@intentius/chant-lexicon-prometheus 0.105.0 → 0.106.1

package/src/import/parser.ts

@@ -1,5 +1,5 @@
 /**
- * Rule file or `alertmanager.yml` -> `TemplateIR`, for `chant import`.
+ * Rule file, `prometheus.yml` or `alertmanager.yml` -> `TemplateIR`, for `chant import`.
  *
  * Either file is one document whose parts name each other (a route names a
  * receiver and time intervals), so the IR carries the whole file as one
@@ -24,7 +24,9 @@ import {
   ALERTMANAGER_GLOBAL_FIELDS,
   RECEIVER_INTEGRATIONS,
   looksLikeAlertmanagerConfig,
+  looksLikePrometheusConfig,
   looksLikeRuleFile,
+  PROMETHEUS_CONFIG_SECTIONS,
   type AlertmanagerConfig,
   type InhibitRuleConfig,
   type ReceiverConfig,
@@ -32,8 +34,11 @@ import {
   type RuleConfig,
   type RuleFileConfig,
   type RuleGroupConfig,
+  type PrometheusConfigFile,
+  type ScrapeJobConfig,
   type TimeIntervalConfig,
 } from "../model";
+import { TYPED_SD_KINDS } from "../model";
 import { PROMETHEUS_PIN } from "../pin";
 
 /** The IR resource type for a whole rule file. */
@@ -41,6 +46,14 @@ export const RULE_FILE_RESOURCE_TYPE = "Prometheus::RuleFile";
 /** The IR resource type for a whole `alertmanager.yml`. */
 export const ALERTMANAGER_RESOURCE_TYPE = "Prometheus::Alertmanager::Config";
 
+/** The IR resource type for a whole `prometheus.yml`. */
+export const PROMETHEUS_RESOURCE_TYPE = "Prometheus::Config";
+
+/** `properties` of the `Prometheus::Config` resource. */
+export interface PrometheusResourceProperties {
+  config: PrometheusConfigFile;
+}
+
 /** `properties` of the `Prometheus::RuleFile` resource. */
 export interface RuleFileResourceProperties {
   file: RuleFileConfig;
@@ -54,7 +67,8 @@ export interface AlertmanagerResourceProperties {
 /** What the parser read. */
 export type ParsedPrometheusFile =
   | { kind: "rules"; file: RuleFileConfig; warnings: string[] }
-  | { kind: "alertmanager"; config: AlertmanagerConfig; warnings: string[] };
+  | { kind: "alertmanager"; config: AlertmanagerConfig; warnings: string[] }
+  | { kind: "prometheus"; config: PrometheusConfigFile; warnings: string[] };
 
 // YAML 1.2 core types plus `<<` merge keys, which Alertmanager configs use to
 // share notifier settings. The default schema would also turn an unquoted
@@ -324,6 +338,52 @@ function parseAlertmanager(doc: Record<string, unknown>, warnings: string[]): Al
   return config;
 }
 
+// ── prometheus.yml ──────────────────────────────────────────────────
+
+function parsePrometheusConfig(doc: Record<string, unknown>, warnings: string[]): PrometheusConfigFile {
+  const config: Record<string, unknown> = {};
+  for (const k of Object.keys(doc)) {
+    if (!PROMETHEUS_CONFIG_SECTIONS.includes(k)) warnings.push(`top-level section "${k}" is not one Prometheus ${PROM_VERSION} defines; it is not carried`);
+  }
+  const jobNames = new Set<string>();
+  for (const key of PROMETHEUS_CONFIG_SECTIONS) {
+    const v = doc[key];
+    if (v === undefined || v === null) continue;
+    if (key === "rule_files" || key === "scrape_config_files") {
+      const list = stringList(v, key, warnings);
+      if (list) config[key] = list;
+    } else if (key === "scrape_configs") {
+      if (!Array.isArray(v)) {
+        warnings.push("scrape_configs is not a list; it is not carried");
+        continue;
+      }
+      const jobs: ScrapeJobConfig[] = [];
+      v.forEach((raw, i) => {
+        if (!isPlainObject(raw) || typeof raw.job_name !== "string") {
+          warnings.push(`scrape_configs[${i}] has no job_name; it is not carried`);
+          return;
+        }
+        if (jobNames.has(raw.job_name)) warnings.push(`scrape_configs: job_name "${raw.job_name}" is used more than once; Prometheus rejects that`);
+        jobNames.add(raw.job_name);
+        const sd = Object.keys(raw).filter((k) => k.endsWith("_sd_configs") && !TYPED_SD_KINDS.includes(k));
+        if (sd.length > 0) warnings.push(`job "${raw.job_name}": ${sd.join(", ")} ${sd.length === 1 ? "is" : "are"} carried as data, untyped`);
+        jobs.push(raw as unknown as ScrapeJobConfig);
+      });
+      config.scrape_configs = jobs;
+    } else if (key === "remote_write" || key === "remote_read") {
+      if (Array.isArray(v)) config[key] = v;
+      else warnings.push(`${key} is not a list; it is not carried`);
+    } else if (isPlainObject(v)) {
+      config[key] = v;
+    } else {
+      warnings.push(`${key} is not a mapping; it is not carried`);
+    }
+  }
+  return config as PrometheusConfigFile;
+}
+
+const PROM_VERSION = PROMETHEUS_PIN.prometheus.version;
+
 // ── entry points ────────────────────────────────────────────────────
 
 /** Parse a rule file or `alertmanager.yml`, telling them apart by shape. */
@@ -331,16 +391,17 @@ export function parsePrometheusYaml(content: string): ParsedPrometheusFile {
   const warnings: string[] = [];
   const doc = content.trim() === "" ? {} : jsYaml.load(content, { schema: YAML_SCHEMA });
   if (!isPlainObject(doc)) {
-    throw new Error("a Prometheus rule file or alertmanager.yml is a YAML mapping; this document is not one");
+    throw new Error("a Prometheus rule file, alertmanager.yml or prometheus.yml is a YAML mapping; this document is not one");
   }
   if (looksLikeRuleFile(doc)) return { kind: "rules", file: parseRuleFile(doc, warnings), warnings };
   if (looksLikeAlertmanagerConfig(doc)) return { kind: "alertmanager", config: parseAlertmanager(doc, warnings), warnings };
+  if (looksLikePrometheusConfig(doc)) return { kind: "prometheus", config: parsePrometheusConfig(doc, warnings), warnings };
   if ("groups" in doc) {
     // A rule file with a malformed group still imports; the bad parts are named.
     return { kind: "rules", file: parseRuleFile(doc, warnings), warnings };
   }
   throw new Error(
-    "this YAML is neither a Prometheus rule file (groups: of named rule lists) nor an alertmanager.yml (route: or receivers:)",
+    "this YAML is not a Prometheus rule file (groups: of named rule lists), an alertmanager.yml (route: or receivers:) or a prometheus.yml (scrape_configs: and the like)",
   );
 }
 
@@ -349,7 +410,13 @@ export class PrometheusParser implements TemplateParser {
   parse(content: string): TemplateIR {
     const parsed = parsePrometheusYaml(content);
     const resource =
-      parsed.kind === "rules"
+      parsed.kind === "prometheus"
+        ? {
+            logicalId: "prometheus",
+            type: PROMETHEUS_RESOURCE_TYPE,
+            properties: { config: parsed.config } satisfies PrometheusResourceProperties as unknown as Record<string, unknown>,
+          }
+        : parsed.kind === "rules"
         ? {
             logicalId: "ruleFile",
             type: RULE_FILE_RESOURCE_TYPE,

package/src/import/prometheus-roundtrip.test.ts

@@ -0,0 +1,148 @@
+/**
+ * `prometheus.yml` through `chant import`: YAML -> TypeScript -> `chant build`
+ * -> YAML must give back the same file (key order and quoting aside), the
+ * generated source must lint clean, and `promtool check config` must accept
+ * both the fixture and what comes back, when `promtool` is on PATH (or
+ * `PROMTOOL` names it).
+ */
+
+import { describe, expect, test } from "vitest";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { load } from "js-yaml";
+import { build } from "@intentius/chant/build";
+import { lintCommand } from "@intentius/chant/cli/commands/lint";
+import { prometheusSerializer, PROMETHEUS_FILE } from "../serializer";
+import { hasTool, promtoolCheckConfig } from "../tools";
+import { PrometheusParser } from "./parser";
+import { PrometheusGenerator } from "./generator";
+import { pkgDir, read } from "./testdata/fixtures";
+import type { SerializerResult } from "@intentius/chant/serializer";
+
+const PROMTOOL = hasTool(process.env.PROMTOOL ?? "promtool");
+
+/** The `prometheus.yml` of one build output: the primary output, or the file beside a rule file. */
+function prometheusYml(out: string | SerializerResult | undefined): string {
+  if (out === undefined || typeof out === "string") return out ?? "";
+  return out.files?.[PROMETHEUS_FILE] ?? out.primary;
+}
+
+function projectDir(): string {
+  const dir = mkdtempSync(join(pkgDir, ".roundtrip-tmp-"));
+  mkdirSync(join(dir, "src"));
+  writeFileSync(join(dir, "chant.config.ts"), 'export default { lexicons: ["prometheus"] };\n');
+  writeFileSync(join(dir, "package.json"), '{ "name": "prometheus-config-roundtrip", "private": true, "type": "module" }\n');
+  return dir;
+}
+
+async function importAndBuild(yaml: string) {
+  const dir = projectDir();
+  try {
+    const srcDir = join(dir, "src");
+    const ir = new PrometheusParser().parse(yaml);
+    const files: string[] = [];
+    const sources: string[] = [];
+    for (const file of new PrometheusGenerator().generate(ir)) {
+      writeFileSync(join(srcDir, file.path), file.content);
+      files.push(file.path);
+      sources.push(`// ${file.path}\n${file.content}`);
+    }
+    const result = await build(srcDir, [prometheusSerializer]);
+    const lint = await lintCommand({ path: srcDir, format: "stylish" });
+    return {
+      files,
+      source: sources.join("\n"),
+      warnings: ir.warnings ?? [],
+      yaml: prometheusYml(result.outputs.get("prometheus")),
+      buildErrors: result.errors,
+      lint: { errorCount: lint.errorCount, warningCount: lint.warningCount, output: lint.output },
+    };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+type Doc = Record<string, unknown> & { scrape_configs?: Array<{ job_name: string }> };
+
+/** A parsed prometheus.yml with the scrape jobs sorted by name, the one order the serializer changes. */
+function normalize(yaml: string): Doc {
+  const doc = (load(yaml) ?? {}) as Doc;
+  if (doc.scrape_configs) doc.scrape_configs = [...doc.scrape_configs].sort((a, b) => a.job_name.localeCompare(b.job_name));
+  return doc;
+}
+
+/** Files the fixture's rule_files glob and promtool's checks read. */
+const COMPANIONS = { "rules/a.yml": "groups:\n  - name: g\n    rules:\n      - record: a:b\n        expr: sum(up)\n" };
+
+describe("prometheus.yml: YAML -> TypeScript -> YAML", () => {
+  test("a config using every typed section and discovery kind", async () => {
+    const fixture = read("prometheus-full.yml");
+    const out = await importAndBuild(fixture);
+    expect(out.buildErrors).toEqual([]);
+    expect(normalize(out.yaml)).toEqual(normalize(fixture));
+    if (out.lint.errorCount + out.lint.warningCount > 0) console.log(out.lint.output);
+    expect(out.lint.errorCount).toBe(0);
+    expect(out.lint.warningCount).toBe(0);
+
+    expect(out.files).toEqual(["scrape-configs-1.ts", "scrape-configs-2.ts", "prometheus.ts"]);
+    expect(out.source).toContain("new ScrapeConfig(");
+    expect(out.source).toContain("new PrometheusConfig(");
+    expect(out.source).toMatch(/: StaticConfig\[\] = /);
+    expect(out.source).toMatch(/: RelabelConfig\[\] = /);
+    expect(out.source).toMatch(/: KubernetesSDConfig\[\] = /);
+    expect(out.source).toMatch(/: FileSDConfig\[\] = /);
+    expect(out.source).toMatch(/: HttpSDConfig\[\] = /);
+    expect(out.source).toMatch(/: DnsSDConfig\[\] = /);
+    expect(out.source).toMatch(/: Ec2SDConfig\[\] = /);
+    expect(out.source).toMatch(/: ConsulSDConfig\[\] = /);
+    expect(out.source).toMatch(/: RemoteWriteConfig\[\] = /);
+    expect(out.source).toMatch(/: RemoteReadConfig\[\] = /);
+    expect(out.source).toMatch(/: PrometheusGlobalConfig = /);
+    expect(out.source).toMatch(/: PrometheusAlertingConfig = /);
+    expect(out.source).toMatch(/: OtlpConfig = /);
+
+    // The one discovery kind the lexicon does not type is named, and kept.
+    expect(out.source).toContain("docker_sd_configs is not a discovery kind the lexicon types");
+    expect(out.warnings).toHaveLength(1);
+    expect(out.warnings[0]).toContain("docker_sd_configs");
+  });
+
+  test("the config terragucci emits is a fixed point", async () => {
+    const yaml = `global:
+  scrape_interval: 5s
+scrape_configs:
+  - job_name: otel-collector
+    static_configs:
+      - targets:
+          - otel-collector:8889
+`;
+    const out = await importAndBuild(yaml);
+    expect(out.buildErrors).toEqual([]);
+    expect(out.yaml).toBe(yaml);
+    expect(out.warnings).toEqual([]);
+    expect(out.lint.errorCount + out.lint.warningCount, out.lint.output).toBe(0);
+    expect(out.files).toEqual(["scrape-configs.ts", "prometheus.ts"]);
+  });
+
+  test("scrape jobs only: no PrometheusConfig is declared", async () => {
+    const out = await importAndBuild("scrape_configs:\n  - job_name: a\n    static_configs:\n      - targets:\n          - a:1\n");
+    expect(out.files).toEqual(["scrape-configs.ts"]);
+    expect(out.source).not.toContain("PrometheusConfig(");
+  });
+
+  test("a rule file is still a rule file", async () => {
+    const ir = new PrometheusParser().parse("groups:\n  - name: g\n    rules:\n      - record: a:b\n        expr: sum(up)\n");
+    expect(ir.resources[0].type).toBe("Prometheus::RuleFile");
+  });
+});
+
+describe("promtool check config", () => {
+  test.skipIf(!PROMTOOL)("accepts the fixture and the file imported from it", async () => {
+    const fixture = read("prometheus-full.yml");
+    const before = promtoolCheckConfig(fixture, COMPANIONS);
+    expect(before.ok, before.output).toBe(true);
+    const out = await importAndBuild(fixture);
+    const after = promtoolCheckConfig(out.yaml, COMPANIONS);
+    expect(after.ok, after.output).toBe(true);
+  }, 60_000);
+});

package/src/import/slo.ts

@@ -41,6 +41,21 @@ function same(a: unknown, b: unknown): boolean {
 /** The SLI expressions a recorded error ratio was built from, with the window put back as `{{window}}`. */
 function sliFrom(expr: string, window: string): SloProps["sli"] | undefined {
   const unwindow = (s: string) => s.split(`[${window}]`).join(`[${SLO_WINDOW_PLACEHOLDER}]`);
+  // Since #3548 a window with no events records nothing: `((E) or 0 * ((T) > 0)) / ((T) > 0)`, and the good/total form
+  // as `1 - (((G) or 0 * ((T) > 0)) / ((T) > 0))`.
+  const idle = (head: string, divide: string, tail: string, key: "errors" | "good"): SloProps["sli"] | undefined => {
+    if (!expr.startsWith(head) || !expr.endsWith(tail)) return undefined;
+    const body = expr.slice(head.length, expr.length - tail.length);
+    const orAt = body.indexOf(") or 0 * ((");
+    const divAt = body.indexOf(`) > 0))${divide}((`);
+    if (orAt === -1 || divAt < orAt) return undefined;
+    const total = body.slice(divAt + `) > 0))${divide}((`.length);
+    return { [key]: unwindow(body.slice(0, orAt)), total: unwindow(total) } as SloProps["sli"];
+  };
+  const idleErrors = idle("((", "\n/\n", ") > 0)", "errors");
+  if (idleErrors) return idleErrors;
+  const idleGood = idle("1 - (\n  ((", "\n  /\n  ", ") > 0)\n)", "good");
+  if (idleGood) return idleGood;
   const goodHead = "1 - (\n  (";
   const goodTail = ")\n)";
   if (expr.startsWith(goodHead) && expr.endsWith(goodTail)) {

package/src/import/testdata/prometheus-full.yml

@@ -0,0 +1,149 @@
+# A prometheus.yml using the typed sections and every typed service discovery kind.
+global:
+  scrape_interval: 15s
+  scrape_timeout: 10s
+  evaluation_interval: 30s
+  external_labels:
+    cluster: prod-eu
+    replica: a
+  query_log_file: /var/log/prometheus/queries.log
+  body_size_limit: 10MB
+  sample_limit: 50000
+  label_limit: 64
+  target_limit: 500
+alerting:
+  alert_relabel_configs:
+    - regex: replica
+      action: labeldrop
+  alertmanagers:
+    - scheme: http
+      path_prefix: /alertmanager
+      timeout: 10s
+      api_version: v2
+      static_configs:
+        - targets: ["alertmanager-0:9093", "alertmanager-1:9093"]
+rule_files:
+  - rules/*.yml
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:9090"]
+        labels:
+          tier: control
+  - job_name: otel-collector
+    scrape_interval: 5s
+    scrape_timeout: 4s
+    metrics_path: /metrics
+    honor_labels: true
+    honor_timestamps: false
+    params:
+      format: [prometheus]
+    static_configs:
+      - targets: ["otel-collector:8889"]
+    metric_relabel_configs:
+      - source_labels: [__name__]
+        regex: "go_.*"
+        action: drop
+      - source_labels: [job, instance]
+        separator: "/"
+        target_label: job_instance
+        replacement: "$1"
+        action: replace
+  - job_name: kubernetes-pods
+    scheme: https
+    tls_config:
+      insecure_skip_verify: true
+    authorization:
+      type: Bearer
+      credentials: sample-token
+    kubernetes_sd_configs:
+      - role: pod
+        api_server: https://kubernetes.default.svc:443
+        namespaces:
+          names: [default, observability]
+        selectors:
+          - role: pod
+            label: app=api
+        attach_metadata:
+          node: true
+    relabel_configs:
+      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
+        regex: "true"
+        action: keep
+      - action: labelmap
+        regex: __meta_kubernetes_pod_label_(.+)
+      - source_labels: [__address__]
+        modulus: 4
+        target_label: __tmp_hash
+        action: hashmod
+  - job_name: files
+    file_sd_configs:
+      - files: [targets/*.json, targets/*.yml]
+        refresh_interval: 1m
+  - job_name: http-targets
+    basic_auth:
+      username: scraper
+      password: sample-password
+    http_sd_configs:
+      - url: https://targets.example.com/sd
+        refresh_interval: 2m
+  - job_name: dns-targets
+    dns_sd_configs:
+      - names: [api.service.internal]
+        type: A
+        port: 9100
+        refresh_interval: 30s
+  - job_name: ec2-nodes
+    ec2_sd_configs:
+      - region: eu-west-1
+        port: 9100
+        refresh_interval: 5m
+        filters:
+          - name: tag:monitoring
+            values: ["true"]
+  - job_name: consul-services
+    bearer_token: sample-bearer
+    consul_sd_configs:
+      - server: consul.service.internal:8500
+        datacenter: dc1
+        services: [api, worker]
+        tags: [metrics]
+        node_meta:
+          rack: r1
+        refresh_interval: 1m
+  - job_name: docker-hosts
+    docker_sd_configs:
+      - host: unix:///var/run/docker.sock
+remote_write:
+  - url: https://mimir.example.com/api/v1/push
+    name: mimir
+    remote_timeout: 30s
+    headers:
+      X-Scope-OrgID: tenant-1
+    send_exemplars: true
+    basic_auth:
+      username: writer
+      password: sample-password
+    write_relabel_configs:
+      - source_labels: [__name__]
+        regex: "debug_.*"
+        action: drop
+    queue_config:
+      capacity: 10000
+      max_shards: 50
+      max_samples_per_send: 2000
+      batch_send_deadline: 5s
+    metadata_config:
+      send: true
+      send_interval: 1m
+remote_read:
+  - url: https://mimir.example.com/prometheus/api/v1/read
+    name: mimir-read
+    read_recent: true
+    required_matchers:
+      env: prod
+otlp:
+  promote_resource_attributes: [service.name, k8s.namespace.name]
+  translation_strategy: UnderscoreEscapingWithSuffixes
+runtime:
+  gogc: 75

package/src/index.ts

@@ -2,7 +2,7 @@
 
 // Plugin and serializer
 export { prometheusPlugin } from "./plugin";
-export { prometheusSerializer, ALERTMANAGER_FILE } from "./serializer";
+export { prometheusSerializer, ALERTMANAGER_FILE, PROMETHEUS_FILE } from "./serializer";
 
 // Rule groups
 export {
@@ -50,16 +50,34 @@ export {
   type AlertmanagerSettingsEntity,
 } from "./alertmanager";
 
+// prometheus.yml
+export {
+  PrometheusConfig,
+  ScrapeConfig,
+  PROMETHEUS_CONFIG_TYPE,
+  SCRAPE_CONFIG_TYPE,
+  isPrometheusConfig,
+  isScrapeConfig,
+  isPrometheusConfigEntity,
+  type PrometheusConfigProps,
+  type PrometheusConfigEntity,
+  type ScrapeConfigProps,
+  type ScrapeConfigEntity,
+} from "./prometheus-config";
+
 // The plain-data model, building, YAML and checks
 export * from "./model";
 export {
   buildRuleFile,
   buildAlertmanagerConfig,
+  buildPrometheusConfig,
   ruleFileYaml,
   alertmanagerYaml,
+  prometheusConfigYaml,
   emitYaml,
   type BuiltRuleFile,
   type BuiltAlertmanager,
+  type BuiltPrometheusConfig,
 } from "./build";
 export { isValidDuration, durationMs, formatDuration } from "./duration";
 export { parseMatchers, matcherMatches, matcher, type Matcher, type MatchOp, type ParsedMatchers } from "./matchers";
@@ -76,7 +94,7 @@ export {
 export { PROMETHEUS_PIN } from "./pin";
 
 // promtool and amtool, when installed
-export { promtoolCheckRules, promtoolTestRules, amtoolCheckConfig, hasTool, type ToolResult } from "./tools";
+export { promtoolCheckRules, promtoolCheckConfig, promtoolTestRules, amtoolCheckConfig, hasTool, type ToolResult } from "./tools";
 
 // Composites
 export {

package/src/lint/audit-catalog.ts

@@ -220,6 +220,13 @@ export const prometheusAuditCatalog: Record<string, RuleMeta> = {
     "Inhibit rule matches one alert as source and target, with no equal",
     "List the labels source and target must share under equal (e.g. alertname, cluster), or make the matchers exclusive.",
   ),
+  PROM225: outputRule(
+    "PROM225",
+    "merge-worthy",
+    "correctness",
+    "labeldrop or labelkeep relabel step carries a field it does not take",
+    "Remove source_labels, separator, target_label, modulus and replacement from the step; keep only regex (and action).",
+  ),
   PROM301: outputRule(
     "PROM301",
     "merge-worthy",

package/src/lint/audit-lineage.test.ts

@@ -36,7 +36,7 @@ describe("prometheus audit lineage (#2916, #3136)", () => {
   });
 
   test("rules no upstream tool checks carry no credit", () => {
-    for (const id of ["PROM001", "PROM003", "PROM202", "PROM207", "PROM216", "PROM219", "PROM220", "PROM221", "PROM222", "PROM223", "PROM224", "PROM301"]) {
+    for (const id of ["PROM001", "PROM003", "PROM202", "PROM207", "PROM216", "PROM219", "PROM220", "PROM221", "PROM222", "PROM223", "PROM224", "PROM225", "PROM301"]) {
       expect(prometheusAuditCatalog[id].lineage, id).toBeUndefined();
     }
   });

package/src/lint/audit-lineage.ts

@@ -46,6 +46,8 @@
  * - PROM220-PROM224: check-config accepts insecure_skip_verify, SMTP auth
  *   without TLS, credentials over http://, a repeat_interval under
  *   group_interval, and an inhibit rule without equal.
+ * - PROM225: promtool check config rejects it, but the check reads a built
+ *   prometheus.yml, which no tool above does.
  * - PROM301: no tool here reads a rule file together with the collector
  *   config that produces its metrics.
  */

package/src/lint/post-synth/checks.test.ts

@@ -10,6 +10,7 @@ import { build } from "@intentius/chant/build";
 import { runPostSynthChecks } from "@intentius/chant/lint/post-synth";
 import { genAiMetrics } from "@intentius/chant-lexicon-otel/genai";
 import { postSynthChecks } from "./index";
+import { prom225 } from "./prom225";
 import { OPT_IN_CHECKS } from "../audit-catalog";
 import { prometheusSerializer } from "../../serializer";
 import { emitYaml } from "../../build";
@@ -255,3 +256,36 @@ describe("the lexicon's own rules report none of the checks", () => {
     expect(diags).toEqual([]);
   });
 });
+
+describe("PROM225 labeldrop and labelkeep fields", () => {
+  const prom = (step: Record<string, unknown>) =>
+    JSON.stringify({ scrape_configs: [{ job_name: "j", static_configs: [{ targets: ["a:1"] }], metric_relabel_configs: [step] }] });
+  const run = (text: string) => prom225.check(makePostSynthCtx("prometheus", text));
+
+  test("a labeldrop with only regex reports nothing", () => {
+    expect(run(prom({ action: "labeldrop", regex: "tmp_.*" }))).toEqual([]);
+    expect(run(prom({ action: "replace", source_labels: ["a"], target_label: "b" }))).toEqual([]);
+  });
+
+  test("each foreign field on labeldrop or labelkeep is reported once per step", () => {
+    for (const action of ["labeldrop", "labelkeep"]) {
+      for (const field of ["source_labels", "separator", "target_label", "modulus", "replacement"]) {
+        const diags = run(prom({ action, regex: "x", [field]: field === "modulus" ? 2 : field === "source_labels" ? ["a"] : "v" }));
+        expect(diags.map((d) => d.checkId), `${action} ${field}`).toEqual(["PROM225"]);
+        expect(diags[0].entity).toBe("scrape_configs[0].metric_relabel_configs[0]");
+        expect(diags[0].message).toContain(field);
+      }
+    }
+  });
+
+  test("steps under remote_write and alerting are read too", () => {
+    const text = JSON.stringify({
+      alerting: { alert_relabel_configs: [{ action: "labelkeep", regex: "a", replacement: "$1" }] },
+      remote_write: [{ url: "http://r", write_relabel_configs: [{ action: "labeldrop", regex: "a", separator: ";" }] }],
+    });
+    expect(run(text).map((d) => d.entity)).toEqual([
+      "alerting.alert_relabel_configs[0]",
+      "remote_write[0].write_relabel_configs[0]",
+    ]);
+  });
+});

package/src/lint/post-synth/index.ts

@@ -31,6 +31,7 @@ import { prom221 } from "./prom221";
 import { prom222 } from "./prom222";
 import { prom223 } from "./prom223";
 import { prom224 } from "./prom224";
+import { prom225 } from "./prom225";
 import { prom301 } from "./prom301";
 
 export const postSynthChecks: PostSynthCheck[] = [
@@ -65,5 +66,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   prom222,
   prom223,
   prom224,
+  prom225,
   prom301,
 ];

package/src/lint/post-synth/prom-helpers.ts

@@ -14,6 +14,8 @@ import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lin
 import type { SerializerResult } from "@intentius/chant/serializer";
 import { loadAll } from "js-yaml";
 import { buildCollectorConfigs, collectorMetricIssues, collectorMetrics } from "../../collector-metrics";
+import { looksLikePrometheusConfig, type PrometheusConfigFile } from "../../config-model";
+import { validateRelabelFields } from "../../validate-relabel";
 import { looksLikeAlertmanagerConfig, looksLikeRuleFile, type AlertmanagerConfig, type RuleFileConfig } from "../../model";
 import {
   validateAlertmanagerConfig,
@@ -27,11 +29,12 @@ import {
 export interface FoundDocs {
   ruleFiles: Array<{ source: string; config: RuleFileConfig }>;
   alertmanager: Array<{ source: string; config: AlertmanagerConfig }>;
+  prometheus: Array<{ source: string; config: PrometheusConfigFile }>;
 }
 
 /** Every rule file and Alertmanager config in the output. Parsed with js-yaml rather than `ctx.docs`, which keeps block scalars and flow lists as strings. */
 export function prometheusDocs(ctx: PostSynthContext): FoundDocs {
-  const found: FoundDocs = { ruleFiles: [], alertmanager: [] };
+  const found: FoundDocs = { ruleFiles: [], alertmanager: [], prometheus: [] };
   for (const [lexicon, output] of ctx.outputs) {
     const texts: Array<[string, string]> =
       typeof output === "string"
@@ -48,6 +51,7 @@ export function prometheusDocs(ctx: PostSynthContext): FoundDocs {
       for (const doc of docs) {
         if (looksLikeRuleFile(doc)) found.ruleFiles.push({ source, config: doc });
         else if (looksLikeAlertmanagerConfig(doc)) found.alertmanager.push({ source, config: doc });
+        else if (looksLikePrometheusConfig(doc)) found.prometheus.push({ source, config: doc });
       }
     }
   }
@@ -82,6 +86,11 @@ export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusI
   );
 }
 
+/** PROM225 across every `prometheus.yml` in the output. */
+export function relabelDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).prometheus.flatMap(({ source, config }) => validateRelabelFields(config).map((i) => toDiagnostic(i, source)));
+}
+
 /** PROM212 across every rule file in the output. Opt-in: the lexicon's `recommended` lint preset leaves it out (see ../../plugin.ts). */
 export function runbookDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRunbookUrls(config).map((i) => toDiagnostic(i, source)));

package/src/lint/post-synth/prom225.ts

@@ -0,0 +1,19 @@
+/**
+ * PROM225: A labeldrop or labelkeep relabel step carries a field it does not take
+ *
+ * Both actions match regex against label names, so source_labels, separator,
+ * target_label, modulus and replacement do nothing, and Prometheus rejects the
+ * file at load. Reads every prometheus.yml in the output.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { relabelDiagnostics } from "./prom-helpers";
+
+export const prom225: PostSynthCheck = {
+  id: "PROM225",
+  description: "A labeldrop or labelkeep relabel step carries a field it does not take",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return relabelDiagnostics(ctx);
+  },
+};