@intentius/chant 0.5.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/catalog.test.ts

@@ -4,7 +4,7 @@ import { loadPlugins } from "../cli/plugins";
 
 /** All post-synth check ids the audit can actually surface, from the lexicons. */
 async function realCheckIds(): Promise<Set<string>> {
-  const plugins = await loadPlugins(["github", "gitlab", "forgejo"]);
+  const plugins = await loadPlugins(["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm"]);
   const ids = new Set<string>();
   for (const plugin of plugins) {
     for (const check of plugin.postSynthChecks?.() ?? []) {

package/src/audit/catalog.ts

@@ -74,6 +74,30 @@ const GH_OIDC: Authority = {
   name: "GitHub — Security hardening with OpenID Connect",
   url: "https://docs.github.com/en/actions/concepts/security/openid-connect",
 };
+const K8S_PSS: Authority = {
+  name: "Kubernetes — Pod Security Standards",
+  url: "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
+};
+const K8S_SECRETS: Authority = {
+  name: "Kubernetes — Good practices for Secrets",
+  url: "https://kubernetes.io/docs/concepts/security/secrets-good-practices/",
+};
+const DOCKER_SEC: Authority = {
+  name: "Docker — Security best practices",
+  url: "https://docs.docker.com/develop/security-best-practices/",
+};
+const AWS_SEC: Authority = {
+  name: "AWS — Security Pillar (Well-Architected)",
+  url: "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html",
+};
+const AZ_SEC: Authority = {
+  name: "Microsoft Cloud Security Benchmark",
+  url: "https://learn.microsoft.com/en-us/security/benchmark/azure/",
+};
+const GCP_SEC: Authority = {
+  name: "Google Cloud — Security best practices",
+  url: "https://cloud.google.com/security/best-practices",
+};
 
 function meta(
   id: string,
@@ -184,6 +208,146 @@ export const RULE_CATALOG: Record<string, RuleMeta> = {
   // ── Forgejo (WFJ) ──────────────────────────────────────────────────
   WFJ010: meta("WFJ010", M, G, "Unresolved action reference on Forgejo", "Use an action reference Forgejo can resolve (full URL or a mirrored action)."),
   WFJ011: meta("WFJ011", M, G, "GitHub-hosted runner label with no Forgejo equivalent", "Use a runner label your Forgejo instance provides."),
+
+  // ── Kubernetes (WK8 / ARGO) ────────────────────────────────────────
+  ARGO002: meta("ARGO002", M, G, "Argo Application references an undeclared AppProject", "Declare the named AppProject or reference an existing project."),
+  ARGO003: meta("ARGO003", M, G, "Argo Application targets an unregistered cluster", "Point spec.destination at a registered cluster or the in-cluster target."),
+  ARGO005: meta("ARGO005", R, G, "Argo source.path may not resolve", "Ensure the source path exists under the build root."),
+  WK8005: meta("WK8005", M, G, "Hardcoded secret in env var", "Use a secretKeyRef instead of a literal value, and rotate the secret.", [K8S_SECRETS]),
+  WK8006: meta("WK8006", M, G, "Image uses :latest or no tag", "Pin the image to an explicit version tag (ideally a digest).", [SCORECARD_PINNED]),
+  WK8041: meta("WK8041", M, G, "Hardcoded API key in env var", "Move the key to a Secret and rotate it.", [K8S_SECRETS]),
+  WK8042: meta("WK8042", M, G, "Private key stored in a ConfigMap", "Store private keys in a Secret, not a ConfigMap.", [K8S_SECRETS]),
+  WK8101: meta("WK8101", M, G, "Deployment selector does not match template labels", "Align spec.selector with the pod template labels."),
+  WK8102: meta("WK8102", R, G, "Resource missing metadata labels", "Add metadata labels for filtering and tooling."),
+  WK8103: meta("WK8103", M, G, "Container missing name", "Add the required container `name`."),
+  WK8104: meta("WK8104", R, G, "Container ports not named", "Name ports for clearer Service/NetworkPolicy config."),
+  WK8105: meta("WK8105", R, G, "imagePullPolicy not explicit", "Set imagePullPolicy explicitly to avoid surprising defaults."),
+  WK8201: meta("WK8201", R, G, "Container missing resource limits", "Set CPU and memory limits."),
+  WK8202: meta("WK8202", M, G, "Privileged container", "Remove privileged: true; grant only the specific capabilities needed.", [K8S_PSS]),
+  WK8203: meta("WK8203", M, G, "Root filesystem is writable", "Set readOnlyRootFilesystem: true.", [K8S_PSS]),
+  WK8204: meta("WK8204", M, G, "Container may run as root", "Set runAsNonRoot: true (and a non-zero runAsUser).", [K8S_PSS]),
+  WK8205: meta("WK8205", M, G, "Capabilities not dropped", "drop: [ALL] and add back only what is required.", [K8S_PSS]),
+  WK8207: meta("WK8207", M, G, "Pod uses host network", "Remove hostNetwork; it bypasses network isolation.", [K8S_PSS]),
+  WK8208: meta("WK8208", M, G, "Pod shares host PID namespace", "Remove hostPID.", [K8S_PSS]),
+  WK8209: meta("WK8209", M, G, "Pod shares host IPC namespace", "Remove hostIPC.", [K8S_PSS]),
+  WK8301: meta("WK8301", R, G, "Container missing probes", "Add liveness and readiness probes."),
+  WK8302: meta("WK8302", R, G, "Deployment has a single replica", "Use replicas >= 2 for availability."),
+  WK8303: meta("WK8303", R, G, "No PodDisruptionBudget for an HA Deployment", "Add a PDB to protect availability during disruptions."),
+  WK8304: meta("WK8304", R, G, "SSL redirect without a certificate", "Provide a certificate and HTTPS listen-ports for the ssl-redirect annotation."),
+  WK8305: meta("WK8305", M, G, "Ingress backend port does not match the Service", "Point the Ingress backend at a declared Service port."),
+  WK8306: meta("WK8306", M, G, "Container command starts with a flag", "The first command element should be a binary, not a flag."),
+  WK8401: meta("WK8401", M, G, "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule."),
+  WK8402: meta("WK8402", R, G, "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image."),
+  WK8403: meta("WK8403", R, G, "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image."),
+
+  // ── Docker (DKRD) ──────────────────────────────────────────────────
+  DKRD001: meta("DKRD001", M, G, "Service uses :latest or untagged image", "Pin the image to an explicit version tag (ideally a digest).", [SCORECARD_PINNED]),
+  DKRD002: meta("DKRD002", R, G, "Named volume declared but unused", "Remove the unused volume or mount it in a service."),
+  DKRD003: meta("DKRD003", M, G, "Service exposes SSH (port 22)", "Don't expose SSH from a container; use exec/ephemeral access instead.", [DOCKER_SEC]),
+  DKRD010: meta("DKRD010", R, G, "apt-get install without --no-install-recommends", "Add --no-install-recommends to keep images small."),
+  DKRD011: meta("DKRD011", R, G, "ADD used where COPY would do", "Prefer COPY unless fetching a URL or extracting an archive."),
+  DKRD012: meta("DKRD012", M, G, "No USER instruction — container runs as root", "Add a non-root USER instruction.", [DOCKER_SEC]),
+
+  // ── AWS CloudFormation (WAW / COR / EXT) ───────────────────────────
+  COR020: meta("COR020", M, G, "Circular resource dependency", "Break the dependency cycle between resources."),
+  EXT001: meta("EXT001", M, G, "Extension constraint violation", "Fix the cross-property constraint flagged by the cfn-lint extension schema."),
+  WAW010: meta("WAW010", R, G, "Redundant DependsOn", "Remove DependsOn already implied by a Ref/GetAtt."),
+  WAW011: meta("WAW011", R, G, "Deprecated Lambda runtime", "Upgrade to a supported Lambda runtime."),
+  WAW013: meta("WAW013", M, G, "Child stack exports nothing", "Add stackOutput() exports the parent can reference."),
+  WAW014: meta("WAW014", R, G, "Nested stack outputs never referenced", "Reference the outputs or split into a separate build."),
+  WAW015: meta("WAW015", M, G, "Circular dependency between nested stacks", "Break the cycle between nested stacks."),
+  WAW016: meta("WAW016", R, G, "Deprecated property", "Replace the deprecated CloudFormation property."),
+  WAW017: meta("WAW017", R, G, "Missing tags on a taggable resource", "Add tags for cost allocation and compliance."),
+  WAW018: meta("WAW018", M, G, "S3 bucket missing public access block", "Add a PublicAccessBlockConfiguration blocking all public access.", [AWS_SEC]),
+  WAW019: meta("WAW019", M, G, "Security group allows unrestricted ingress on a sensitive port", "Restrict the CIDR on SSH/RDP/database ports to known sources.", [AWS_SEC]),
+  WAW020: meta("WAW020", M, G, "IAM policy uses a wildcard Action", "Scope the policy to specific actions (least privilege).", [AWS_SEC]),
+  WAW021: meta("WAW021", M, G, "RDS storage not encrypted", "Enable StorageEncrypted for encryption at rest.", [AWS_SEC]),
+  WAW022: meta("WAW022", R, G, "Lambda has no VpcConfig", "Consider a VpcConfig for network isolation if the function needs VPC resources."),
+  WAW023: meta("WAW023", R, G, "CloudFront has no WAF web ACL", "Consider attaching a WAF web ACL."),
+  WAW024: meta("WAW024", R, G, "ALB access logging disabled", "Enable access logging for audit trails."),
+  WAW025: meta("WAW025", M, G, "SNS topic not encrypted", "Set KmsMasterKeyId for encryption at rest.", [AWS_SEC]),
+  WAW026: meta("WAW026", M, G, "SQS queue not encrypted", "Enable SqsManagedSseEnabled or set KmsMasterKeyId.", [AWS_SEC]),
+  WAW027: meta("WAW027", R, G, "DynamoDB point-in-time recovery disabled", "Enable PITR for recovery."),
+  WAW028: meta("WAW028", M, G, "EBS volume not encrypted", "Enable encryption at rest.", [AWS_SEC]),
+  WAW029: meta("WAW029", M, G, "Invalid DependsOn target", "Fix the dangling/self DependsOn reference."),
+  WAW030: meta("WAW030", R, G, "Missing DependsOn for a known ordering pattern", "Add the DependsOn the pattern requires."),
+  WAW031: meta("WAW031", R, G, "EKS Addon missing ServiceAccountRoleArn", "Set ServiceAccountRoleArn (IRSA) for addons that need it."),
+  WAW032: meta("WAW032", M, G, "EFS transit encryption disabled on Fargate", "Enable transit encryption for the EFS volume.", [AWS_SEC]),
+  WAW033: meta("WAW033", M, G, "Solr heap exceeds Fargate task memory", "Lower SOLR_HEAP or raise task memory."),
+  WAW034: meta("WAW034", R, G, "Fargate Solr task under-provisioned", "Allocate >= 2048MB for the Solr task."),
+  WAW035: meta("WAW035", R, G, "Solr container missing nofile ulimit", "Set a nofile ulimit >= 65535."),
+  WAW036: meta("WAW036", M, G, "Non-ASCII characters in resource properties", "Remove non-ASCII characters rejected at changeset time."),
+  WAW037: meta("WAW037", M, G, "Null values in resource properties", "Fix the invalid AttrRef producing null property values."),
+
+  // ── Azure ARM (AZR) ────────────────────────────────────────────────
+  AZR010: meta("AZR010", R, G, "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId()."),
+  AZR011: meta("AZR011", M, G, "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource."),
+  AZR012: meta("AZR012", R, G, "Deprecated API version", "Move to a current apiVersion."),
+  AZR013: meta("AZR013", M, G, "Resource missing location", "Add the required location property."),
+  AZR014: meta("AZR014", M, G, "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", [AZ_SEC]),
+  AZR015: meta("AZR015", M, G, "Storage account missing encryption", "Enable encryption services for data at rest.", [AZ_SEC]),
+  AZR016: meta("AZR016", R, G, "Key Vault soft-delete not enabled", "Enable soft-delete."),
+  AZR017: meta("AZR017", R, G, "Key Vault purge protection not enabled", "Enable purge protection."),
+  AZR018: meta("AZR018", R, G, "SQL Server missing auditing", "Enable auditing for compliance and threat detection."),
+  AZR019: meta("AZR019", M, G, "SQL database missing TDE", "Enable Transparent Data Encryption.", [AZ_SEC]),
+  AZR020: meta("AZR020", R, G, "App Service missing managed identity", "Enable a system- or user-assigned identity."),
+  AZR021: meta("AZR021", M, G, "App Service not HTTPS-only", "Set httpsOnly to true.", [AZ_SEC]),
+  AZR022: meta("AZR022", M, G, "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", [AZ_SEC]),
+  AZR023: meta("AZR023", R, G, "VM not using a managed disk", "Use a managed disk."),
+  AZR024: meta("AZR024", R, G, "VM missing boot diagnostics", "Enable boot diagnostics."),
+  AZR025: meta("AZR025", R, G, "AKS cluster missing RBAC", "Enable Kubernetes RBAC."),
+  AZR026: meta("AZR026", R, G, "AKS cluster missing network policy", "Configure a networkPolicy."),
+  AZR027: meta("AZR027", M, G, "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", [AZ_SEC]),
+  AZR028: meta("AZR028", R, G, "Network interface missing NSG", "Associate an NSG to control traffic."),
+  AZR029: meta("AZR029", M, G, "Managed disk missing encryption", "Enable encryption for data at rest.", [AZ_SEC]),
+
+  // ── GCP Config Connector (WGC) ─────────────────────────────────────
+  WGC101: meta("WGC101", M, G, "Storage/SQL without encryption configuration", "Configure encryption (e.g. a CMEK key) for data at rest.", [GCP_SEC]),
+  WGC102: meta("WGC102", M, G, "Public IAM member (allUsers/allAuthenticatedUsers)", "Remove allUsers/allAuthenticatedUsers bindings.", [GCP_SEC]),
+  WGC103: meta("WGC103", R, G, "Missing project-id annotation", "Add the cnrm.cloud.google.com/project-id annotation."),
+  WGC104: meta("WGC104", M, G, "Bucket without uniform bucket-level access", "Enable uniformBucketLevelAccess.", [GCP_SEC]),
+  WGC105: meta("WGC105", M, G, "Cloud SQL open to 0.0.0.0/0", "Restrict authorizedNetworks to known sources.", [GCP_SEC]),
+  WGC106: meta("WGC106", R, G, "Missing deletion-policy annotation", "Add the cnrm.cloud.google.com/deletion-policy annotation."),
+  WGC107: meta("WGC107", R, G, "Bucket versioning disabled", "Enable object versioning."),
+  WGC108: meta("WGC108", R, G, "Cloud SQL backups disabled", "Enable backup configuration."),
+  WGC109: meta("WGC109", M, G, "Firewall open to 0.0.0.0/0", "Restrict sourceRanges to known sources.", [GCP_SEC]),
+  WGC110: meta("WGC110", M, G, "KMS key without rotation", "Set a rotationPeriod on the CryptoKey.", [GCP_SEC]),
+  WGC111: meta("WGC111", M, G, "Reference to an undefined resource", "Point the reference at a resource in the output."),
+  WGC112: meta("WGC112", M, G, "Missing or invalid apiVersion", "Set a valid cnrm.cloud.google.com apiVersion."),
+  WGC113: meta("WGC113", R, G, "Alpha API version", "Move to a beta/GA API version."),
+  WGC201: meta("WGC201", R, G, "Missing managed-by label", "Add the app.kubernetes.io/managed-by label."),
+  WGC202: meta("WGC202", M, G, "Cluster without Workload Identity", "Enable Workload Identity on the ContainerCluster.", [GCP_SEC]),
+  WGC203: meta("WGC203", M, G, "Node pool uses broad cloud-platform scope", "Use narrowly-scoped OAuth scopes instead of cloud-platform.", [GCP_SEC]),
+  WGC204: meta("WGC204", R, G, "Compute instance without Shielded VM", "Enable Shielded VM configuration."),
+  WGC301: meta("WGC301", R, G, "No IAMAuditConfig found", "Configure audit logging via IAMAuditConfig."),
+  WGC302: meta("WGC302", R, G, "No Service (enabled APIs) found", "Declare the GCP APIs you depend on."),
+  WGC303: meta("WGC303", R, G, "No VPC Service Controls perimeter", "Consider an AccessContextManager ServicePerimeter."),
+  WGC401: meta("WGC401", M, G, "Unknown field in resource spec", "Remove the unknown spec field."),
+  WGC402: meta("WGC402", M, G, "Missing required spec field", "Add the required spec field."),
+  WGC403: meta("WGC403", M, G, "Spec field has wrong type/structure", "Fix the field's type/structure."),
+
+  // ── Helm (WHM) ─────────────────────────────────────────────────────
+  WHM005: meta("WHM005", R, G, "Sub-chart wrapper with no templates", "Deploy the upstream chart directly instead of an empty wrapper."),
+  WHM101: meta("WHM101", M, G, "Chart.yaml missing required fields", "Set apiVersion (v2), name, and version in Chart.yaml."),
+  WHM102: meta("WHM102", R, G, "Missing values.schema.json", "Add a values.schema.json to validate values."),
+  WHM103: meta("WHM103", M, G, "Invalid Go template syntax", "Fix the unbalanced template braces."),
+  WHM104: meta("WHM104", R, G, "Missing NOTES.txt", "Add templates/NOTES.txt for application charts."),
+  WHM105: meta("WHM105", R, G, "Missing _helpers.tpl", "Add templates/_helpers.tpl."),
+  WHM201: meta("WHM201", R, G, "Missing standard Helm labels", "Add the recommended app.kubernetes.io labels."),
+  WHM202: meta("WHM202", R, G, "Hook weights undefined", "Define hook weights when multiple hooks exist."),
+  WHM203: meta("WHM203", R, G, "Undocumented values", "Document values via schema or comments."),
+  WHM204: meta("WHM204", R, G, "Dependencies pinned, not ranged", "Use semver ranges for chart dependencies."),
+  WHM301: meta("WHM301", R, G, "No Helm test", "Add at least one Helm test for application charts."),
+  WHM302: meta("WHM302", R, G, "Container resources not set", "Set limits/requests via values or defaults."),
+  WHM401: meta("WHM401", M, G, "Container image uses :latest or no tag", "Pin the image to an explicit version tag.", [SCORECARD_PINNED]),
+  WHM402: meta("WHM402", M, G, "Container may run as root", "Set runAsNonRoot in the security context.", [K8S_PSS]),
+  WHM403: meta("WHM403", M, G, "Root filesystem writable", "Set readOnlyRootFilesystem.", [K8S_PSS]),
+  WHM404: meta("WHM404", M, G, "Privileged container", "Remove privileged mode.", [K8S_PSS]),
+  WHM405: meta("WHM405", R, G, "Resource specs missing cpu/memory", "Set cpu and memory in limits/requests."),
+  WHM406: meta("WHM406", R, G, "CRDs in crds/ are never upgraded", "Manage CRD upgrades outside Helm or via a separate chart."),
+  WHM407: meta("WHM407", M, G, "Inline Secret data", "Use ExternalSecret/SealedSecret instead of inline Secret data.", [K8S_SECRETS]),
+  WHM501: meta("WHM501", R, G, "Unused values key", "Remove values defined but never referenced."),
+  WHM502: meta("WHM502", M, G, "Deprecated/invalid Kubernetes API version", "Update to a supported apiVersion."),
 };
 
 /** Look up catalog metadata for a check id, if known. */

package/src/audit/core.test.ts

@@ -1,7 +1,27 @@
 import { describe, test, expect } from "vitest";
-import { auditFiles, type AuditInput } from "./core";
+import { auditFiles, CROSS_FILE, type AuditInput } from "./core";
 import type { PostSynthCheck } from "../lint/post-synth";
 
+const ARGO_APP = `apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: myapp
+spec:
+  project: team-a
+  source:
+    repoURL: https://example.com/repo
+    path: .
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+`;
+const ARGO_PROJECT = `apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: team-a
+`;
+const WF = (name: string) => `name: ${name}\non:\n  push:\njobs:\n  build:\n    runs-on: ubuntu-latest\n`;
+
 const DIRTY_GH = `name: CI
 on:
   push:
@@ -108,6 +128,32 @@ describe("auditFiles", () => {
     expect(findings.map((f) => f.file).sort()).toEqual(["a.yml", "b.yml"]);
   });
 
+  test("resolves a cross-file relationship (ARGO002 sees the AppProject in another file)", async () => {
+    // The Application alone → ARGO002 fires (project not declared here).
+    const alone = await auditFiles([{ path: "app.yaml", content: ARGO_APP, lexicon: "k8s" }]);
+    expect(alone.some((f) => f.checkId === "ARGO002")).toBe(true);
+
+    // With the AppProject in a separate file → ARGO002 must NOT fire.
+    const together = await auditFiles([
+      { path: "app.yaml", content: ARGO_APP, lexicon: "k8s" },
+      { path: "project.yaml", content: ARGO_PROJECT, lexicon: "k8s" },
+    ]);
+    expect(together.some((f) => f.checkId === "ARGO002")).toBe(false);
+  });
+
+  test("surfaces a genuine cross-file finding (GHA006 duplicate workflow name)", async () => {
+    const findings = await auditFiles([
+      { path: ".github/workflows/a.yml", content: WF("CI"), lexicon: "github" },
+      { path: ".github/workflows/b.yml", content: WF("CI"), lexicon: "github" },
+    ]);
+    const dup = findings.find((f) => f.checkId === "GHA006");
+    expect(dup).toBeDefined();
+    expect(dup!.file).toBe(CROSS_FILE);
+    // A single workflow → no duplicate finding.
+    const single = await auditFiles([{ path: "a.yml", content: WF("CI"), lexicon: "github" }]);
+    expect(single.some((f) => f.checkId === "GHA006")).toBe(false);
+  });
+
   test("a check that throws does not abort the audit", async () => {
     const boom: PostSynthCheck = {
       id: "BOOM",

package/src/audit/rules-doc.ts

@@ -9,10 +9,16 @@
 
 import { RULE_CATALOG, type RuleMeta } from "./catalog";
 
-const GROUPS: Array<{ heading: string; prefix: string; blurb: string }> = [
-  { heading: "GitHub Actions (GHA)", prefix: "GHA", blurb: "Also applied to Forgejo workflows, which are GitHub-dialect." },
-  { heading: "GitLab CI (WGL)", prefix: "WGL", blurb: "" },
-  { heading: "Forgejo (WFJ)", prefix: "WFJ", blurb: "" },
+const GROUPS: Array<{ heading: string; prefixes: string[]; blurb: string }> = [
+  { heading: "GitHub Actions (GHA)", prefixes: ["GHA"], blurb: "Also applied to Forgejo workflows, which are GitHub-dialect." },
+  { heading: "GitLab CI (WGL)", prefixes: ["WGL"], blurb: "" },
+  { heading: "Forgejo (WFJ)", prefixes: ["WFJ"], blurb: "" },
+  { heading: "Kubernetes (WK8 / ARGO)", prefixes: ["WK8", "ARGO"], blurb: "Run against Kubernetes manifests." },
+  { heading: "Docker (DKRD)", prefixes: ["DKRD"], blurb: "Run against Dockerfiles and Compose files." },
+  { heading: "AWS CloudFormation (WAW / COR / EXT)", prefixes: ["WAW", "COR", "EXT"], blurb: "Run against CloudFormation templates (JSON or YAML)." },
+  { heading: "Azure ARM (AZR)", prefixes: ["AZR"], blurb: "Run against ARM deployment templates (JSON)." },
+  { heading: "GCP Config Connector (WGC)", prefixes: ["WGC"], blurb: "Run against Config Connector (cnrm.cloud.google.com) manifests." },
+  { heading: "Helm (WHM)", prefixes: ["WHM"], blurb: "Run against Helm charts (Chart.yaml + templates)." },
 ];
 
 function ruleBlock(m: RuleMeta): string {
@@ -26,8 +32,8 @@ function ruleBlock(m: RuleMeta): string {
 /** Render the full audit rules reference page (frontmatter + body). */
 export function renderRulesReference(): string {
   const ids = Object.keys(RULE_CATALOG).sort();
-  const sections = GROUPS.map(({ heading, prefix, blurb }) => {
-    const blocks = ids.filter((id) => id.startsWith(prefix)).map((id) => ruleBlock(RULE_CATALOG[id]));
+  const sections = GROUPS.map(({ heading, prefixes, blurb }) => {
+    const blocks = ids.filter((id) => prefixes.some((p) => id.startsWith(p))).map((id) => ruleBlock(RULE_CATALOG[id]));
     if (blocks.length === 0) return "";
     return `## ${heading}\n${blurb ? `\n${blurb}\n` : ""}\n${blocks.join("\n\n")}`;
   }).filter(Boolean);

package/src/cli/commands/__fixtures__/audit-aws/stack.yaml

@@ -0,0 +1,11 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Resources:
+  Sg:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: web
+      SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 22
+          ToPort: 22
+          CidrIp: 0.0.0.0/0

package/src/cli/commands/__fixtures__/audit-aws/template.json

@@ -0,0 +1,7 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Resources": {
+    "Data": { "Type": "AWS::S3::Bucket", "Properties": {} },
+    "Db": { "Type": "AWS::RDS::DBInstance", "Properties": { "Engine": "postgres" } }
+  }
+}

package/src/cli/commands/__fixtures__/audit-azure/azuredeploy.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "type": "Microsoft.Storage/storageAccounts",
+      "apiVersion": "2022-09-01",
+      "name": "data",
+      "location": "eastus",
+      "properties": { "allowBlobPublicAccess": true }
+    }
+  ]
+}

package/src/cli/commands/__fixtures__/audit-docker/app/Dockerfile

@@ -0,0 +1,4 @@
+FROM node:20
+RUN apt-get update && apt-get install -y curl
+COPY . /app
+CMD ["node", "server.js"]

package/src/cli/commands/__fixtures__/audit-docker/docker-compose.yml

@@ -0,0 +1,5 @@
+services:
+  web:
+    image: myapp:latest
+    ports:
+      - "22:22"

package/src/cli/commands/__fixtures__/audit-gcp/bucket.yaml

@@ -0,0 +1,6 @@
+apiVersion: storage.cnrm.cloud.google.com/v1beta1
+kind: StorageBucket
+metadata:
+  name: data
+spec:
+  location: US

package/src/cli/commands/__fixtures__/audit-gcp/firewall.yaml

@@ -0,0 +1,9 @@
+apiVersion: compute.cnrm.cloud.google.com/v1beta1
+kind: ComputeFirewall
+metadata:
+  name: allow-all
+spec:
+  sourceRanges:
+    - 0.0.0.0/0
+  allow:
+    - protocol: tcp

package/src/cli/commands/__fixtures__/audit-helm/mychart/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: mychart
+version: 0.1.0

package/src/cli/commands/__fixtures__/audit-helm/mychart/templates/deployment.yaml

@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx:latest
+          securityContext:
+            privileged: true

package/src/cli/commands/__fixtures__/audit-helm/mychart/values.yaml

@@ -0,0 +1 @@
+image: myapp:latest

package/src/cli/commands/__fixtures__/audit-k8s/manifests/deploy.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+spec:
+  selector:
+    matchLabels:
+      app: web
+  template:
+    metadata:
+      labels:
+        app: web
+    spec:
+      containers:
+        - name: web
+          image: nginx:latest
+          securityContext:
+            privileged: true

package/src/cli/commands/audit.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { fileURLToPath } from "url";
-import { auditCommand, discoverCiFiles, tokenForHost, coverageNotes } from "./audit";
+import { auditCommand, discoverCiFiles, discoverManifests, discoverDocker, discoverCloudFormation, discoverArm, discoverGcp, discoverHelm, tokenForHost, coverageNotes } from "./audit";
 import { MissingLexiconError, type AuditInput } from "../../audit/core";
 import { readFileSync, existsSync, rmSync } from "fs";
 import { tmpdir } from "os";
@@ -30,6 +30,92 @@ describe("auditCommand", () => {
     expect(coverageNotes(gh)).toEqual([]);
   });
 
+  test("discovers and audits Kubernetes manifests", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-k8s", import.meta.url));
+    const files = discoverManifests(repo);
+    expect(files.map((f) => f.path)).toContain("manifests/deploy.yaml");
+    expect(files.every((f) => f.lexicon === "k8s")).toBe(true);
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WK8202"); // privileged container
+    expect(ids).toContain("WK8006"); // :latest image
+  });
+
+  test("discovers and audits Docker artifacts (nested Dockerfile + compose)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-docker", import.meta.url));
+    const files = discoverDocker(repo);
+    const paths = files.map((f) => f.path).sort();
+    expect(paths).toContain("app/Dockerfile");
+    expect(paths).toContain("docker-compose.yml");
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("DKRD012"); // Dockerfile has no USER (nested — basename-key fix)
+    expect(ids).toContain("DKRD010"); // apt-get without --no-install-recommends
+    expect(ids).toContain("DKRD003"); // compose exposes SSH port 22
+  });
+
+  test("discovers and audits CloudFormation (JSON and YAML)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-aws", import.meta.url));
+    const files = discoverCloudFormation(repo);
+    const paths = files.map((f) => f.path).sort();
+    expect(paths).toContain("template.json");
+    expect(paths).toContain("stack.yaml");
+    // YAML is normalized to a JSON string the aws checks can JSON.parse.
+    expect(() => JSON.parse(files.find((f) => f.path === "stack.yaml")!.content)).not.toThrow();
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WAW018"); // S3 missing public access block (JSON template)
+    expect(ids).toContain("WAW021"); // RDS not encrypted (JSON template)
+    expect(ids).toContain("WAW019"); // SG open SSH (YAML template — proves YAML works)
+  });
+
+  test("discovers and audits Azure ARM templates", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-azure", import.meta.url));
+    expect(discoverArm(repo).map((f) => f.path)).toContain("azuredeploy.json");
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("AZR014"); // storage allows public blob access
+  });
+
+  test("discovers and audits GCP Config Connector (not misclassified as k8s)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-gcp", import.meta.url));
+    const gcp = discoverGcp(repo);
+    expect(gcp.map((f) => f.path).sort()).toEqual(["bucket.yaml", "firewall.yaml"]);
+    // cnrm manifests must NOT also be picked up as k8s.
+    expect(discoverManifests(repo)).toEqual([]);
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WGC109"); // firewall open to 0.0.0.0/0
+    // k8s checks did not run on these.
+    expect([...ids].some((id) => id.startsWith("WK8"))).toBe(false);
+  });
+
+  test("discovers and audits a Helm chart (as a bundle, not loose manifests)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-helm", import.meta.url));
+    const charts = discoverHelm(repo);
+    expect(charts).toHaveLength(1);
+    expect(charts[0].lexicon).toBe("helm");
+    expect(charts[0].files!["Chart.yaml"]).toContain("name: mychart");
+    expect(charts[0].files!["templates/deployment.yaml"]).toContain("privileged");
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WHM401"); // :latest image in the chart
+    expect(ids).toContain("WHM404"); // privileged container in a template
+    // the chart's template was NOT double-audited as a loose k8s manifest
+    expect([...ids].some((id) => id.startsWith("WK8"))).toBe(false);
+  });
+
   test("discovers CI files under a repo root", () => {
     const files = discoverCiFiles(REPO);
     expect(files.map((f) => f.path)).toContain(".github/workflows/ci.yml");
@@ -99,11 +185,14 @@ describe("auditCommand", () => {
   });
 
   test("a path with no CI files succeeds with a clear message", async () => {
-    const tmp = fileURLToPath(new URL(".", import.meta.url)); // commands dir, no CI files
+    const tmp = join(tmpdir(), `chant-audit-empty-${process.pid}`);
+    const { mkdirSync } = await import("fs");
+    mkdirSync(tmp, { recursive: true });
     const result = await auditCommand({ path: tmp });
     expect(result.success).toBe(true);
     expect(result.exitCode).toBe(0);
     expect(result.output).toContain("No CI files found");
+    rmSync(tmp, { recursive: true, force: true });
   });
 
   test("audits a remote repo URL via injected fetch", async () => {

package/src/cli/commands/audit.ts

@@ -6,7 +6,8 @@
  */
 
 import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
-import { join, relative } from "path";
+import { join, relative, basename } from "path";
+import { parseYAML } from "../../yaml";
 import { auditFiles, type AuditInput, type AuditFinding, type AuditLexicon, type ChecksProvider } from "../../audit/core";
 import { RULE_CATALOG } from "../../audit/catalog";
 import { renderMarkdown } from "../../audit/report";
@@ -115,6 +116,228 @@ export function discoverCiFiles(root: string): AuditInput[] {
   return inputs;
 }
 
+const WALK_SKIP = new Set(["node_modules", ".git", "dist", ".github", ".forgejo"]);
+const MAX_WALK_FILES = 1000;
+
+/** Recursively collect file paths under a root, skipping noise/dot dirs. */
+function walkFiles(dir: string, out: string[]): void {
+  if (out.length >= MAX_WALK_FILES) return;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+    if (out.length >= MAX_WALK_FILES) return;
+    if (e.name.startsWith(".") && e.isDirectory()) continue;
+    if (WALK_SKIP.has(e.name)) continue;
+    const full = join(dir, e.name);
+    if (e.isDirectory()) walkFiles(full, out);
+    else out.push(full);
+  }
+}
+
+function readSafe(full: string): string | undefined {
+  try {
+    return readFileSync(full, "utf-8");
+  } catch {
+    return undefined;
+  }
+}
+
+const CNRM = "cnrm.cloud.google.com";
+
+/** True if any YAML doc is a Kubernetes manifest (excluding GCP Config Connector). */
+function looksLikeK8s(content: string): boolean {
+  for (const doc of content.split(/\n---\n/)) {
+    const t = doc.trim();
+    if (!t) continue;
+    try {
+      const obj = parseYAML(t) as Record<string, unknown>;
+      const apiVersion = obj?.apiVersion;
+      if (typeof apiVersion === "string" && typeof obj.kind === "string" && !apiVersion.includes(CNRM)) return true;
+    } catch {
+      // not parseable as a single doc — skip
+    }
+  }
+  return false;
+}
+
+/** True if any YAML doc is a GCP Config Connector resource (cnrm.cloud.google.com). */
+function looksLikeGcp(content: string): boolean {
+  for (const doc of content.split(/\n---\n/)) {
+    const t = doc.trim();
+    if (!t) continue;
+    try {
+      const obj = parseYAML(t) as Record<string, unknown>;
+      if (typeof obj?.apiVersion === "string" && obj.apiVersion.includes(CNRM)) return true;
+    } catch {
+      // skip
+    }
+  }
+  return false;
+}
+
+/** Discover GCP Config Connector manifests under a repo root. */
+export function discoverGcp(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    if (!isYaml(basename(full))) continue;
+    const content = readSafe(full);
+    if (content !== undefined && looksLikeGcp(content)) {
+      inputs.push({ path: relative(root, full), content, lexicon: "gcp" });
+    }
+  }
+  return inputs;
+}
+
+/** Discover Kubernetes manifest files under a repo root (content-detected). */
+export function discoverManifests(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    if (!isYaml(basename(full))) continue;
+    const content = readSafe(full);
+    if (content !== undefined && looksLikeK8s(content)) {
+      inputs.push({ path: relative(root, full), content, lexicon: "k8s" });
+    }
+  }
+  return inputs;
+}
+
+function isDockerfileName(name: string): boolean {
+  return name === "Dockerfile" || name.startsWith("Dockerfile.") || name.endsWith(".Dockerfile") || name.endsWith(".dockerfile");
+}
+
+function looksLikeCompose(content: string): boolean {
+  try {
+    const obj = parseYAML(content) as Record<string, unknown>;
+    return Boolean(obj) && typeof obj === "object" && "services" in obj;
+  } catch {
+    return false;
+  }
+}
+
+/** Parse JSON or YAML content into an object, or undefined. */
+function parseStructured(content: string): Record<string, unknown> | undefined {
+  try {
+    const j = JSON.parse(content);
+    if (j && typeof j === "object") return j as Record<string, unknown>;
+  } catch {
+    // not JSON — try YAML
+  }
+  try {
+    const y = parseYAML(content) as Record<string, unknown>;
+    if (y && typeof y === "object") return y;
+  } catch {
+    // not YAML either
+  }
+  return undefined;
+}
+
+/** True if a parsed object is a CloudFormation template. */
+function looksLikeCloudFormation(obj: Record<string, unknown>): boolean {
+  if (obj.AWSTemplateFormatVersion !== undefined) return true;
+  const resources = obj.Resources;
+  if (resources && typeof resources === "object") {
+    for (const r of Object.values(resources as Record<string, unknown>)) {
+      const type = r && typeof r === "object" ? (r as Record<string, unknown>).Type : undefined;
+      if (typeof type === "string" && type.startsWith("AWS::")) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Discover CloudFormation templates (JSON or YAML, `.json`/`.yaml`/`.yml`/`.template`).
+ * The aws checks `JSON.parse` the template, so YAML templates are normalized to a
+ * JSON string here (intrinsics like `!Ref` survive as strings — fine for the
+ * structural security checks).
+ */
+export function discoverCloudFormation(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    const name = basename(full);
+    if (!/\.(json|ya?ml|template)$/i.test(name)) continue;
+    const content = readSafe(full);
+    if (content === undefined) continue;
+    const parsed = parseStructured(content);
+    if (parsed && looksLikeCloudFormation(parsed)) {
+      inputs.push({ path: relative(root, full), content: JSON.stringify(parsed), lexicon: "aws" });
+    }
+  }
+  return inputs;
+}
+
+/** True if a parsed object is an Azure ARM deployment template. */
+function looksLikeArm(obj: Record<string, unknown>): boolean {
+  return typeof obj.$schema === "string" && obj.$schema.includes("deploymentTemplate") && Array.isArray(obj.resources);
+}
+
+/** Discover Azure ARM templates (`.json`) under a repo root. */
+export function discoverArm(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    if (!/\.json$/i.test(basename(full))) continue;
+    const content = readSafe(full);
+    if (content === undefined) continue;
+    const parsed = parseStructured(content);
+    if (parsed && looksLikeArm(parsed)) {
+      inputs.push({ path: relative(root, full), content: JSON.stringify(parsed), lexicon: "azure" });
+    }
+  }
+  return inputs;
+}
+
+/**
+ * Discover Helm charts. A chart (directory with Chart.yaml) is one bundle: the
+ * helm checks read `output.files` keyed by chart-relative path, so all of the
+ * chart's files are collected into a single AuditInput.files map.
+ */
+export function discoverHelm(root: string): AuditInput[] {
+  const all: string[] = [];
+  walkFiles(root, all);
+  const chartDirs = all.filter((f) => basename(f) === "Chart.yaml").map((f) => f.slice(0, -("/Chart.yaml".length)));
+  const inputs: AuditInput[] = [];
+  for (const dir of chartDirs) {
+    const prefix = dir + "/";
+    const files: Record<string, string> = {};
+    for (const f of all) {
+      if (!f.startsWith(prefix)) continue;
+      const content = readSafe(f);
+      if (content !== undefined) files[f.slice(prefix.length)] = content;
+    }
+    if (files["Chart.yaml"] === undefined) continue;
+    const chartPath = relative(root, dir) || ".";
+    inputs.push({ path: chartPath, content: files["Chart.yaml"], lexicon: "helm", files });
+  }
+  return inputs;
+}
+
+/** Discover Docker artifacts: Dockerfiles (by name) and Compose files (by `services:`). */
+export function discoverDocker(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    const name = basename(full);
+    const content = readSafe(full);
+    if (content === undefined) continue;
+    if (isDockerfileName(name) || (isYaml(name) && looksLikeCompose(content))) {
+      inputs.push({ path: relative(root, full), content, lexicon: "docker" });
+    }
+  }
+  return inputs;
+}
+
 function isMergeWorthy(f: AuditFinding): boolean {
   return RULE_CATALOG[f.checkId]?.tier === "merge-worthy";
 }
@@ -247,7 +470,20 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     if (!existsSync(options.path)) {
       return { success: false, output: "", findings: [], scanned: [], exitCode: 1, error: `Path not found: ${options.path}` };
     }
-    inputs = discoverCiFiles(options.path);
+    // Helm claims whole chart directories; exclude chart-internal files from the
+    // other discoverers so raw templates aren't double-audited as loose manifests.
+    const helm = discoverHelm(options.path);
+    const chartPrefixes = helm.map((h) => (h.path === "." ? "" : `${h.path}/`));
+    const underChart = (p: string): boolean => chartPrefixes.some((pre) => (pre === "" ? true : p.startsWith(pre)));
+    const others = [
+      ...discoverCiFiles(options.path),
+      ...discoverManifests(options.path),
+      ...discoverDocker(options.path),
+      ...discoverCloudFormation(options.path),
+      ...discoverArm(options.path),
+      ...discoverGcp(options.path),
+    ].filter((i) => !underChart(i.path));
+    inputs = [...others, ...helm];
   }
 
   const scanned = inputs.map((i) => i.path);