@intentius/chant 0.6.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/catalog.test.ts

@@ -4,7 +4,7 @@ import { loadPlugins } from "../cli/plugins";
 
 /** All post-synth check ids the audit can actually surface, from the lexicons. */
 async function realCheckIds(): Promise<Set<string>> {
-  const plugins = await loadPlugins(["github", "gitlab", "forgejo", "k8s", "docker"]);
+  const plugins = await loadPlugins(["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm"]);
   const ids = new Set<string>();
   for (const plugin of plugins) {
     for (const check of plugin.postSynthChecks?.() ?? []) {

package/src/audit/catalog.ts

@@ -86,6 +86,18 @@ const DOCKER_SEC: Authority = {
   name: "Docker — Security best practices",
   url: "https://docs.docker.com/develop/security-best-practices/",
 };
+const AWS_SEC: Authority = {
+  name: "AWS — Security Pillar (Well-Architected)",
+  url: "https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/welcome.html",
+};
+const AZ_SEC: Authority = {
+  name: "Microsoft Cloud Security Benchmark",
+  url: "https://learn.microsoft.com/en-us/security/benchmark/azure/",
+};
+const GCP_SEC: Authority = {
+  name: "Google Cloud — Security best practices",
+  url: "https://cloud.google.com/security/best-practices",
+};
 
 function meta(
   id: string,
@@ -235,6 +247,107 @@ export const RULE_CATALOG: Record<string, RuleMeta> = {
   DKRD010: meta("DKRD010", R, G, "apt-get install without --no-install-recommends", "Add --no-install-recommends to keep images small."),
   DKRD011: meta("DKRD011", R, G, "ADD used where COPY would do", "Prefer COPY unless fetching a URL or extracting an archive."),
   DKRD012: meta("DKRD012", M, G, "No USER instruction — container runs as root", "Add a non-root USER instruction.", [DOCKER_SEC]),
+
+  // ── AWS CloudFormation (WAW / COR / EXT) ───────────────────────────
+  COR020: meta("COR020", M, G, "Circular resource dependency", "Break the dependency cycle between resources."),
+  EXT001: meta("EXT001", M, G, "Extension constraint violation", "Fix the cross-property constraint flagged by the cfn-lint extension schema."),
+  WAW010: meta("WAW010", R, G, "Redundant DependsOn", "Remove DependsOn already implied by a Ref/GetAtt."),
+  WAW011: meta("WAW011", R, G, "Deprecated Lambda runtime", "Upgrade to a supported Lambda runtime."),
+  WAW013: meta("WAW013", M, G, "Child stack exports nothing", "Add stackOutput() exports the parent can reference."),
+  WAW014: meta("WAW014", R, G, "Nested stack outputs never referenced", "Reference the outputs or split into a separate build."),
+  WAW015: meta("WAW015", M, G, "Circular dependency between nested stacks", "Break the cycle between nested stacks."),
+  WAW016: meta("WAW016", R, G, "Deprecated property", "Replace the deprecated CloudFormation property."),
+  WAW017: meta("WAW017", R, G, "Missing tags on a taggable resource", "Add tags for cost allocation and compliance."),
+  WAW018: meta("WAW018", M, G, "S3 bucket missing public access block", "Add a PublicAccessBlockConfiguration blocking all public access.", [AWS_SEC]),
+  WAW019: meta("WAW019", M, G, "Security group allows unrestricted ingress on a sensitive port", "Restrict the CIDR on SSH/RDP/database ports to known sources.", [AWS_SEC]),
+  WAW020: meta("WAW020", M, G, "IAM policy uses a wildcard Action", "Scope the policy to specific actions (least privilege).", [AWS_SEC]),
+  WAW021: meta("WAW021", M, G, "RDS storage not encrypted", "Enable StorageEncrypted for encryption at rest.", [AWS_SEC]),
+  WAW022: meta("WAW022", R, G, "Lambda has no VpcConfig", "Consider a VpcConfig for network isolation if the function needs VPC resources."),
+  WAW023: meta("WAW023", R, G, "CloudFront has no WAF web ACL", "Consider attaching a WAF web ACL."),
+  WAW024: meta("WAW024", R, G, "ALB access logging disabled", "Enable access logging for audit trails."),
+  WAW025: meta("WAW025", M, G, "SNS topic not encrypted", "Set KmsMasterKeyId for encryption at rest.", [AWS_SEC]),
+  WAW026: meta("WAW026", M, G, "SQS queue not encrypted", "Enable SqsManagedSseEnabled or set KmsMasterKeyId.", [AWS_SEC]),
+  WAW027: meta("WAW027", R, G, "DynamoDB point-in-time recovery disabled", "Enable PITR for recovery."),
+  WAW028: meta("WAW028", M, G, "EBS volume not encrypted", "Enable encryption at rest.", [AWS_SEC]),
+  WAW029: meta("WAW029", M, G, "Invalid DependsOn target", "Fix the dangling/self DependsOn reference."),
+  WAW030: meta("WAW030", R, G, "Missing DependsOn for a known ordering pattern", "Add the DependsOn the pattern requires."),
+  WAW031: meta("WAW031", R, G, "EKS Addon missing ServiceAccountRoleArn", "Set ServiceAccountRoleArn (IRSA) for addons that need it."),
+  WAW032: meta("WAW032", M, G, "EFS transit encryption disabled on Fargate", "Enable transit encryption for the EFS volume.", [AWS_SEC]),
+  WAW033: meta("WAW033", M, G, "Solr heap exceeds Fargate task memory", "Lower SOLR_HEAP or raise task memory."),
+  WAW034: meta("WAW034", R, G, "Fargate Solr task under-provisioned", "Allocate >= 2048MB for the Solr task."),
+  WAW035: meta("WAW035", R, G, "Solr container missing nofile ulimit", "Set a nofile ulimit >= 65535."),
+  WAW036: meta("WAW036", M, G, "Non-ASCII characters in resource properties", "Remove non-ASCII characters rejected at changeset time."),
+  WAW037: meta("WAW037", M, G, "Null values in resource properties", "Fix the invalid AttrRef producing null property values."),
+
+  // ── Azure ARM (AZR) ────────────────────────────────────────────────
+  AZR010: meta("AZR010", R, G, "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId()."),
+  AZR011: meta("AZR011", M, G, "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource."),
+  AZR012: meta("AZR012", R, G, "Deprecated API version", "Move to a current apiVersion."),
+  AZR013: meta("AZR013", M, G, "Resource missing location", "Add the required location property."),
+  AZR014: meta("AZR014", M, G, "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", [AZ_SEC]),
+  AZR015: meta("AZR015", M, G, "Storage account missing encryption", "Enable encryption services for data at rest.", [AZ_SEC]),
+  AZR016: meta("AZR016", R, G, "Key Vault soft-delete not enabled", "Enable soft-delete."),
+  AZR017: meta("AZR017", R, G, "Key Vault purge protection not enabled", "Enable purge protection."),
+  AZR018: meta("AZR018", R, G, "SQL Server missing auditing", "Enable auditing for compliance and threat detection."),
+  AZR019: meta("AZR019", M, G, "SQL database missing TDE", "Enable Transparent Data Encryption.", [AZ_SEC]),
+  AZR020: meta("AZR020", R, G, "App Service missing managed identity", "Enable a system- or user-assigned identity."),
+  AZR021: meta("AZR021", M, G, "App Service not HTTPS-only", "Set httpsOnly to true.", [AZ_SEC]),
+  AZR022: meta("AZR022", M, G, "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", [AZ_SEC]),
+  AZR023: meta("AZR023", R, G, "VM not using a managed disk", "Use a managed disk."),
+  AZR024: meta("AZR024", R, G, "VM missing boot diagnostics", "Enable boot diagnostics."),
+  AZR025: meta("AZR025", R, G, "AKS cluster missing RBAC", "Enable Kubernetes RBAC."),
+  AZR026: meta("AZR026", R, G, "AKS cluster missing network policy", "Configure a networkPolicy."),
+  AZR027: meta("AZR027", M, G, "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", [AZ_SEC]),
+  AZR028: meta("AZR028", R, G, "Network interface missing NSG", "Associate an NSG to control traffic."),
+  AZR029: meta("AZR029", M, G, "Managed disk missing encryption", "Enable encryption for data at rest.", [AZ_SEC]),
+
+  // ── GCP Config Connector (WGC) ─────────────────────────────────────
+  WGC101: meta("WGC101", M, G, "Storage/SQL without encryption configuration", "Configure encryption (e.g. a CMEK key) for data at rest.", [GCP_SEC]),
+  WGC102: meta("WGC102", M, G, "Public IAM member (allUsers/allAuthenticatedUsers)", "Remove allUsers/allAuthenticatedUsers bindings.", [GCP_SEC]),
+  WGC103: meta("WGC103", R, G, "Missing project-id annotation", "Add the cnrm.cloud.google.com/project-id annotation."),
+  WGC104: meta("WGC104", M, G, "Bucket without uniform bucket-level access", "Enable uniformBucketLevelAccess.", [GCP_SEC]),
+  WGC105: meta("WGC105", M, G, "Cloud SQL open to 0.0.0.0/0", "Restrict authorizedNetworks to known sources.", [GCP_SEC]),
+  WGC106: meta("WGC106", R, G, "Missing deletion-policy annotation", "Add the cnrm.cloud.google.com/deletion-policy annotation."),
+  WGC107: meta("WGC107", R, G, "Bucket versioning disabled", "Enable object versioning."),
+  WGC108: meta("WGC108", R, G, "Cloud SQL backups disabled", "Enable backup configuration."),
+  WGC109: meta("WGC109", M, G, "Firewall open to 0.0.0.0/0", "Restrict sourceRanges to known sources.", [GCP_SEC]),
+  WGC110: meta("WGC110", M, G, "KMS key without rotation", "Set a rotationPeriod on the CryptoKey.", [GCP_SEC]),
+  WGC111: meta("WGC111", M, G, "Reference to an undefined resource", "Point the reference at a resource in the output."),
+  WGC112: meta("WGC112", M, G, "Missing or invalid apiVersion", "Set a valid cnrm.cloud.google.com apiVersion."),
+  WGC113: meta("WGC113", R, G, "Alpha API version", "Move to a beta/GA API version."),
+  WGC201: meta("WGC201", R, G, "Missing managed-by label", "Add the app.kubernetes.io/managed-by label."),
+  WGC202: meta("WGC202", M, G, "Cluster without Workload Identity", "Enable Workload Identity on the ContainerCluster.", [GCP_SEC]),
+  WGC203: meta("WGC203", M, G, "Node pool uses broad cloud-platform scope", "Use narrowly-scoped OAuth scopes instead of cloud-platform.", [GCP_SEC]),
+  WGC204: meta("WGC204", R, G, "Compute instance without Shielded VM", "Enable Shielded VM configuration."),
+  WGC301: meta("WGC301", R, G, "No IAMAuditConfig found", "Configure audit logging via IAMAuditConfig."),
+  WGC302: meta("WGC302", R, G, "No Service (enabled APIs) found", "Declare the GCP APIs you depend on."),
+  WGC303: meta("WGC303", R, G, "No VPC Service Controls perimeter", "Consider an AccessContextManager ServicePerimeter."),
+  WGC401: meta("WGC401", M, G, "Unknown field in resource spec", "Remove the unknown spec field."),
+  WGC402: meta("WGC402", M, G, "Missing required spec field", "Add the required spec field."),
+  WGC403: meta("WGC403", M, G, "Spec field has wrong type/structure", "Fix the field's type/structure."),
+
+  // ── Helm (WHM) ─────────────────────────────────────────────────────
+  WHM005: meta("WHM005", R, G, "Sub-chart wrapper with no templates", "Deploy the upstream chart directly instead of an empty wrapper."),
+  WHM101: meta("WHM101", M, G, "Chart.yaml missing required fields", "Set apiVersion (v2), name, and version in Chart.yaml."),
+  WHM102: meta("WHM102", R, G, "Missing values.schema.json", "Add a values.schema.json to validate values."),
+  WHM103: meta("WHM103", M, G, "Invalid Go template syntax", "Fix the unbalanced template braces."),
+  WHM104: meta("WHM104", R, G, "Missing NOTES.txt", "Add templates/NOTES.txt for application charts."),
+  WHM105: meta("WHM105", R, G, "Missing _helpers.tpl", "Add templates/_helpers.tpl."),
+  WHM201: meta("WHM201", R, G, "Missing standard Helm labels", "Add the recommended app.kubernetes.io labels."),
+  WHM202: meta("WHM202", R, G, "Hook weights undefined", "Define hook weights when multiple hooks exist."),
+  WHM203: meta("WHM203", R, G, "Undocumented values", "Document values via schema or comments."),
+  WHM204: meta("WHM204", R, G, "Dependencies pinned, not ranged", "Use semver ranges for chart dependencies."),
+  WHM301: meta("WHM301", R, G, "No Helm test", "Add at least one Helm test for application charts."),
+  WHM302: meta("WHM302", R, G, "Container resources not set", "Set limits/requests via values or defaults."),
+  WHM401: meta("WHM401", M, G, "Container image uses :latest or no tag", "Pin the image to an explicit version tag.", [SCORECARD_PINNED]),
+  WHM402: meta("WHM402", M, G, "Container may run as root", "Set runAsNonRoot in the security context.", [K8S_PSS]),
+  WHM403: meta("WHM403", M, G, "Root filesystem writable", "Set readOnlyRootFilesystem.", [K8S_PSS]),
+  WHM404: meta("WHM404", M, G, "Privileged container", "Remove privileged mode.", [K8S_PSS]),
+  WHM405: meta("WHM405", R, G, "Resource specs missing cpu/memory", "Set cpu and memory in limits/requests."),
+  WHM406: meta("WHM406", R, G, "CRDs in crds/ are never upgraded", "Manage CRD upgrades outside Helm or via a separate chart."),
+  WHM407: meta("WHM407", M, G, "Inline Secret data", "Use ExternalSecret/SealedSecret instead of inline Secret data.", [K8S_SECRETS]),
+  WHM501: meta("WHM501", R, G, "Unused values key", "Remove values defined but never referenced."),
+  WHM502: meta("WHM502", M, G, "Deprecated/invalid Kubernetes API version", "Update to a supported apiVersion."),
 };
 
 /** Look up catalog metadata for a check id, if known. */

package/src/audit/rules-doc.ts

@@ -15,6 +15,10 @@ const GROUPS: Array<{ heading: string; prefixes: string[]; blurb: string }> = [
   { heading: "Forgejo (WFJ)", prefixes: ["WFJ"], blurb: "" },
   { heading: "Kubernetes (WK8 / ARGO)", prefixes: ["WK8", "ARGO"], blurb: "Run against Kubernetes manifests." },
   { heading: "Docker (DKRD)", prefixes: ["DKRD"], blurb: "Run against Dockerfiles and Compose files." },
+  { heading: "AWS CloudFormation (WAW / COR / EXT)", prefixes: ["WAW", "COR", "EXT"], blurb: "Run against CloudFormation templates (JSON or YAML)." },
+  { heading: "Azure ARM (AZR)", prefixes: ["AZR"], blurb: "Run against ARM deployment templates (JSON)." },
+  { heading: "GCP Config Connector (WGC)", prefixes: ["WGC"], blurb: "Run against Config Connector (cnrm.cloud.google.com) manifests." },
+  { heading: "Helm (WHM)", prefixes: ["WHM"], blurb: "Run against Helm charts (Chart.yaml + templates)." },
 ];
 
 function ruleBlock(m: RuleMeta): string {

package/src/cli/commands/__fixtures__/audit-aws/stack.yaml

@@ -0,0 +1,11 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Resources:
+  Sg:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: web
+      SecurityGroupIngress:
+        - IpProtocol: tcp
+          FromPort: 22
+          ToPort: 22
+          CidrIp: 0.0.0.0/0

package/src/cli/commands/__fixtures__/audit-aws/template.json

@@ -0,0 +1,7 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Resources": {
+    "Data": { "Type": "AWS::S3::Bucket", "Properties": {} },
+    "Db": { "Type": "AWS::RDS::DBInstance", "Properties": { "Engine": "postgres" } }
+  }
+}

package/src/cli/commands/__fixtures__/audit-azure/azuredeploy.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "resources": [
+    {
+      "type": "Microsoft.Storage/storageAccounts",
+      "apiVersion": "2022-09-01",
+      "name": "data",
+      "location": "eastus",
+      "properties": { "allowBlobPublicAccess": true }
+    }
+  ]
+}

package/src/cli/commands/__fixtures__/audit-gcp/bucket.yaml

@@ -0,0 +1,6 @@
+apiVersion: storage.cnrm.cloud.google.com/v1beta1
+kind: StorageBucket
+metadata:
+  name: data
+spec:
+  location: US

package/src/cli/commands/__fixtures__/audit-gcp/firewall.yaml

@@ -0,0 +1,9 @@
+apiVersion: compute.cnrm.cloud.google.com/v1beta1
+kind: ComputeFirewall
+metadata:
+  name: allow-all
+spec:
+  sourceRanges:
+    - 0.0.0.0/0
+  allow:
+    - protocol: tcp

package/src/cli/commands/__fixtures__/audit-helm/mychart/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: mychart
+version: 0.1.0

package/src/cli/commands/__fixtures__/audit-helm/mychart/templates/deployment.yaml

@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  template:
+    spec:
+      containers:
+        - name: app
+          image: nginx:latest
+          securityContext:
+            privileged: true

package/src/cli/commands/__fixtures__/audit-helm/mychart/values.yaml

@@ -0,0 +1 @@
+image: myapp:latest

package/src/cli/commands/audit.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { fileURLToPath } from "url";
-import { auditCommand, discoverCiFiles, discoverManifests, discoverDocker, tokenForHost, coverageNotes } from "./audit";
+import { auditCommand, discoverCiFiles, discoverManifests, discoverDocker, discoverCloudFormation, discoverArm, discoverGcp, discoverHelm, tokenForHost, coverageNotes } from "./audit";
 import { MissingLexiconError, type AuditInput } from "../../audit/core";
 import { readFileSync, existsSync, rmSync } from "fs";
 import { tmpdir } from "os";
@@ -58,6 +58,64 @@ describe("auditCommand", () => {
     expect(ids).toContain("DKRD003"); // compose exposes SSH port 22
   });
 
+  test("discovers and audits CloudFormation (JSON and YAML)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-aws", import.meta.url));
+    const files = discoverCloudFormation(repo);
+    const paths = files.map((f) => f.path).sort();
+    expect(paths).toContain("template.json");
+    expect(paths).toContain("stack.yaml");
+    // YAML is normalized to a JSON string the aws checks can JSON.parse.
+    expect(() => JSON.parse(files.find((f) => f.path === "stack.yaml")!.content)).not.toThrow();
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WAW018"); // S3 missing public access block (JSON template)
+    expect(ids).toContain("WAW021"); // RDS not encrypted (JSON template)
+    expect(ids).toContain("WAW019"); // SG open SSH (YAML template — proves YAML works)
+  });
+
+  test("discovers and audits Azure ARM templates", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-azure", import.meta.url));
+    expect(discoverArm(repo).map((f) => f.path)).toContain("azuredeploy.json");
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("AZR014"); // storage allows public blob access
+  });
+
+  test("discovers and audits GCP Config Connector (not misclassified as k8s)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-gcp", import.meta.url));
+    const gcp = discoverGcp(repo);
+    expect(gcp.map((f) => f.path).sort()).toEqual(["bucket.yaml", "firewall.yaml"]);
+    // cnrm manifests must NOT also be picked up as k8s.
+    expect(discoverManifests(repo)).toEqual([]);
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WGC109"); // firewall open to 0.0.0.0/0
+    // k8s checks did not run on these.
+    expect([...ids].some((id) => id.startsWith("WK8"))).toBe(false);
+  });
+
+  test("discovers and audits a Helm chart (as a bundle, not loose manifests)", async () => {
+    const repo = fileURLToPath(new URL("./__fixtures__/audit-helm", import.meta.url));
+    const charts = discoverHelm(repo);
+    expect(charts).toHaveLength(1);
+    expect(charts[0].lexicon).toBe("helm");
+    expect(charts[0].files!["Chart.yaml"]).toContain("name: mychart");
+    expect(charts[0].files!["templates/deployment.yaml"]).toContain("privileged");
+
+    const result = await auditCommand({ path: repo, format: "stylish" });
+    expect(result.success).toBe(true);
+    const ids = new Set(result.findings.map((f) => f.checkId));
+    expect(ids).toContain("WHM401"); // :latest image in the chart
+    expect(ids).toContain("WHM404"); // privileged container in a template
+    // the chart's template was NOT double-audited as a loose k8s manifest
+    expect([...ids].some((id) => id.startsWith("WK8"))).toBe(false);
+  });
+
   test("discovers CI files under a repo root", () => {
     const files = discoverCiFiles(REPO);
     expect(files.map((f) => f.path)).toContain(".github/workflows/ci.yml");

package/src/cli/commands/audit.ts

@@ -146,14 +146,17 @@ function readSafe(full: string): string | undefined {
   }
 }
 
-/** True if any YAML document in the content is a Kubernetes manifest. */
+const CNRM = "cnrm.cloud.google.com";
+
+/** True if any YAML doc is a Kubernetes manifest (excluding GCP Config Connector). */
 function looksLikeK8s(content: string): boolean {
   for (const doc of content.split(/\n---\n/)) {
     const t = doc.trim();
     if (!t) continue;
     try {
       const obj = parseYAML(t) as Record<string, unknown>;
-      if (obj && typeof obj.apiVersion === "string" && typeof obj.kind === "string") return true;
+      const apiVersion = obj?.apiVersion;
+      if (typeof apiVersion === "string" && typeof obj.kind === "string" && !apiVersion.includes(CNRM)) return true;
     } catch {
       // not parseable as a single doc — skip
     }
@@ -161,6 +164,36 @@ function looksLikeK8s(content: string): boolean {
   return false;
 }
 
+/** True if any YAML doc is a GCP Config Connector resource (cnrm.cloud.google.com). */
+function looksLikeGcp(content: string): boolean {
+  for (const doc of content.split(/\n---\n/)) {
+    const t = doc.trim();
+    if (!t) continue;
+    try {
+      const obj = parseYAML(t) as Record<string, unknown>;
+      if (typeof obj?.apiVersion === "string" && obj.apiVersion.includes(CNRM)) return true;
+    } catch {
+      // skip
+    }
+  }
+  return false;
+}
+
+/** Discover GCP Config Connector manifests under a repo root. */
+export function discoverGcp(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    if (!isYaml(basename(full))) continue;
+    const content = readSafe(full);
+    if (content !== undefined && looksLikeGcp(content)) {
+      inputs.push({ path: relative(root, full), content, lexicon: "gcp" });
+    }
+  }
+  return inputs;
+}
+
 /** Discover Kubernetes manifest files under a repo root (content-detected). */
 export function discoverManifests(root: string): AuditInput[] {
   const files: string[] = [];
@@ -189,6 +222,106 @@ function looksLikeCompose(content: string): boolean {
   }
 }
 
+/** Parse JSON or YAML content into an object, or undefined. */
+function parseStructured(content: string): Record<string, unknown> | undefined {
+  try {
+    const j = JSON.parse(content);
+    if (j && typeof j === "object") return j as Record<string, unknown>;
+  } catch {
+    // not JSON — try YAML
+  }
+  try {
+    const y = parseYAML(content) as Record<string, unknown>;
+    if (y && typeof y === "object") return y;
+  } catch {
+    // not YAML either
+  }
+  return undefined;
+}
+
+/** True if a parsed object is a CloudFormation template. */
+function looksLikeCloudFormation(obj: Record<string, unknown>): boolean {
+  if (obj.AWSTemplateFormatVersion !== undefined) return true;
+  const resources = obj.Resources;
+  if (resources && typeof resources === "object") {
+    for (const r of Object.values(resources as Record<string, unknown>)) {
+      const type = r && typeof r === "object" ? (r as Record<string, unknown>).Type : undefined;
+      if (typeof type === "string" && type.startsWith("AWS::")) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Discover CloudFormation templates (JSON or YAML, `.json`/`.yaml`/`.yml`/`.template`).
+ * The aws checks `JSON.parse` the template, so YAML templates are normalized to a
+ * JSON string here (intrinsics like `!Ref` survive as strings — fine for the
+ * structural security checks).
+ */
+export function discoverCloudFormation(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    const name = basename(full);
+    if (!/\.(json|ya?ml|template)$/i.test(name)) continue;
+    const content = readSafe(full);
+    if (content === undefined) continue;
+    const parsed = parseStructured(content);
+    if (parsed && looksLikeCloudFormation(parsed)) {
+      inputs.push({ path: relative(root, full), content: JSON.stringify(parsed), lexicon: "aws" });
+    }
+  }
+  return inputs;
+}
+
+/** True if a parsed object is an Azure ARM deployment template. */
+function looksLikeArm(obj: Record<string, unknown>): boolean {
+  return typeof obj.$schema === "string" && obj.$schema.includes("deploymentTemplate") && Array.isArray(obj.resources);
+}
+
+/** Discover Azure ARM templates (`.json`) under a repo root. */
+export function discoverArm(root: string): AuditInput[] {
+  const files: string[] = [];
+  walkFiles(root, files);
+  const inputs: AuditInput[] = [];
+  for (const full of files) {
+    if (!/\.json$/i.test(basename(full))) continue;
+    const content = readSafe(full);
+    if (content === undefined) continue;
+    const parsed = parseStructured(content);
+    if (parsed && looksLikeArm(parsed)) {
+      inputs.push({ path: relative(root, full), content: JSON.stringify(parsed), lexicon: "azure" });
+    }
+  }
+  return inputs;
+}
+
+/**
+ * Discover Helm charts. A chart (directory with Chart.yaml) is one bundle: the
+ * helm checks read `output.files` keyed by chart-relative path, so all of the
+ * chart's files are collected into a single AuditInput.files map.
+ */
+export function discoverHelm(root: string): AuditInput[] {
+  const all: string[] = [];
+  walkFiles(root, all);
+  const chartDirs = all.filter((f) => basename(f) === "Chart.yaml").map((f) => f.slice(0, -("/Chart.yaml".length)));
+  const inputs: AuditInput[] = [];
+  for (const dir of chartDirs) {
+    const prefix = dir + "/";
+    const files: Record<string, string> = {};
+    for (const f of all) {
+      if (!f.startsWith(prefix)) continue;
+      const content = readSafe(f);
+      if (content !== undefined) files[f.slice(prefix.length)] = content;
+    }
+    if (files["Chart.yaml"] === undefined) continue;
+    const chartPath = relative(root, dir) || ".";
+    inputs.push({ path: chartPath, content: files["Chart.yaml"], lexicon: "helm", files });
+  }
+  return inputs;
+}
+
 /** Discover Docker artifacts: Dockerfiles (by name) and Compose files (by `services:`). */
 export function discoverDocker(root: string): AuditInput[] {
   const files: string[] = [];
@@ -337,7 +470,20 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     if (!existsSync(options.path)) {
       return { success: false, output: "", findings: [], scanned: [], exitCode: 1, error: `Path not found: ${options.path}` };
     }
-    inputs = [...discoverCiFiles(options.path), ...discoverManifests(options.path), ...discoverDocker(options.path)];
+    // Helm claims whole chart directories; exclude chart-internal files from the
+    // other discoverers so raw templates aren't double-audited as loose manifests.
+    const helm = discoverHelm(options.path);
+    const chartPrefixes = helm.map((h) => (h.path === "." ? "" : `${h.path}/`));
+    const underChart = (p: string): boolean => chartPrefixes.some((pre) => (pre === "" ? true : p.startsWith(pre)));
+    const others = [
+      ...discoverCiFiles(options.path),
+      ...discoverManifests(options.path),
+      ...discoverDocker(options.path),
+      ...discoverCloudFormation(options.path),
+      ...discoverArm(options.path),
+      ...discoverGcp(options.path),
+    ].filter((i) => !underChart(i.path));
+    inputs = [...others, ...helm];
   }
 
   const scanned = inputs.map((i) => i.path);