@opensip-cli/checks-universal 0.1.0

package/dist/checks/architecture/docker-best-practices.js

@@ -0,0 +1,427 @@
+// @fitness-ignore-file fitness-check-standards -- Dockerfile check scans non-standard file types that do not map to a fileTypes extension array
+// @fitness-ignore-file file-length-limit -- Complex module with tightly coupled logic; refactoring would risk breaking changes
+/**
+ * @fileoverview Docker best practices fitness check
+ * @invariants
+ * - Security rules (non-root user, no secrets, production-dependencies) are errors (blocking)
+ * - Efficiency rules (layer ordering, multi-stage, no-build-tools-in-runner) are warnings (advisory)
+ * - All Dockerfiles in the repository are scanned
+ */
+import * as path from 'node:path';
+import { defineCheck } from '@opensip-cli/fitness';
+// =============================================================================
+// PRE-COMPILED REGEX PATTERNS (for safety and performance)
+// =============================================================================
+// Maximum line length for regex matching to prevent DoS
+const MAX_DOCKERFILE_LINE_LENGTH = 2000;
+/**
+ * Safely truncate a line for regex matching.
+ */
+function safeDockerLine(line) {
+    /* v8 ignore next -- defensive: real Dockerfile lines never exceed 2000 chars */
+    return line.length > MAX_DOCKERFILE_LINE_LENGTH
+        ? line.slice(0, MAX_DOCKERFILE_LINE_LENGTH)
+        : line;
+}
+// Secret patterns - using word character classes with bounded quantifiers
+// Using \w for alphanumeric plus underscore, adding dash separately with explicit bounds
+const SECRET_API_KEY_PATTERN = /(?:API_KEY|APIKEY|API_SECRET|SECRET_KEY|AUTH_TOKEN|ACCESS_TOKEN)\s{0,10}=\s{0,10}['"]?[\w-]{16,200}/i;
+const SECRET_AWS_PATTERN = /(?:AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY)\s{0,10}=\s{0,10}['"]?[\w/+=]{20,200}/i;
+const SECRET_DB_URL_PATTERN = /(?:DATABASE_URL|DB_URL|MONGO_URL|REDIS_URL)\s{0,10}=\s{0,10}['"]?[a-z]{1,20}:\/\/[^:]{1,100}:[^@]{1,100}@/i;
+const SECRET_PASSWORD_PATTERN = /(?:PASSWORD|PASSWD|DB_PASSWORD|ADMIN_PASSWORD)\s{0,10}=\s{0,10}['"]?[^\s'"]{8,200}/i;
+const SECRET_PRIVATE_KEY_PATTERN = /-----BEGIN\s{1,10}(?:RSA\s{1,10})?PRIVATE\s{1,10}KEY-----/;
+const SECRET_JWT_PATTERN = /JWT_SECRET\s{0,10}=\s{0,10}['"]?[\w-]{32,500}/i;
+const SECRET_PATTERNS = [
+    SECRET_API_KEY_PATTERN,
+    SECRET_AWS_PATTERN,
+    SECRET_DB_URL_PATTERN,
+    SECRET_PASSWORD_PATTERN,
+    SECRET_PRIVATE_KEY_PATTERN,
+    SECRET_JWT_PATTERN,
+];
+// Package manager patterns - pre-compiled with bounded quantifiers
+const PNPM_INSTALL_PATTERN = /pnpm\s{1,10}install(?!\s{1,10}--frozen-lockfile)/;
+const NPM_INSTALL_PATTERN = /npm\s{1,10}(?:install|ci)(?!\s{1,10}-g)(?!\s{1,10}--global)(?!\s{1,10}--ci)(?!\s{1,10}--frozen-lockfile)/;
+const YARN_INSTALL_PATTERN = /yarn\s{1,10}install(?!\s{1,10}--frozen-lockfile)(?!\s{1,10}--immutable)/;
+const PACKAGE_MANAGER_PATTERNS = [
+    { pattern: PNPM_INSTALL_PATTERN, manager: 'pnpm', fix: '--frozen-lockfile' },
+    { pattern: NPM_INSTALL_PATTERN, manager: 'npm', fix: '--ci or npm ci' },
+    {
+        pattern: YARN_INSTALL_PATTERN,
+        manager: 'yarn',
+        fix: '--frozen-lockfile or --immutable',
+    },
+];
+// Cache mount patterns - pre-compiled with bounded quantifiers
+const PKG_INSTALL_PATTERN = /(?:pnpm|npm|yarn)\s{1,10}install(?!\s{1,10}-g)(?!\s{1,10}--global)/;
+// Production dependency patterns - pre-compiled with bounded quantifiers
+const PROD_DEPS_FLAG_PATTERN = /(?:--prod\b|--production\b)/;
+// Other patterns - pre-compiled with bounded quantifiers
+const APT_UPGRADE_PATTERN = /apt-get\s{1,10}upgrade/i;
+const COPY_PATTERN = /COPY\s{1,10}(?:--from=\S{1,100}\s{1,10})?(\S{1,500})/i;
+const PACKAGE_FILE_COPY_PATTERN = /COPY\s{1,10}[^\n]{0,500}(?:package\.json|pnpm-lock|yarn\.lock|package-lock)/i;
+const NODE_MODULES_FROM_STAGE_PATTERN = /COPY\s{1,10}--from=\S{1,100}[^\n]{0,500}node_modules/i;
+const FROM_IMAGE_PATTERN = /FROM\s{1,10}(\S{1,200})/i;
+const FROM_STAGE_PATTERN = /\bAS\s{1,10}(\w{1,100})/i;
+const USER_PATTERN = /USER\s{1,10}(\S{1,100})/i;
+const NODE_ENV_PROD_PATTERN = /NODE_ENV\s{0,10}=\s{0,10}production/i;
+const RUNNER_STAGE_NAMES = new Set(['runner', 'production', 'prod', 'final', 'runtime']);
+// =============================================================================
+// ANALYSIS FUNCTIONS
+// =============================================================================
+function checkForSecrets(line, lineNum, file, filePath) {
+    const safeLine = safeDockerLine(line);
+    for (const pattern of SECRET_PATTERNS) {
+        if (pattern.test(safeLine)) {
+            return {
+                file,
+                filePath,
+                line: lineNum,
+                rule: 'no-hardcoded-secrets',
+                message: 'Hardcoded secret detected in Dockerfile',
+                severity: 'error',
+                suggestion: 'Use build arguments, runtime environment variables, or a secrets manager instead',
+            };
+        }
+    }
+    return null;
+}
+function checkRunCommand(line, lineNum, file, filePath) {
+    const violations = [];
+    let hasFrozenLockfileViolation = false;
+    const safeLine = safeDockerLine(line);
+    for (const { pattern, manager, fix } of PACKAGE_MANAGER_PATTERNS) {
+        if (pattern.test(safeLine)) {
+            hasFrozenLockfileViolation = true;
+            violations.push({
+                file,
+                filePath,
+                line: lineNum,
+                rule: 'frozen-lockfile',
+                message: `${manager} install without frozen lockfile flag`,
+                severity: 'error',
+                suggestion: `Add ${fix} to ensure reproducible builds`,
+            });
+        }
+    }
+    if (APT_UPGRADE_PATTERN.test(safeLine)) {
+        violations.push({
+            file,
+            filePath,
+            line: lineNum,
+            rule: 'no-apt-upgrade',
+            message: 'apt-get upgrade makes builds non-reproducible',
+            severity: 'warning',
+            suggestion: 'Pin specific package versions instead of upgrading all packages',
+        });
+    }
+    return { violations, hasFrozenLockfileViolation };
+}
+function checkCopyOrder(options) {
+    const { line, lineNum, file, filePath, lines, lastFromLine, lineIndex } = options;
+    /* v8 ignore next 4 -- defensive: callers always pass an array */
+    // Validate array parameter
+    if (!Array.isArray(lines)) {
+        return null;
+    }
+    const safeLine = safeDockerLine(line);
+    const copyMatch = COPY_PATTERN.exec(safeLine);
+    if (copyMatch?.[1] !== '.' && copyMatch?.[1] !== './')
+        return null;
+    if (safeLine.includes('--from='))
+        return null;
+    const stageLines = lines.slice(lastFromLine, lineIndex);
+    const hasPackageFileCopy = stageLines.some((l) => PACKAGE_FILE_COPY_PATTERN.test(safeDockerLine(l)));
+    const hasNodeModulesFromStage = stageLines.some((l) => NODE_MODULES_FROM_STAGE_PATTERN.test(safeDockerLine(l)));
+    if (!hasPackageFileCopy && !hasNodeModulesFromStage) {
+        return {
+            file,
+            filePath,
+            line: lineNum,
+            rule: 'copy-order',
+            message: 'COPY . before copying dependency files',
+            severity: 'warning',
+            suggestion: 'Copy package.json and lockfile first, run install, then copy source for better layer caching',
+        };
+    }
+    return null;
+}
+function checkCacheMount(line, lineNum, file, filePath) {
+    const safeLine = safeDockerLine(line);
+    if (PKG_INSTALL_PATTERN.test(safeLine) && !safeLine.includes('--mount=type=cache')) {
+        return {
+            file,
+            filePath,
+            line: lineNum,
+            rule: 'cache-mount',
+            message: 'Package install without BuildKit cache mount',
+            severity: 'warning',
+            suggestion: 'Add --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store to cache the package store across builds',
+        };
+    }
+    return null;
+}
+/* v8 ignore start -- Dockerfile multi-stage state-machine; many edge-case branches covered by integration */
+function processFromLine(line, lineNum, state) {
+    state.fromCount++;
+    state.lastFromLine = lineNum;
+    const safeLine = safeDockerLine(line);
+    const match = FROM_IMAGE_PATTERN.exec(safeLine);
+    const baseImage = match?.[1] ?? null;
+    if (baseImage)
+        state.baseImages.push(baseImage);
+    const stageMatch = FROM_STAGE_PATTERN.exec(safeLine);
+    const stageName = stageMatch?.[1]?.toLowerCase() ?? null;
+    // Determine if this is the runner stage
+    if (stageName) {
+        state.isInRunnerStage = RUNNER_STAGE_NAMES.has(stageName);
+    }
+    else if (state.fromCount > 1) {
+        state.isInRunnerStage = true;
+    }
+    if (state.isInRunnerStage) {
+        state.runnerStageBaseImage = baseImage;
+        state.runnerFromLine = lineNum;
+        // Check if runner's base image references a previously defined build stage
+        if (baseImage) {
+            const baseImageLower = baseImage.toLowerCase();
+            state.runnerInheritsBuildStage = state.stageNames.includes(baseImageLower);
+        }
+    }
+    // Record stage name after checks (to avoid self-matching)
+    if (stageName) {
+        state.stageNames.push(stageName);
+    }
+}
+function addMissingBestPracticeViolations(file, filePath, lineCount, state) {
+    const violations = [];
+    const hasMultiStage = state.fromCount >= 2;
+    if (!hasMultiStage && state.fromCount > 0) {
+        violations.push({
+            file,
+            filePath,
+            line: 1,
+            rule: 'multi-stage-build',
+            message: 'Dockerfile does not use multi-stage build',
+            severity: 'error',
+            suggestion: 'Use separate stages for building and running to reduce image size and attack surface',
+        });
+    }
+    if (!state.hasNonRootUser && state.fromCount > 0) {
+        violations.push({
+            file,
+            filePath,
+            line: lineCount,
+            rule: 'non-root-user',
+            message: 'Dockerfile does not specify a non-root user',
+            severity: 'error',
+            suggestion: String.raw `Add USER directive with a non-root user: RUN addgroup --system app && adduser --system --ingroup app app\nUSER app`,
+        });
+    }
+    if (!state.hasHealthcheck && state.fromCount > 0) {
+        violations.push({
+            file,
+            filePath,
+            line: lineCount,
+            rule: 'healthcheck',
+            message: 'Dockerfile does not include a HEALTHCHECK instruction',
+            severity: 'warning',
+            suggestion: 'Add HEALTHCHECK to help orchestrators verify container health',
+        });
+    }
+    // Check NODE_ENV only if runner stage uses Node.js
+    const runnerUsesNode = state.runnerStageBaseImage?.includes('node') ?? false;
+    if (runnerUsesNode && !state.hasNodeEnvProduction) {
+        violations.push({
+            file,
+            filePath,
+            line: lineCount,
+            rule: 'node-env-production',
+            message: 'NODE_ENV=production not set in runtime stage',
+            severity: 'warning',
+            suggestion: 'Add ENV NODE_ENV=production in the runner stage for Node.js optimizations',
+        });
+    }
+    // Check if runner copies node_modules without production-only dependency resolution
+    if (state.runnerCopiesNodeModules && !state.hasProductionDepsFlag) {
+        violations.push({
+            file,
+            filePath,
+            line: state.runnerNodeModulesLine,
+            rule: 'production-dependencies',
+            message: 'Runtime image copies node_modules without production-only dependency resolution',
+            severity: 'error',
+            suggestion: 'Use "pnpm deploy --prod" to create a production bundle, or add --prod to install command to exclude devDependencies from the runtime image',
+        });
+    }
+    // Check if runner stage inherits from a build stage (includes build tools)
+    if (state.runnerInheritsBuildStage) {
+        violations.push({
+            file,
+            filePath,
+            line: state.runnerFromLine,
+            rule: 'no-build-tools-in-runner',
+            message: 'Runtime stage inherits from a build stage that may include build tools (pnpm, corepack, etc.)',
+            severity: 'warning',
+            suggestion: 'Use a clean base image (e.g., node:20-alpine) for the runtime stage instead of inheriting from a build stage',
+        });
+    }
+    return violations;
+}
+/* v8 ignore stop */
+function analyzeDockerfile(content, filePath, file) {
+    const lines = content.split('\n');
+    const violations = [];
+    const state = {
+        hasNonRootUser: false,
+        hasHealthcheck: false,
+        hasFrozenLockfile: true,
+        hasNodeEnvProduction: false,
+        hasProductionDepsFlag: false,
+        baseImages: [],
+        fromCount: 0,
+        isInRunnerStage: false,
+        runnerStageBaseImage: null,
+        lastFromLine: 0,
+        stageNames: [],
+        runnerCopiesNodeModules: false,
+        runnerNodeModulesLine: 0,
+        runnerInheritsBuildStage: false,
+        runnerFromLine: 0,
+    };
+    for (let i = 0; i < lines.length; i++) {
+        processDockerfileLine({
+            line: lines[i],
+            index: i,
+            lines,
+            state,
+            violations,
+            file,
+            filePath,
+        });
+    }
+    // Add violations for missing best practices
+    violations.push(...addMissingBestPracticeViolations(file, filePath, lines.length, state));
+    return violations;
+}
+function processUserLine(trimmedLine, state) {
+    const safeLine = safeDockerLine(trimmedLine);
+    const userMatch = USER_PATTERN.exec(safeLine);
+    if (userMatch?.[1] && userMatch[1] !== 'root') {
+        state.hasNonRootUser = true;
+    }
+}
+function processRunLine(options) {
+    const { trimmedLine, lineNum, file, filePath, state, violations } = options;
+    const runResult = checkRunCommand(trimmedLine, lineNum, file, filePath);
+    violations.push(...runResult.violations);
+    if (runResult.hasFrozenLockfileViolation)
+        state.hasFrozenLockfile = false;
+    const cacheMountViolation = checkCacheMount(trimmedLine, lineNum, file, filePath);
+    if (cacheMountViolation)
+        violations.push(cacheMountViolation);
+    if (PROD_DEPS_FLAG_PATTERN.test(safeDockerLine(trimmedLine))) {
+        state.hasProductionDepsFlag = true;
+    }
+}
+function processCopyLine(options) {
+    const { trimmedLine, lineNum, index, lines, file, filePath, state, violations } = options;
+    const copyViolation = checkCopyOrder({
+        line: trimmedLine,
+        lineNum,
+        file,
+        filePath,
+        lines,
+        lastFromLine: state.lastFromLine,
+        lineIndex: index,
+    });
+    if (copyViolation)
+        violations.push(copyViolation);
+    if (state.isInRunnerStage && NODE_MODULES_FROM_STAGE_PATTERN.test(safeDockerLine(trimmedLine))) {
+        state.runnerCopiesNodeModules = true;
+        state.runnerNodeModulesLine = lineNum;
+    }
+}
+function processDockerfileLine(options) {
+    const { line, index, lines, state, violations, file, filePath } = options;
+    /* v8 ignore next -- defensive: lines.entries() never yields undefined */
+    const trimmedLine = line?.trim() ?? '';
+    if (!trimmedLine || trimmedLine.startsWith('#'))
+        return;
+    const upperLine = trimmedLine.toUpperCase();
+    const lineNum = index + 1;
+    if (upperLine.startsWith('FROM ')) {
+        processFromLine(trimmedLine, lineNum, state);
+    }
+    if (upperLine.startsWith('USER ')) {
+        processUserLine(trimmedLine, state);
+    }
+    if (upperLine.startsWith('HEALTHCHECK ')) {
+        state.hasHealthcheck = true;
+    }
+    if (NODE_ENV_PROD_PATTERN.test(safeDockerLine(trimmedLine))) {
+        state.hasNodeEnvProduction = true;
+    }
+    const secretViolation = checkForSecrets(trimmedLine, lineNum, file, filePath);
+    if (secretViolation)
+        violations.push(secretViolation);
+    if (upperLine.startsWith('RUN ')) {
+        processRunLine({ trimmedLine, lineNum, file, filePath, state, violations });
+    }
+    if (upperLine.startsWith('COPY ')) {
+        processCopyLine({ trimmedLine, lineNum, index, lines, file, filePath, state, violations });
+    }
+}
+// =============================================================================
+// CHECK DEFINITION
+// =============================================================================
+/**
+ * Check: architecture/docker-best-practices
+ *
+ * Validates Dockerfiles follow security and efficiency best practices:
+ * - Multi-stage builds
+ * - Non-root user
+ * - No hardcoded secrets
+ * - Frozen lockfiles for package managers
+ * - HEALTHCHECK instruction
+ * - Proper COPY order for layer caching
+ * - Production-only dependencies in runtime image (no devDependencies)
+ * - No build tools (pnpm, corepack) inherited in runtime stage
+ * - BuildKit cache mounts for package install commands
+ */
+export const dockerBestPractices = defineCheck({
+    id: '9870251d-6d3c-49b7-a680-864bc892b19e',
+    slug: 'docker-best-practices',
+    disabled: true,
+    scope: { languages: ['json', 'typescript', 'yaml'], concerns: ['config'] },
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Validate Dockerfiles follow security and efficiency best practices',
+    longDescription: `**Purpose:** Enforces security and efficiency best practices in Dockerfiles across the repository.
+
+**Detects:**
+- Hardcoded secrets (API keys, AWS credentials, passwords, JWT secrets, private keys)
+- Missing multi-stage builds, missing non-root \`USER\` directive, missing \`HEALTHCHECK\`
+- Package installs without \`--frozen-lockfile\` (pnpm/npm/yarn)
+- \`COPY .\` before dependency file copy (poor layer caching)
+- Missing BuildKit cache mounts on package installs
+- Runtime stage inheriting from build stage or copying \`node_modules\` without \`--prod\`
+
+**Why it matters:** Prevents security vulnerabilities (running as root, leaked secrets), non-reproducible builds, and bloated production images.
+
+**Scope:** General best practice. Analyzes each file individually.`,
+    tags: ['docker', 'security', 'best-practices', 'architecture'],
+    analyze(content, filePath) {
+        const file = path.relative(process.cwd(), filePath);
+        const violations = analyzeDockerfile(content, filePath, file);
+        return violations.map((violation) => ({
+            line: violation.line,
+            message: violation.message + (violation.suggestion ? ` (${violation.suggestion})` : ''),
+            severity: violation.severity,
+            suggestion: violation.suggestion ?? 'See Docker best practices documentation.',
+            match: violation.rule,
+            type: violation.rule,
+        }));
+    },
+});
+//# sourceMappingURL=docker-best-practices.js.map

package/dist/checks/architecture/docker-best-practices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-best-practices.js","sourceRoot":"","sources":["../../../src/checks/architecture/docker-best-practices.ts"],"names":[],"mappings":"AAAA,gJAAgJ;AAChJ,+HAA+H;AAC/H;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAkCxE,gFAAgF;AAChF,2DAA2D;AAC3D,gFAAgF;AAEhF,wDAAwD;AACxD,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC;;GAEG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,gFAAgF;IAChF,OAAO,IAAI,CAAC,MAAM,GAAG,0BAA0B;QAC7C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,yFAAyF;AACzF,MAAM,sBAAsB,GAC1B,sGAAsG,CAAC;AACzG,MAAM,kBAAkB,GACtB,mFAAmF,CAAC;AACtF,MAAM,qBAAqB,GACzB,4GAA4G,CAAC;AAC/G,MAAM,uBAAuB,GAC3B,qFAAqF,CAAC;AACxF,MAAM,0BAA0B,GAAG,2DAA2D,CAAC;AAC/F,MAAM,kBAAkB,GAAG,gDAAgD,CAAC;AAE5E,MAAM,eAAe,GAAG;IACtB,sBAAsB;IACtB,kBAAkB;IAClB,qBAAqB;IACrB,uBAAuB;IACvB,0BAA0B;IAC1B,kBAAkB;CACnB,CAAC;AAEF,mEAAmE;AACnE,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAChF,MAAM,mBAAmB,GACvB,0GAA0G,CAAC;AAC7G,MAAM,oBAAoB,GACxB,yEAAyE,CAAC;AAQ5E,MAAM,wBAAwB,GAA4B;IACxD,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE;IAC5E,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE;IACvE;QACE,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,kCAAkC;KACxC;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,oEAAoE,CAAC;AAEjG,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAE7D,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AACtD,MAAM,YAAY,GAAG,uDAAuD,CAAC;AAC7E,MAAM,yBAAyB,GAC7B,8EAA8E,CAAC;AACjF,MAAM,+BAA+B,GAAG,uDAAuD,CAAC;AAChG,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,YAAY,GAAG,0BAA0B,CAAC;AAChD,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAErE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzF,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,IAAI;gBACJ,QAAQ;gBACR,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,yCAAyC;gBAClD,QAAQ,EAAE,OAAO;gBACjB,UAAU,EACR,kFAAkF;aACrF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,IAAI,0BAA0B,GAAG,KAAK,CAAC;IACvC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEtC,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,wBAAwB,EAAE,CAAC;QACjE,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,0BAA0B,GAAG,IAAI,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,QAAQ;gBACR,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,OAAO,uCAAuC;gBAC1D,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,OAAO,GAAG,gCAAgC;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,iEAAiE;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;AACpD,CAAC;AAYD,SAAS,cAAc,CAAC,OAA8B;IACpD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAElF,iEAAiE;IACjE,2BAA2B;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAExD,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,yBAAyB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CACxD,CAAC;IAEF,IAAI,CAAC,kBAAkB,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACpD,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,wCAAwC;YACjD,QAAQ,EAAE,SAAS;YACnB,UAAU,EACR,8FAA8F;SACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,8CAA8C;YACvD,QAAQ,EAAE,SAAS;YACnB,UAAU,EACR,8GAA8G;SACjH,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe,EAAE,KAAoB;IAC1E,KAAK,CAAC,SAAS,EAAE,CAAC;IAClB,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC;IAC7B,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrC,IAAI,SAAS;QAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;IAEzD,wCAAwC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,KAAK,CAAC,oBAAoB,GAAG,SAAS,CAAC;QACvC,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC;QAE/B,2EAA2E;QAC3E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/C,KAAK,CAAC,wBAAwB,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,IAAY,EACZ,QAAgB,EAChB,SAAiB,EACjB,KAAoB;IAEpB,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;IAE3C,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,CAAC;YACP,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,2CAA2C;YACpD,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,sFAAsF;SACzF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,6CAA6C;YACtD,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAA,oHAAoH;SAC3I,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,uDAAuD;YAChE,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,+DAA+D;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,MAAM,cAAc,GAAG,KAAK,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;IAC7E,IAAI,cAAc,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8CAA8C;YACvD,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,2EAA2E;SACxF,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAClE,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,qBAAqB;YACjC,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,iFAAiF;YAC1F,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,4IAA4I;SAC/I,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,cAAc;YAC1B,IAAI,EAAE,0BAA0B;YAChC,OAAO,EACL,+FAA+F;YACjG,QAAQ,EAAE,SAAS;YACnB,UAAU,EACR,8GAA8G;SACjH,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AACD,oBAAoB;AAEpB,SAAS,iBAAiB,CAAC,OAAe,EAAE,QAAgB,EAAE,IAAY;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAA0B,EAAE,CAAC;IAE7C,MAAM,KAAK,GAAkB;QAC3B,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,KAAK;QAC3B,qBAAqB,EAAE,KAAK;QAC5B,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,IAAI;QAC1B,YAAY,EAAE,CAAC;QACf,UAAU,EAAE,EAAE;QACd,uBAAuB,EAAE,KAAK;QAC9B,qBAAqB,EAAE,CAAC;QACxB,wBAAwB,EAAE,KAAK;QAC/B,cAAc,EAAE,CAAC;KAClB,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,qBAAqB,CAAC;YACpB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACd,KAAK,EAAE,CAAC;YACR,KAAK;YACL,KAAK;YACL,UAAU;YACV,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,UAAU,CAAC,IAAI,CAAC,GAAG,gCAAgC,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAE1F,OAAO,UAAU,CAAC;AACpB,CAAC;AAYD,SAAS,eAAe,CAAC,WAAmB,EAAE,KAAoB;IAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9C,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;IAC9B,CAAC;AACH,CAAC;AAWD,SAAS,cAAc,CAAC,OAA8B;IACpD,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC5E,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxE,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,SAAS,CAAC,0BAA0B;QAAE,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;IAE1E,MAAM,mBAAmB,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClF,IAAI,mBAAmB;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE9D,IAAI,sBAAsB,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,CAAC;AACH,CAAC;AAaD,SAAS,eAAe,CAAC,OAA+B;IACtD,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC1F,MAAM,aAAa,GAAG,cAAc,CAAC;QACnC,IAAI,EAAE,WAAW;QACjB,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;IACH,IAAI,aAAa;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,KAAK,CAAC,eAAe,IAAI,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC/F,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,qBAAqB,GAAG,OAAO,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAqC;IAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC1E,yEAAyE;IACzE,MAAM,WAAW,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAExD,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC;IAE1B,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACpC,CAAC;IAED,MAAM,eAAe,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9E,IAAI,eAAe;QAAE,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAEtD,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,cAAc,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,eAAe,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1E,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,oEAAoE;IACjF,eAAe,EAAE;;;;;;;;;;;;mEAYgD;IACjE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,CAAC;IAE9D,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE9D,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,OAAO,EAAE,SAAS,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,0CAA0C;YAC9E,KAAK,EAAE,SAAS,CAAC,IAAI;YACrB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/docker-ignore-validation.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Docker .dockerignore validation fitness check
+ * @invariants
+ * - Every Dockerfile directory must have a .dockerignore file
+ * - .dockerignore must include .git pattern
+ * - Node-based Dockerfiles must also include node_modules pattern
+ */
+/**
+ * Check: architecture/docker-ignore-validation
+ *
+ * Validates that every Dockerfile has a corresponding .dockerignore with required patterns:
+ * 1. .git — always required
+ * 2. node_modules — required for Node-based Dockerfiles
+ *
+ * @throws {Error} When a .dockerignore file exceeds 10MB
+ */
+export declare const dockerIgnoreValidation: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=docker-ignore-validation.d.ts.map

package/dist/checks/architecture/docker-ignore-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-ignore-validation.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/docker-ignore-validation.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAsCH;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,sCA+EjC,CAAC"}

package/dist/checks/architecture/docker-ignore-validation.js

@@ -0,0 +1,117 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collections (config entries, registry items, or small analysis results)
+// @fitness-ignore-file fitness-check-standards -- Uses fs for .dockerignore reading, not source file content
+/**
+ * @fileoverview Docker .dockerignore validation fitness check
+ * @invariants
+ * - Every Dockerfile directory must have a .dockerignore file
+ * - .dockerignore must include .git pattern
+ * - Node-based Dockerfiles must also include node_modules pattern
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { defineCheck } from '@opensip-cli/fitness';
+// =============================================================================
+// REGEX PATTERNS
+// =============================================================================
+/** Matches FROM node:XX or FROM node:XX-alpine etc. */
+const FROM_NODE_PATTERN = /^FROM\s+node:/im;
+// =============================================================================
+// HELPERS
+// =============================================================================
+/**
+ * Check if a .dockerignore file contains a required pattern.
+ * Matches exact lines (trimmed), not substrings.
+ */
+function hasPattern(dockerignoreContent, pattern) {
+    const lines = dockerignoreContent.split('\n').map((l) => l.trim());
+    return lines.includes(pattern);
+}
+/**
+ * Determine if a Dockerfile is Node-based by checking for FROM node: directives.
+ */
+function isNodeDockerfile(content) {
+    return FROM_NODE_PATTERN.test(content);
+}
+// =============================================================================
+// CHECK DEFINITION
+// =============================================================================
+/**
+ * Check: architecture/docker-ignore-validation
+ *
+ * Validates that every Dockerfile has a corresponding .dockerignore with required patterns:
+ * 1. .git — always required
+ * 2. node_modules — required for Node-based Dockerfiles
+ *
+ * @throws {Error} When a .dockerignore file exceeds 10MB
+ */
+export const dockerIgnoreValidation = defineCheck({
+    id: '70123fbb-c538-4186-a82e-fdb5e53d52d7',
+    slug: 'docker-ignore-validation',
+    disabled: true,
+    scope: { languages: ['json', 'typescript', 'yaml'], concerns: ['config'] },
+    contentFilter: 'raw',
+    confidence: 'medium',
+    description: 'Validate .dockerignore files exist alongside Dockerfiles with required patterns',
+    longDescription: `**Purpose:** Ensures every Dockerfile has a corresponding \`.dockerignore\` with required exclusion patterns to keep build contexts small and secure.
+
+**Detects:**
+- Missing \`.dockerignore\` file in the same directory as a Dockerfile
+- \`.dockerignore\` missing the \`.git\` pattern (always required)
+- \`.dockerignore\` missing the \`node_modules\` pattern for Node-based Dockerfiles (detected via \`FROM node:\` directives)
+
+**Why it matters:** Without proper \`.dockerignore\` files, Docker build contexts include unnecessary files (.git history, node_modules), causing slow builds and potential secret leaks.
+
+**Scope:** General best practice. Cross-file analysis via \`analyzeAll\`.`,
+    tags: ['docker', 'dockerignore', 'architecture'],
+    /** @throws {Error} When file system operations fail */
+    async analyzeAll(files) {
+        const violations = [];
+        for (const filePath of files.paths) {
+            const dockerfileDir = path.dirname(filePath);
+            const dockerignorePath = path.join(dockerfileDir, '.dockerignore');
+            const relPath = path.relative(process.cwd(), filePath);
+            // Check if .dockerignore exists
+            if (!fs.existsSync(dockerignorePath)) {
+                violations.push({
+                    line: 1,
+                    filePath,
+                    message: `No .dockerignore found alongside ${relPath}`,
+                    severity: 'warning',
+                    suggestion: `Create a .dockerignore file in ${path.relative(process.cwd(), dockerfileDir)} with at least .git pattern`,
+                    type: 'missing-dockerignore',
+                });
+                continue;
+            }
+            // Read .dockerignore and validate required patterns
+            const dockerignoreStats = fs.statSync(dockerignorePath);
+            if (dockerignoreStats.size > 10_000_000)
+                throw new Error(`File too large: ${dockerignorePath}`);
+            const dockerignoreContent = fs.readFileSync(dockerignorePath, 'utf8');
+            const content = await files.read(filePath);
+            // .git is always required
+            if (!hasPattern(dockerignoreContent, '.git')) {
+                violations.push({
+                    line: 1,
+                    filePath,
+                    message: `.dockerignore for ${relPath} is missing required pattern: .git`,
+                    severity: 'warning',
+                    suggestion: 'Add .git to .dockerignore to exclude version control data from build context',
+                    type: 'missing-pattern',
+                });
+            }
+            // node_modules is required for Node-based Dockerfiles
+            if (isNodeDockerfile(content) && !hasPattern(dockerignoreContent, 'node_modules')) {
+                violations.push({
+                    line: 1,
+                    filePath,
+                    message: `.dockerignore for ${relPath} is missing required pattern: node_modules`,
+                    severity: 'warning',
+                    suggestion: 'Add node_modules to .dockerignore to exclude local dependencies from build context',
+                    type: 'missing-pattern',
+                });
+            }
+        }
+        return violations;
+    },
+});
+//# sourceMappingURL=docker-ignore-validation.js.map

package/dist/checks/architecture/docker-ignore-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-ignore-validation.js","sourceRoot":"","sources":["../../../src/checks/architecture/docker-ignore-validation.ts"],"names":[],"mappings":"AAAA,0IAA0I;AAC1I,6GAA6G;AAC7G;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAE3F,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,uDAAuD;AACvD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,UAAU,CAAC,mBAA2B,EAAE,OAAe;IAC9D,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,0BAA0B;IAChC,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1E,aAAa,EAAE,KAAK;IAEpB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,iFAAiF;IAC9F,eAAe,EAAE;;;;;;;;;0EASuD;IACxE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC;IAEhD,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,KAAmB;QAClC,MAAM,UAAU,GAAqB,EAAE,CAAC;QAExC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEvD,gCAAgC;YAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,CAAC;oBACP,QAAQ;oBACR,OAAO,EAAE,oCAAoC,OAAO,EAAE;oBACtD,QAAQ,EAAE,SAAS;oBACnB,UAAU,EAAE,kCAAkC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,6BAA6B;oBACtH,IAAI,EAAE,sBAAsB;iBAC7B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,oDAAoD;YACpD,MAAM,iBAAiB,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,iBAAiB,CAAC,IAAI,GAAG,UAAU;gBACrC,MAAM,IAAI,KAAK,CAAC,mBAAmB,gBAAgB,EAAE,CAAC,CAAC;YACzD,MAAM,mBAAmB,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3C,0BAA0B;YAC1B,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC7C,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,CAAC;oBACP,QAAQ;oBACR,OAAO,EAAE,qBAAqB,OAAO,oCAAoC;oBACzE,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,8EAA8E;oBAChF,IAAI,EAAE,iBAAiB;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,sDAAsD;YACtD,IAAI,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,cAAc,CAAC,EAAE,CAAC;gBAClF,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,CAAC;oBACP,QAAQ;oBACR,OAAO,EAAE,qBAAqB,OAAO,4CAA4C;oBACjF,QAAQ,EAAE,SAAS;oBACnB,UAAU,EACR,oFAAoF;oBACtF,IAAI,EAAE,iBAAiB;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC,CAAC"}

package/dist/checks/architecture/docker-version-sync.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @fileoverview Docker version sync fitness check
+ * @invariants
+ * - Node major version in FROM directives must match engines.node from root package.json
+ * - pnpm version should be derived dynamically from package.json packageManager field
+ * - Hardcoded pnpm versions that don't match packageManager are errors
+ */
+/**
+ * Check: architecture/docker-version-sync
+ *
+ * Validates that Dockerfiles keep Node and pnpm versions in sync with package.json:
+ * 1. FROM node:XX major version matches engines.node
+ * 2. pnpm version is either dynamically derived (preferred) or hardcoded consistently
+ */
+export declare const dockerVersionSync: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=docker-version-sync.d.ts.map

package/dist/checks/architecture/docker-version-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-version-sync.d.ts","sourceRoot":"","sources":["../../../src/checks/architecture/docker-version-sync.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AA8LH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,sCAkD5B,CAAC"}