the alertname label
+ *
+ * Prometheus sets alertname to the rule's name after applying the rule's
+ * labels, so the value is overwritten.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ruleFileDiagnostics } from "./prom-helpers";
+
+export const prom219: PostSynthCheck = {
+  id: "PROM219",
+  description: "An alerting rule sets the alertname label",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return ruleFileDiagnostics(ctx, "PROM219");
+  },
+};

package/src/lint/post-synth/prom220.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM220: A receiver turns off TLS certificate verification
+ *
+ * tls_config.insecure_skip_verify: true on a receiver, or in global, accepts
+ * any certificate the endpoint presents.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom220: PostSynthCheck = {
+  id: "PROM220",
+  description: "A receiver turns off TLS certificate verification",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM220");
+  },
+};

package/src/lint/post-synth/prom221.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM221: SMTP credentials sent with require_tls false
+ *
+ * An email receiver with SMTP auth and require_tls false (its own, or
+ * global.smtp_require_tls) can send the credentials in clear text. Implicit
+ * TLS is left alone.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom221: PostSynthCheck = {
+  id: "PROM221",
+  description: "SMTP credentials sent with require_tls false",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM221");
+  },
+};

package/src/lint/post-synth/prom222.ts

@@ -0,0 +1,18 @@
+/**
+ * PROM222: Credentials sent to an http:// receiver URL
+ *
+ * An integration whose URL is http:// and whose request carries a credential:
+ * user info in the URL, http_config auth, or a key or token field.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom222: PostSynthCheck = {
+  id: "PROM222",
+  description: "Credentials sent to an http:// receiver URL",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM222");
+  },
+};

package/src/lint/post-synth/prom223.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM223: repeat_interval is shorter than group_interval
+ *
+ * Alertmanager resends only when it flushes a group, every group_interval, so
+ * a shorter repeat_interval never takes effect. Intervals are inherited down
+ * the routing tree from Alertmanager's defaults.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom223: PostSynthCheck = {
+  id: "PROM223",
+  description: "repeat_interval is shorter than group_interval",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM223");
+  },
+};