@intentius/chant-lexicon-prometheus 0.105.0 → 0.106.1

package/src/model.ts

@@ -104,6 +104,7 @@ export function ruleName(rule: RuleConfig): string {
 // ── Alertmanager ────────────────────────────────────────────────────
 
 export * from "./integrations";
+export * from "./config-model";
 
 /** One entry under `receivers:`. */
 export interface ReceiverConfig {

package/src/plugin.test.ts

@@ -52,6 +52,7 @@ describe("prometheus plugin", () => {
       "PROM222",
       "PROM223",
       "PROM224",
+      "PROM225",
       "PROM301",
     ]);
   });

package/src/plugin.ts

@@ -57,6 +57,7 @@ export const prometheusPlugin: LexiconPlugin = {
     const { prometheus, alertmanager } = PROMETHEUS_PIN;
     console.error(`prometheus: ${CATALOG.length} entities`);
     console.error(`  rule file (${prometheus.source} ${prometheus.version}): RuleGroup, recording and alerting rules`);
+    console.error(`  prometheus.yml (${prometheus.source} ${prometheus.version}): ScrapeConfig, PrometheusConfig`);
     console.error(
       `  alertmanager.yml (${alertmanager.source} ${alertmanager.version}): ` +
         CATALOG.filter((c) => c.file === "alertmanager.yml").map((c) => c.className).join(", "),

package/src/prometheus-config.test.ts

@@ -0,0 +1,230 @@
+/**
+ * `prometheus.yml` as entities: `PrometheusConfig` and `ScrapeConfig` build to
+ * the file, the serializer writes it beside the other files, and
+ * `promtool check config` accepts it when `promtool` is on PATH.
+ *
+ * The import round trip is in import/prometheus-roundtrip.test.ts.
+ */
+
+import { describe, expect, test } from "vitest";
+import { load } from "js-yaml";
+import type { Declarable } from "@intentius/chant/declarable";
+import { buildPrometheusConfig, prometheusConfigYaml } from "./build";
+import { PrometheusConfig, ScrapeConfig, isPrometheusConfig, isScrapeConfig } from "./prometheus-config";
+import { prometheusSerializer, PROMETHEUS_FILE, ALERTMANAGER_FILE } from "./serializer";
+import { Receiver, Route, RuleGroup } from "./index";
+import { hasTool, promtoolCheckConfig } from "./tools";
+import { CATALOG } from "./catalog";
+import { detectTemplate } from "./detect";
+import { PrometheusParser } from "./import/parser";
+import type { SerializerResult } from "@intentius/chant/serializer";
+
+const PROMTOOL = hasTool(process.env.PROMTOOL ?? "promtool");
+
+function entities(record: Record<string, unknown>): Map<string, Declarable> {
+  return new Map(Object.entries(record) as Array<[string, Declarable]>);
+}
+
+/** What terragucci's observability/prometheus.ts emits today. */
+const terragucci = () => ({
+  config: new PrometheusConfig({ global: { scrape_interval: "5s" } }),
+  collector: new ScrapeConfig({ job_name: "otel-collector", static_configs: [{ targets: ["otel-collector:8889"] }] }),
+});
+
+const TERRAGUCCI_YAML = `global:
+  scrape_interval: 5s
+scrape_configs:
+  - job_name: otel-collector
+    static_configs:
+      - targets:
+          - otel-collector:8889
+`;
+
+describe("PrometheusConfig and ScrapeConfig", () => {
+  test("the guards tell the two entities apart", () => {
+    const { config, collector } = terragucci();
+    expect(isPrometheusConfig(config)).toBe(true);
+    expect(isScrapeConfig(config)).toBe(false);
+    expect(isScrapeConfig(collector)).toBe(true);
+    expect(isPrometheusConfig(collector)).toBe(false);
+  });
+
+  test("both are in the catalog", () => {
+    const names = CATALOG.filter((c) => c.file === "prometheus.yml").map((c) => c.className);
+    expect(names.sort()).toEqual(["PrometheusConfig", "ScrapeConfig"]);
+  });
+
+  test("the config terragucci emits today builds to the same text", () => {
+    expect(prometheusConfigYaml(Object.values(terragucci()) as unknown as Declarable[])).toBe(TERRAGUCCI_YAML);
+  });
+
+  test("sections come out in Prometheus's order and scrape jobs are sorted by name", () => {
+    const built = buildPrometheusConfig([
+      new ScrapeConfig({ job_name: "zeta", static_configs: [{ targets: ["z:1"] }] }),
+      new ScrapeConfig({ job_name: "alpha", static_configs: [{ targets: ["a:1"] }] }),
+      new PrometheusConfig({
+        otlp: { promote_resource_attributes: ["service.name"] },
+        rule_files: ["rules/*.yml"],
+        global: { scrape_interval: "15s", external_labels: { cluster: "dev" } },
+        alerting: { alertmanagers: [{ static_configs: [{ targets: ["alertmanager:9093"] }] }] },
+        remote_write: [{ url: "http://mimir:9009/api/v1/push" }],
+      }),
+    ]);
+    expect(Object.keys(built.config)).toEqual(["global", "alerting", "rule_files", "scrape_configs", "remote_write", "otlp"]);
+    expect(built.config.scrape_configs?.map((j) => j.job_name)).toEqual(["alpha", "zeta"]);
+    expect(built.warnings).toEqual([]);
+    expect(built.count).toBe(3);
+  });
+
+  test("scrape jobs written inline in PrometheusConfig are merged with declared ones", () => {
+    const declared = new ScrapeConfig({ job_name: "declared", static_configs: [{ targets: ["d:1"] }] });
+    const built = buildPrometheusConfig([
+      declared,
+      new PrometheusConfig({ scrape_configs: [declared, { job_name: "inline", static_configs: [{ targets: ["i:1"] }] }] }),
+    ]);
+    expect(built.config.scrape_configs?.map((j) => j.job_name)).toEqual(["declared", "inline"]);
+  });
+
+  test("undefined fields are dropped", () => {
+    const yaml = prometheusConfigYaml([new ScrapeConfig({ job_name: "a", scrape_interval: undefined, honor_labels: false })]);
+    expect(load(yaml)).toEqual({ scrape_configs: [{ job_name: "a", honor_labels: false }] });
+  });
+
+  test("a repeated job_name and a second PrometheusConfig are warnings", () => {
+    const built = buildPrometheusConfig([
+      new ScrapeConfig({ job_name: "dup" }),
+      new ScrapeConfig({ job_name: "dup" }),
+      new PrometheusConfig({ global: { scrape_interval: "1s" } }),
+      new PrometheusConfig({ global: { scrape_interval: "2s" } }),
+    ]);
+    expect(built.warnings).toHaveLength(2);
+    expect(built.config.global?.scrape_interval).toBe("1s");
+  });
+
+  test("an unlisted discovery kind is carried as written", () => {
+    const yaml = prometheusConfigYaml([
+      new ScrapeConfig({ job_name: "docker", docker_sd_configs: [{ host: "unix:///var/run/docker.sock" }] }),
+    ]);
+    expect(load(yaml)).toEqual({
+      scrape_configs: [{ job_name: "docker", docker_sd_configs: [{ host: "unix:///var/run/docker.sock" }] }],
+    });
+  });
+});
+
+describe("prometheus serializer with prometheus.yml", () => {
+  test("a build with only scrape configs writes prometheus.yml as the primary output", () => {
+    expect(prometheusSerializer.serialize(entities(terragucci()))).toBe(TERRAGUCCI_YAML);
+  });
+
+  test("a build with no prometheus.yml entities is unchanged", () => {
+    const out = prometheusSerializer.serialize(
+      entities({ g: new RuleGroup({ name: "g", rules: [{ record: "a:b", expr: "sum(up)" }] }) }),
+    );
+    expect(typeof out).toBe("string");
+    expect(out as string).toMatch(/^groups:/);
+  });
+
+  test("with rule groups, prometheus.yml is written beside the rule file", () => {
+    const out = prometheusSerializer.serialize(
+      entities({ ...terragucci(), g: new RuleGroup({ name: "g", rules: [{ record: "a:b", expr: "sum(up)" }] }) }),
+    ) as SerializerResult;
+    expect(out.primary).toMatch(/^groups:/);
+    expect(out.files).toEqual({ [PROMETHEUS_FILE]: TERRAGUCCI_YAML });
+  });
+
+  test("with rule groups and Alertmanager entities, all three files are written", () => {
+    const hook = new Receiver({ name: "hook", webhook_configs: [{ url: "http://hook:8080/" }] });
+    const out = prometheusSerializer.serialize(
+      entities({
+        ...terragucci(),
+        g: new RuleGroup({ name: "g", rules: [{ record: "a:b", expr: "sum(up)" }] }),
+        route: new Route({ receiver: hook }),
+      }),
+    ) as SerializerResult;
+    expect(out.primary).toMatch(/^groups:/);
+    expect(Object.keys(out.files ?? {})).toEqual([PROMETHEUS_FILE, ALERTMANAGER_FILE]);
+  });
+
+  test("with Alertmanager entities only, prometheus.yml is primary and alertmanager.yml beside it", () => {
+    const hook = new Receiver({ name: "hook", webhook_configs: [{ url: "http://hook:8080/" }] });
+    const out = prometheusSerializer.serialize(entities({ ...terragucci(), route: new Route({ receiver: hook }) })) as SerializerResult;
+    expect(out.primary).toBe(TERRAGUCCI_YAML);
+    expect(Object.keys(out.files ?? {})).toEqual([ALERTMANAGER_FILE]);
+  });
+
+  test("warnings travel with the output", () => {
+    const out = prometheusSerializer.serialize(
+      entities({ a: new ScrapeConfig({ job_name: "dup" }), b: new ScrapeConfig({ job_name: "dup" }) }),
+    ) as SerializerResult;
+    expect(out.warnings).toHaveLength(1);
+  });
+});
+
+describe("prometheus.yml detection and parsing", () => {
+  test("a prometheus.yml is a template of this lexicon; a bare global block or a collector config is not", () => {
+    expect(detectTemplate(load(TERRAGUCCI_YAML))).toBe(true);
+    expect(detectTemplate({ global: { scrape_interval: "5s" } })).toBe(true);
+    expect(detectTemplate({ global: { resolve_timeout: "5m" } })).toBe(false);
+    expect(detectTemplate({ receivers: { otlp: {} }, exporters: {} })).toBe(false);
+    expect(detectTemplate({ apiVersion: "v1", kind: "ConfigMap", global: { scrape_interval: "5s" } })).toBe(false);
+  });
+
+  test("the parser names what it does not carry", () => {
+    const ir = new PrometheusParser().parse(`scrape_configs:
+  - job_name: a
+    docker_sd_configs: [{ host: "unix:///x.sock" }]
+  - static_configs: [{ targets: ["x:1"] }]
+bogus: 1
+`);
+    expect(ir.resources[0].type).toBe("Prometheus::Config");
+    expect(ir.warnings).toHaveLength(3);
+    expect(ir.warnings?.join("\n")).toContain("docker_sd_configs");
+    expect(ir.warnings?.join("\n")).toContain("has no job_name");
+    expect(ir.warnings?.join("\n")).toContain('"bogus"');
+  });
+});
+
+describe("promtool check config", () => {
+  test.skipIf(!PROMTOOL)("accepts the config terragucci emits", () => {
+    const r = promtoolCheckConfig(prometheusConfigYaml(Object.values(terragucci()) as unknown as Declarable[]));
+    expect(r.ok, r.output).toBe(true);
+  });
+
+  test.skipIf(!PROMTOOL)("accepts a config using the typed sections", () => {
+    const yaml = prometheusConfigYaml([
+      new PrometheusConfig({
+        global: { scrape_interval: "15s", scrape_timeout: "10s", evaluation_interval: "30s", external_labels: { cluster: "dev" } },
+        alerting: { alertmanagers: [{ scheme: "http", api_version: "v2", static_configs: [{ targets: ["alertmanager:9093"] }] }] },
+        rule_files: ["rules.yml"],
+        remote_write: [
+          {
+            url: "http://mimir:9009/api/v1/push",
+            queue_config: { capacity: 10000 },
+            write_relabel_configs: [{ source_labels: ["__name__"], regex: "debug_.*", action: "drop" }],
+          },
+        ],
+        otlp: { promote_resource_attributes: ["service.name"] },
+      }),
+      new ScrapeConfig({
+        job_name: "app",
+        scrape_interval: "5s",
+        params: { format: ["prometheus"] },
+        static_configs: [{ targets: ["app:8080"], labels: { tier: "web" } }],
+        metric_relabel_configs: [{ source_labels: ["__name__"], regex: "go_.*", action: "drop" }],
+      }),
+      new ScrapeConfig({
+        job_name: "dns",
+        dns_sd_configs: [{ names: ["api.service.internal"], type: "A", port: 9100 }],
+        relabel_configs: [{ source_labels: ["__address__"], target_label: "host" }],
+      }),
+    ]);
+    const r = promtoolCheckConfig(yaml, { "rules.yml": "groups:\n  - name: g\n    rules:\n      - record: a:b\n        expr: sum(up)\n" });
+    expect(r.ok, r.output).toBe(true);
+  });
+
+  test.skipIf(!PROMTOOL)("rejects a config Prometheus rejects", () => {
+    const r = promtoolCheckConfig(prometheusConfigYaml([new ScrapeConfig({ job_name: "bad", scrape_interval: "1s", scrape_timeout: "5s" })]));
+    expect(r.ran).toBe(true);
+    expect(r.ok).toBe(false);
+  });
+});

package/src/prometheus-config.ts

@@ -0,0 +1,71 @@
+/**
+ * `PrometheusConfig` and `ScrapeConfig`: the entities that serialize to
+ * `prometheus.yml`.
+ *
+ * A `ScrapeConfig` is one scrape job. `PrometheusConfig` holds the rest of the
+ * file (`global`, `alerting`, `rule_files`, `remote_write`, `remote_read`,
+ * `otlp`) and is optional: a build that declares only `ScrapeConfig`s still
+ * writes a `prometheus.yml`. A project that declares neither writes none, so
+ * a project that builds only rule files sees no change.
+ */
+
+import { createResource } from "@intentius/chant/runtime";
+import type { Declarable } from "@intentius/chant/declarable";
+import type { PrometheusConfigSections, ScrapeJobConfig } from "./model";
+
+export const SCRAPE_CONFIG_TYPE = "Prometheus::Config::ScrapeConfig";
+export const PROMETHEUS_CONFIG_TYPE = "Prometheus::Config::PrometheusConfig";
+
+type Ctor<P, E> = new (props: P) => E;
+
+function entityClass<P, E>(entityType: string, className: string): Ctor<P, E> {
+  const Base = createResource(entityType, "prometheus", {}) as unknown as (this: object, props: Record<string, unknown>) => void;
+  const Cls = function (this: object, props: P) {
+    Base.call(this, (props ?? {}) as unknown as Record<string, unknown>);
+  };
+  Object.defineProperty(Cls, "name", { value: className });
+  return Cls as unknown as Ctor<P, E>;
+}
+
+// ── ScrapeConfig ────────────────────────────────────────────────────
+
+export type ScrapeConfigProps = ScrapeJobConfig;
+
+export interface ScrapeConfigEntity extends Declarable {
+  readonly props: ScrapeConfigProps;
+}
+
+/**
+ * One scrape job: where its targets come from (`static_configs` or a service
+ * discovery list), how to scrape them, and how to relabel what comes back.
+ */
+export const ScrapeConfig = entityClass<ScrapeConfigProps, ScrapeConfigEntity>(SCRAPE_CONFIG_TYPE, "ScrapeConfig");
+
+// ── PrometheusConfig ────────────────────────────────────────────────
+
+export interface PrometheusConfigProps extends PrometheusConfigSections {
+  /** Scrape jobs written inline, as plain objects. Merged with the declared `ScrapeConfig`s. */
+  scrape_configs?: Array<ScrapeConfigEntity | ScrapeConfigProps>;
+}
+
+export interface PrometheusConfigEntity extends Declarable {
+  readonly props: PrometheusConfigProps;
+}
+
+/** The sections of `prometheus.yml` other than the scrape jobs. Declare at most one. */
+export const PrometheusConfig = entityClass<PrometheusConfigProps, PrometheusConfigEntity>(PROMETHEUS_CONFIG_TYPE, "PrometheusConfig");
+
+// ── Guards ──────────────────────────────────────────────────────────
+
+function isType<T>(type: string) {
+  return (value: unknown): value is T =>
+    typeof value === "object" && value !== null && (value as Declarable).entityType === type;
+}
+
+export const isScrapeConfig = isType<ScrapeConfigEntity>(SCRAPE_CONFIG_TYPE);
+export const isPrometheusConfig = isType<PrometheusConfigEntity>(PROMETHEUS_CONFIG_TYPE);
+
+/** True for an entity that goes into `prometheus.yml`. */
+export function isPrometheusConfigEntity(value: unknown): boolean {
+  return isScrapeConfig(value) || isPrometheusConfig(value);
+}

package/src/serializer.ts

@@ -1,30 +1,35 @@
 /**
  * Prometheus serializer.
  *
- * Emits the two files a Prometheus setup reads:
+ * Emits the files a Prometheus setup reads:
  *
  * - the rule file (`groups:`), from every `RuleGroup` in the build, the file
  *   `rule_files:` points at and `promtool check rules` reads;
+ * - `prometheus.yml`, from the `PrometheusConfig` and `ScrapeConfig`
+ *   entities, the file `promtool check config` reads;
  * - `alertmanager.yml`, from the `Route`, `Receiver`, `InhibitRule`,
  *   `TimeInterval` and `AlertmanagerSettings` entities, the file
  *   `amtool check-config` reads.
  *
- * The rule file is the primary output when the build declares any rule
- * groups, and `alertmanager.yml` is written beside it when the build also
- * declares Alertmanager entities. A build with only Alertmanager entities
- * emits `alertmanager.yml` as the primary output. Rules inside a group and
- * child routes keep the order they are written in, which is the order that
- * matters to Prometheus and Alertmanager; groups, receivers and time
- * intervals, whose order means nothing, are sorted by name.
+ * The first of those a build produces, in that order, is the primary output
+ * and the others are written beside it: the rule file, then `prometheus.yml`
+ * (`PROMETHEUS_FILE`), then `alertmanager.yml`. A project that declares only
+ * rule groups, or only Alertmanager entities, sees no change. Rules inside a
+ * group and child routes keep the order they are written in, which is the
+ * order that matters to Prometheus and Alertmanager; groups, scrape jobs,
+ * receivers and time intervals, whose order means nothing, are sorted by name.
  *
- * Neither file has a metadata channel, so there is no ownership marker to
- * stamp.
+ * None of these files has a metadata channel, so there is no ownership marker
+ * to stamp.
  */
 
 import type { Declarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult } from "@intentius/chant/serializer";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
-import { buildAlertmanagerConfig, buildRuleFile, emitYaml } from "./build";
+import { buildAlertmanagerConfig, buildPrometheusConfig, buildRuleFile, emitYaml } from "./build";
+
+/** The filename `prometheus.yml` is written under when it sits beside a rule file or `alertmanager.yml`. */
+export const PROMETHEUS_FILE = "prometheus.yml";
 
 /** The filename `alertmanager.yml` is written under when it sits beside a rule file. */
 export const ALERTMANAGER_FILE = "alertmanager.yml";
@@ -35,20 +40,25 @@ export const prometheusSerializer: Serializer = {
 
   serialize(entities: Map<string, Declarable>, _outputs?: LexiconOutput[]): string | SerializerResult {
     const rules = buildRuleFile(entities);
+    const prom = buildPrometheusConfig(entities);
     const am = buildAlertmanagerConfig(entities);
-    const hasRules = rules.groups.length > 0;
-    const hasAm = am.count > 0;
-    const warnings = am.warnings;
+    const warnings = [...prom.warnings, ...am.warnings];
+
+    // The files this build writes, in the order of the primary: the rule file,
+    // then prometheus.yml, then alertmanager.yml.
+    const out: Array<[string, string]> = [];
+    if (rules.groups.length > 0) out.push(["rules", emitYaml(rules.config)]);
+    if (prom.count > 0) out.push([PROMETHEUS_FILE, emitYaml(prom.config)]);
+    if (am.count > 0) out.push([ALERTMANAGER_FILE, emitYaml(am.config)]);
 
-    if (!hasRules && !hasAm) return "";
-    if (!hasAm) return emitYaml(rules.config);
-    if (!hasRules) {
-      const text = emitYaml(am.config);
-      return warnings.length === 0 ? text : { primary: text, warnings };
+    if (out.length === 0) return "";
+    if (out.length === 1) {
+      return warnings.length === 0 ? out[0][1] : { primary: out[0][1], warnings };
     }
+    const [[, primary], ...rest] = out;
     return {
-      primary: emitYaml(rules.config),
-      files: { [ALERTMANAGER_FILE]: emitYaml(am.config) },
+      primary,
+      files: Object.fromEntries(rest),
       ...(warnings.length > 0 ? { warnings } : {}),
     };
   },

package/src/tools.ts

@@ -1,5 +1,5 @@
 /**
- * `promtool check rules` and `amtool check-config`, when they are installed.
+ * `promtool check rules`, `promtool check config` and `amtool check-config`, when they are installed.
  *
  * The lexicon's own checks cover structure, references and PromQL syntax.
  * The upstream tools add what only Prometheus and Alertmanager know (PromQL
@@ -10,9 +10,9 @@
  */
 
 import { spawnSync } from "child_process";
-import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
-import { join } from "path";
+import { dirname, join } from "path";
 
 export interface ToolResult {
   /** False when the binary isn't installed; `ok` and `output` are then meaningless. */
@@ -46,6 +46,34 @@ export function promtoolCheckRules(yaml: string, bin = process.env.PROMTOOL ?? "
   return runOnText(bin, (f) => ["check", "rules", f], "rules.yml", yaml);
 }
 
+/**
+ * Run `promtool check config` over `prometheus.yml` text. The config is written
+ * as `prometheus.yml` in a directory of its own, and `files` (path relative to
+ * that directory to contents) are written beside it: `check config` also reads
+ * the rule files, certificates and credentials files the config names, so a
+ * config that names any needs them here. `bin` defaults to `promtool` on PATH.
+ */
+export function promtoolCheckConfig(
+  yaml: string,
+  files: Record<string, string> = {},
+  bin = process.env.PROMTOOL ?? "promtool",
+): ToolResult {
+  if (!hasTool(bin)) return { ran: false, ok: false, output: "" };
+  const dir = mkdtempSync(join(tmpdir(), "chant-prometheus-"));
+  try {
+    writeFileSync(join(dir, "prometheus.yml"), yaml);
+    for (const [path, content] of Object.entries(files)) {
+      const target = join(dir, path);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, content);
+    }
+    const r = spawnSync(bin, ["check", "config", "prometheus.yml"], { cwd: dir, encoding: "utf-8" });
+    return { ran: true, ok: r.status === 0, output: `${r.stdout ?? ""}${r.stderr ?? ""}` };
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
 /**
  * Run `promtool test rules` over rule file YAML and a unit-test file for it.
  * The test file's `rule_files:` should name `rules.yml`, which is where the

package/src/validate-config.ts

@@ -66,7 +66,8 @@ export type PrometheusIssueCode =
   | "PROM221"
   | "PROM222"
   | "PROM223"
-  | "PROM224";
+  | "PROM224"
+  | "PROM225";
 
 export interface PrometheusIssue {
   code: PrometheusIssueCode;

package/src/validate-relabel.ts

@@ -0,0 +1,53 @@
+/**
+ * PROM225: a `labeldrop` or `labelkeep` relabel step carries a field the
+ * action does not take.
+ *
+ * Both actions match `regex` against label names, so `source_labels`,
+ * `separator`, `target_label`, `modulus` and `replacement` have nothing to
+ * act on. Prometheus rejects the file when it loads it (the importer's
+ * fixture was fixed for the same reason, #3537).
+ */
+
+import type { PrometheusConfigFile } from "./config-model";
+import type { PrometheusIssue } from "./validate-config";
+
+const RELABEL_KEYS = new Set(["relabel_configs", "metric_relabel_configs", "alert_relabel_configs", "write_relabel_configs"]);
+const FOREIGN_FIELDS = ["source_labels", "separator", "target_label", "modulus", "replacement"] as const;
+
+/** Every relabel step in a `prometheus.yml`, with where it sits, e.g. `scrape_configs[0].relabel_configs[1]`. */
+function relabelSteps(node: unknown, path: string, out: Array<{ path: string; step: Record<string, unknown> }>): void {
+  if (Array.isArray(node)) {
+    node.forEach((v, i) => relabelSteps(v, `${path}[${i}]`, out));
+    return;
+  }
+  if (typeof node !== "object" || node === null) return;
+  for (const [key, value] of Object.entries(node)) {
+    const here = path ? `${path}.${key}` : key;
+    if (RELABEL_KEYS.has(key) && Array.isArray(value)) {
+      value.forEach((step, i) => {
+        if (typeof step === "object" && step !== null && !Array.isArray(step)) out.push({ path: `${here}[${i}]`, step: step as Record<string, unknown> });
+      });
+    } else {
+      relabelSteps(value, here, out);
+    }
+  }
+}
+
+/** PROM225 over one `prometheus.yml`. */
+export function validateRelabelFields(config: PrometheusConfigFile): PrometheusIssue[] {
+  const steps: Array<{ path: string; step: Record<string, unknown> }> = [];
+  relabelSteps(config, "", steps);
+  const issues: PrometheusIssue[] = [];
+  for (const { path, step } of steps) {
+    if (step.action !== "labeldrop" && step.action !== "labelkeep") continue;
+    const extra = FOREIGN_FIELDS.filter((f) => step[f] !== undefined);
+    if (extra.length === 0) continue;
+    issues.push({
+      code: "PROM225",
+      severity: "error",
+      subject: path,
+      message: `${path}: a ${String(step.action)} step matches regex against label names and takes no ${extra.join(", ")}; Prometheus rejects the file, so remove ${extra.length === 1 ? "it" : "them"}`,
+    });
+  }
+  return issues;
+}

package/src/validate.ts

@@ -14,7 +14,7 @@ import { validateAlertmanagerConfig, validateRuleFile } from "./validate-config"
 export type { ValidateCheck, ValidateResult } from "@intentius/chant/codegen/validate";
 
 /** Every entity class the package must keep exporting. */
-export const REQUIRED_NAMES = ["RuleGroup", "Route", "Receiver", "InhibitRule", "TimeInterval", "AlertmanagerSettings"];
+export const REQUIRED_NAMES = ["RuleGroup", "ScrapeConfig", "PrometheusConfig", "Route", "Receiver", "InhibitRule", "TimeInterval", "AlertmanagerSettings"];
 
 export async function validate(): Promise<ValidateResult> {
   const checks: ValidateCheck[] = [];