@orionscanner/cli 0.1.0

package/src/orion/engine/config_engine/engine.py

@@ -0,0 +1,364 @@
+"""Config validation engine for YAML, JSON, TOML, .env, .ini, .properties, Python config files."""
+import ast
+import json
+import re
+import tomllib
+from pathlib import Path
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "config_engine"
+    version = "1.0.0"
+
+    REQUIRED_KEYS = {
+        "DATABASE_URL", "SECRET_KEY", "JWT_SECRET", "API_KEY",
+        "REDIS_URL", "CELERY_BROKER_URL", "POSTGRES_URL", "MYSQL_URL",
+        "MONGODB_URI", "RABBITMQ_URL", "KAFKA_BOOTSTRAP_SERVERS",
+        "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "GOOGLE_API_KEY",
+        "STRIPE_SECRET_KEY", "SENDGRID_API_KEY", "TWILIO_AUTH_TOKEN"
+    }
+
+    TYPE_HINTS = {
+        "port": int, "PORT": int, "port_number": int,
+        "debug": bool, "DEBUG": bool, "verbose": bool,
+        "hosts": list, "HOSTS": list, "servers": list, "allowed_hosts": list,
+        "timeout": (int, float), "TIMEOUT": (int, float),
+        "retries": int, "RETRIES": int, "max_retries": int,
+        "workers": int, "WORKERS": int,
+    }
+
+    PLACEHOLDER_PATTERNS = [
+        r"changeme", r"your_.*_here", r"TODO", r"FIXME", r"xxx+",
+        r"replace_me", r"insert_.*_here", r"<.*>", r"\{\{.*\}\}",
+        r"your-.*-here", r"example\.com", r"localhost", r"127\.0\.0\.1"
+    ]
+
+    SENSITIVE_KEYS = {
+        "SECRET_KEY", "JWT_SECRET", "API_KEY", "PASSWORD", "TOKEN",
+        "PRIVATE_KEY", "ACCESS_TOKEN", "REFRESH_TOKEN", "CREDENTIALS"
+    }
+
+    def __init__(self):
+        self._placeholder_regex = [re.compile(p, re.IGNORECASE) for p in self.PLACEHOLDER_PATTERNS]
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    def _is_config_file(self, filename: str, ext: str) -> bool:
+        if ext in (".yaml", ".yml", ".json", ".toml", ".env", ".ini", ".cfg", ".conf", ".properties"):
+            return True
+        if ext == ".py":
+            name = filename.lower()
+            return any(k in name for k in ("config", "settings", "conf", "env", "secret", "options"))
+        return False
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        path = ir.metadata.get("path", "unknown")
+        filename = Path(path).name.lower()
+        ext = Path(path).suffix.lower()
+
+        if not self._is_config_file(filename, ext):
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        findings = []
+        parsed = self._parse_config(text, filename, ext, path)
+
+        if parsed:
+            findings.extend(self._validate_config(parsed, path, filename, ext, config))
+            findings.extend(self._check_secrets_in_config(parsed, path, filename, ext))
+            findings.extend(self._check_duplicates(parsed, path, filename))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _parse_config(self, text: str, filename: str, ext: str, path: str) -> dict | None:
+        try:
+            if ext in (".yaml", ".yml"):
+                import yaml
+                return yaml.safe_load(text) or {}
+            elif ext == ".json":
+                return json.loads(text) or {}
+            elif ext == ".toml":
+                return tomllib.loads(text) or {}
+            elif ext in (".env",) or filename.startswith(".env"):
+                return self._parse_env(text)
+            elif ext in (".ini", ".cfg", ".conf"):
+                return self._parse_ini(text)
+            elif ext == ".properties":
+                return self._parse_properties(text)
+            elif ext == ".py" and self._is_config_file(filename, ext):
+                return self._parse_python_config(text, path)
+        except Exception:
+            pass
+        return None
+
+    def _parse_env(self, text: str) -> dict:
+        result = {}
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#"):
+                continue
+            if "=" in line:
+                key, value = line.split("=", 1)
+                result[key.strip()] = value.strip().strip('"\'')
+        return result
+
+    def _parse_ini(self, text: str) -> dict:
+        import configparser
+        parser = configparser.ConfigParser()
+        parser.read_string(text)
+        result = {}
+        for section in parser.sections():
+            for key, value in parser[section].items():
+                result[f"{section}.{key}"] = value
+        return result
+
+    def _parse_properties(self, text: str) -> dict:
+        result = {}
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or line.startswith("!"):
+                continue
+            if "=" in line:
+                key, value = line.split("=", 1)
+                result[key.strip()] = value.strip()
+            elif ":" in line:
+                key, value = line.split(":", 1)
+                result[key.strip()] = value.strip()
+        return result
+
+    def _parse_python_config(self, text: str, path: str) -> dict:
+        result = {}
+        try:
+            tree = ast.parse(text, filename=path)
+            for node in ast.walk(tree):
+                if isinstance(node, ast.Assign):
+                    for target in node.targets:
+                        if isinstance(target, ast.Name) and (target.id.isupper() or "_" in target.id):
+                            value = self._extract_value(node.value)
+                            if value is not None:
+                                result[target.id] = value
+        except Exception:
+            pass
+        return result
+
+    def _extract_value(self, node: ast.AST):
+        if isinstance(node, ast.Constant):
+            return node.value
+        elif isinstance(node, ast.List):
+            return [self._extract_value(e) for e in node.elts]
+        elif isinstance(node, ast.Dict):
+            return {self._extract_value(k): self._extract_value(v) for k, v in zip(node.keys, node.values)}
+        elif isinstance(node, ast.Tuple):
+            return tuple(self._extract_value(e) for e in node.elts)
+        return None
+
+    def _validate_config(self, config: dict, path: str, filename: str, ext: str, engine_config: EngineConfig) -> list[Finding]:
+        findings = []
+        flat = self._flatten_config(config)
+
+        # Check explicitly configured required keys
+        required_keys = engine_config.toggles.get("required_config_keys", [])
+        for key in required_keys:
+            if key not in flat and key.lower() not in {k.lower() for k in flat}:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="high",
+                    title=f"Required config key missing: {key}",
+                    description=f"Expected configuration key '{key}' not found",
+                    location=path,
+                    metadata={
+                        "confidence": 0.85,
+                        "key": key,
+                        "expected_type": "str",
+                        "issue": "missing",
+                        "cwe": "CWE-256",
+                    },
+                ))
+
+        for key, value in flat.items():
+            if isinstance(value, str):
+                for pattern in self._placeholder_regex:
+                    if pattern.search(value):
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="high",
+                            title=f"Placeholder value in config: {key}",
+                            description=f"Config value appears to be a placeholder: {value[:50]}",
+                            location=path,
+                            metadata={
+                                "confidence": 0.9,
+                                "key": key,
+                                "issue": "placeholder_value",
+                                "value": value[:100],
+                                "cwe": "CWE-256",
+                            },
+                        ))
+                        break
+
+                if self._looks_like_secret(key, value) and ext not in (".env",):
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="critical",
+                        title=f"Secret in non-.env config file: {key}",
+                        description=f"Sensitive value found in {ext} file (should be in .env)",
+                        location=path,
+                        metadata={
+                            "confidence": 0.95,
+                            "key": key,
+                            "issue": "secret_in_config",
+                            "cwe": "CWE-798",
+                        },
+                    ))
+
+            expected_type = self.TYPE_HINTS.get(key)
+            if expected_type and not self._type_matches(value, expected_type):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title=f"Config type mismatch: {key}",
+                    description=f"Expected {expected_type.__name__ if hasattr(expected_type, '__name__') else expected_type}, got {type(value).__name__}",
+                    location=path,
+                    metadata={
+                        "confidence": 0.8,
+                        "key": key,
+                        "expected_type": str(expected_type),
+                        "actual_type": type(value).__name__,
+                        "issue": "type_mismatch",
+                        "cwe": "CWE-704",
+                    },
+                ))
+
+            if key.lower() in ("url", "endpoint", "uri") and isinstance(value, str):
+                if not self._is_valid_url(value):
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"Invalid URL format: {key}",
+                        description=f"Config value does not appear to be a valid URL: {value[:50]}",
+                        location=path,
+                        metadata={
+                            "confidence": 0.75,
+                            "key": key,
+                            "issue": "invalid_url",
+                            "value": value[:100],
+                        },
+                    ))
+
+            if key.lower() in ("email", "mail") and isinstance(value, str):
+                if not self._is_valid_email(value):
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"Invalid email format: {key}",
+                        description=f"Config value does not appear to be a valid email: {value[:50]}",
+                        location=path,
+                        metadata={
+                            "confidence": 0.75,
+                            "key": key,
+                            "issue": "invalid_email",
+                            "value": value[:100],
+                        },
+                    ))
+
+        return findings
+
+    def _check_secrets_in_config(self, config: dict, path: str, filename: str, ext: str) -> list[Finding]:
+        findings = []
+        flat = self._flatten_config(config)
+
+        for key, value in flat.items():
+            if isinstance(value, str) and self._looks_like_secret(key, value):
+                if ext not in (".env",) or "example" in filename or "template" in filename or "sample" in filename:
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="critical" if ext not in (".env",) else "high",
+                        title=f"Potential secret in config: {key}",
+                        description=f"Value for '{key}' matches secret patterns",
+                        location=path,
+                        metadata={
+                            "confidence": 0.85,
+                            "key": key,
+                            "issue": "potential_secret",
+                            "cwe": "CWE-798",
+                        },
+                    ))
+        return findings
+
+    def _check_duplicates(self, config: dict, path: str, filename: str) -> list[Finding]:
+        findings = []
+        flat = self._flatten_config(config)
+        seen = {}
+        for key in flat:
+            lower_key = key.lower()
+            if lower_key in seen:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title=f"Duplicate config key (case-insensitive): {key}",
+                    description=f"Key '{key}' duplicates '{seen[lower_key]}' (case-insensitive)",
+                    location=path,
+                    metadata={
+                        "confidence": 0.9,
+                        "key": key,
+                        "duplicate_of": seen[lower_key],
+                        "issue": "duplicate_key",
+                    },
+                ))
+            else:
+                seen[lower_key] = key
+        return findings
+
+    def _flatten_config(self, config: dict, prefix: str = "") -> dict:
+        result = {}
+        for key, value in config.items():
+            full_key = f"{prefix}.{key}" if prefix else key
+            if isinstance(value, dict):
+                result.update(self._flatten_config(value, full_key))
+            else:
+                result[full_key] = value
+        return result
+
+    def _type_matches(self, value, expected_type) -> bool:
+        if isinstance(expected_type, tuple):
+            return isinstance(value, expected_type)
+        if expected_type == int:
+            return isinstance(value, int) and not isinstance(value, bool)
+        if expected_type == bool:
+            return isinstance(value, bool)
+        if expected_type == list:
+            return isinstance(value, list)
+        if expected_type == float:
+            return isinstance(value, (int, float))
+        return isinstance(value, expected_type)
+
+    def _looks_like_secret(self, key: str, value: str) -> bool:
+        key_upper = key.upper()
+        if any(sk in key_upper for sk in self.SENSITIVE_KEYS):
+            if len(value) >= 16 and not value.startswith("${") and not value.startswith("{{"):
+                return True
+        return False
+
+    def _is_valid_url(self, url: str) -> bool:
+        url_pattern = re.compile(
+            r'^(https?|ftp|postgres|mysql|redis|mongodb|amqp|kafka)://'
+            r'(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+[A-Z]{2,6}\.?|'
+            r'localhost|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
+            r'(?::\d+)?'
+            r'(?:/?|[/?]\S+)$', re.IGNORECASE)
+        return bool(url_pattern.match(url))
+
+    def _is_valid_email(self, email: str) -> bool:
+        email_pattern = re.compile(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$')
+        return bool(email_pattern.match(email))

package/src/orion/engine/config_validation/engine.py

@@ -0,0 +1,313 @@
+"""Orion config self-validation engine - validates EngineConfig passed to run."""
+import re
+import os
+from pathlib import Path
+from typing import Dict, List, Any, Optional
+
+from orion.engine.config import EngineConfig, ResourceLimits, NetworkPolicy
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class ConfigValidationEngine:
+    name = "config_validation"
+    version = "1.0.0"
+
+    ALLOWED_OUTPUT_FORMATS = {"json", "sarif", "text", "html", "markdown", "csv"}
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=5, max_memory_mb=32)
+
+    def _validate_project_path(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        project_path = config.toggles.get("project_path")
+        if not project_path:
+            findings.append(Finding(
+                engine=self.name,
+                severity="error",
+                title="Missing project_path in config",
+                description="EngineConfig.toggles must contain 'project_path'",
+                location="config.toggles.project_path",
+                metadata={"rule": "missing_project_path"},
+            ))
+        else:
+            path = Path(project_path)
+            if not path.exists():
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title=f"Project path does not exist: {project_path}",
+                    description="The specified project_path does not exist on filesystem",
+                    location="config.toggles.project_path",
+                    metadata={"rule": "project_path_not_found", "path": project_path},
+                ))
+            elif not path.is_dir():
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title=f"Project path is not a directory: {project_path}",
+                    description="project_path must be a directory",
+                    location="config.toggles.project_path",
+                    metadata={"rule": "project_path_not_dir", "path": project_path},
+                ))
+        return findings
+
+    def _validate_exclude_patterns(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        exclude = config.toggles.get("exclude", [])
+        if not isinstance(exclude, list):
+            findings.append(Finding(
+                engine=self.name,
+                severity="error",
+                title="Invalid exclude configuration",
+                description="config.toggles.exclude must be a list of glob patterns",
+                location="config.toggles.exclude",
+                metadata={"rule": "exclude_not_list"},
+            ))
+            return findings
+
+        for i, pattern in enumerate(exclude):
+            if not isinstance(pattern, str):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title=f"Exclude pattern {i} is not a string",
+                    description="All exclude patterns must be strings",
+                    location=f"config.toggles.exclude[{i}]",
+                    metadata={"rule": "exclude_pattern_not_string", "index": i},
+                ))
+                continue
+
+            # Test if pattern is valid glob
+            try:
+                # Try to compile as a test
+                Path("test").match(pattern)
+            except Exception as e:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="warning",
+                    title=f"Exclude pattern {i} may be invalid: {pattern}",
+                    description=f"Glob pattern validation failed: {e}",
+                    location=f"config.toggles.exclude[{i}]",
+                    metadata={"rule": "exclude_pattern_invalid", "index": i, "pattern": pattern, "error": str(e)},
+                ))
+        return findings
+
+    def _validate_resource_limits(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        rl = config.resource_limits or {}
+
+        # max_memory_mb
+        memory = rl.get("max_memory_mb")
+        if memory is not None:
+            if not isinstance(memory, int) or memory <= 0:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title="Invalid max_memory_mb",
+                    description="resource_limits.max_memory_mb must be a positive integer",
+                    location="config.resource_limits.max_memory_mb",
+                    metadata={"rule": "invalid_max_memory", "value": memory},
+                ))
+
+        # max_cpu_seconds
+        cpu = rl.get("max_cpu_seconds")
+        if cpu is not None:
+            if not isinstance(cpu, int) or cpu <= 0:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title="Invalid max_cpu_seconds",
+                    description="resource_limits.max_cpu_seconds must be a positive integer",
+                    location="config.resource_limits.max_cpu_seconds",
+                    metadata={"rule": "invalid_max_cpu", "value": cpu},
+                ))
+
+        # max_file_size_mb
+        file_size = rl.get("max_file_size_mb")
+        if file_size is not None:
+            if not isinstance(file_size, int) or file_size <= 0:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title="Invalid max_file_size_mb",
+                    description="resource_limits.max_file_size_mb must be a positive integer",
+                    location="config.resource_limits.max_file_size_mb",
+                    metadata={"rule": "invalid_max_file_size", "value": file_size},
+                ))
+
+        return findings
+
+    def _validate_network_policy(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        np = config.network_policy or {}
+
+        allow_outbound = np.get("allow_outbound")
+        if allow_outbound is not None and not isinstance(allow_outbound, bool):
+            findings.append(Finding(
+                engine=self.name,
+                severity="error",
+                title="Invalid network_policy.allow_outbound",
+                description="network_policy.allow_outbound must be a boolean",
+                location="config.network_policy.allow_outbound",
+                metadata={"rule": "invalid_allow_outbound", "value": allow_outbound},
+            ))
+
+        allowed_hosts = np.get("allowed_hosts", [])
+        if not isinstance(allowed_hosts, list):
+            findings.append(Finding(
+                engine=self.name,
+                severity="error",
+                title="Invalid network_policy.allowed_hosts",
+                description="network_policy.allowed_hosts must be a list",
+                location="config.network_policy.allowed_hosts",
+                metadata={"rule": "invalid_allowed_hosts_type"},
+            ))
+        else:
+            for i, host in enumerate(allowed_hosts):
+                if not isinstance(host, str):
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="error",
+                        title=f"allowed_hosts[{i}] is not a string",
+                        description="All allowed_hosts entries must be strings",
+                        location=f"config.network_policy.allowed_hosts[{i}]",
+                        metadata={"rule": "allowed_host_not_string", "index": i},
+                    ))
+
+        # Check if allow_outbound=False but allowed_hosts is not empty (contradiction)
+        if allow_outbound is False and allowed_hosts:
+            findings.append(Finding(
+                engine=self.name,
+                severity="warning",
+                title="network_policy.allow_outbound is false but allowed_hosts is not empty",
+                description="allowed_hosts will be ignored when allow_outbound is false",
+                location="config.network_policy",
+                metadata={"rule": "network_policy_contradiction"},
+            ))
+
+        return findings
+
+    def _validate_parallelism(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        parallelism = config.toggles.get("parallelism")
+        if parallelism is not None:
+            if not isinstance(parallelism, int) or parallelism <= 0:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title="Invalid parallelism",
+                    description="parallelism must be a positive integer",
+                    location="config.toggles.parallelism",
+                    metadata={"rule": "invalid_parallelism", "value": parallelism},
+                ))
+            else:
+                # Check against CPU count
+                try:
+                    cpu_count = os.cpu_count() or 1
+                    if parallelism > cpu_count * 2:
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="warning",
+                            title=f"parallelism ({parallelism}) exceeds 2x CPU count ({cpu_count})",
+                            description="High parallelism may cause resource contention",
+                            location="config.toggles.parallelism",
+                            metadata={"rule": "parallelism_high", "parallelism": parallelism, "cpu_count": cpu_count},
+                        ))
+                except Exception:
+                    pass
+        return findings
+
+    def _validate_timeout(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        timeout = config.toggles.get("timeout")
+        if timeout is not None:
+            if not isinstance(timeout, (int, float)) or timeout <= 0:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title="Invalid timeout",
+                    description="timeout must be a positive number",
+                    location="config.toggles.timeout",
+                    metadata={"rule": "invalid_timeout", "value": timeout},
+                ))
+        return findings
+
+    def _validate_output_format(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        output_format = config.toggles.get("output_format")
+        if output_format is not None:
+            if not isinstance(output_format, str):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="error",
+                    title="Invalid output_format",
+                    description="output_format must be a string",
+                    location="config.toggles.output_format",
+                    metadata={"rule": "invalid_output_format_type"},
+                ))
+            elif output_format not in self.ALLOWED_OUTPUT_FORMATS:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="warning",
+                    title=f"Unknown output_format: {output_format}",
+                    description=f"Allowed formats: {', '.join(sorted(self.ALLOWED_OUTPUT_FORMATS))}",
+                    location="config.toggles.output_format",
+                    metadata={"rule": "unknown_output_format", "value": output_format, "allowed": list(self.ALLOWED_OUTPUT_FORMATS)},
+                ))
+        return findings
+
+    def _validate_engine_toggles(self, config: EngineConfig) -> List[Finding]:
+        findings = []
+        # Check for unknown engine toggles
+        known_toggles = {
+            "project_path", "exclude", "parallelism", "timeout", "output_format",
+            "fail_on_severity", "include_tests", "include_generated",
+        }
+        for key in config.toggles:
+            if key not in known_toggles and not key.startswith("_"):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="warning",
+                    title=f"Unknown config toggle: {key}",
+                    description=f"Toggle '{key}' is not a recognized Orion configuration option",
+                    location=f"config.toggles.{key}",
+                    metadata={"rule": "unknown_toggle", "toggle": key},
+                ))
+        return findings
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        all_findings = []
+
+        # Run all validations
+        all_findings.extend(self._validate_project_path(config))
+        all_findings.extend(self._validate_exclude_patterns(config))
+        all_findings.extend(self._validate_resource_limits(config))
+        all_findings.extend(self._validate_network_policy(config))
+        all_findings.extend(self._validate_parallelism(config))
+        all_findings.extend(self._validate_timeout(config))
+        all_findings.extend(self._validate_output_format(config))
+        all_findings.extend(self._validate_engine_toggles(config))
+
+        # Count errors and warnings
+        errors = sum(1 for f in all_findings if f.severity == "error")
+        warnings = sum(1 for f in all_findings if f.severity == "warning")
+
+        return EngineResult(
+            engine=self.name,
+            findings=all_findings,
+            ok=errors == 0,
+            metrics={
+                "validations_run": 7,
+                "errors": errors,
+                "warnings": warnings,
+                "total_findings": len(all_findings),
+            },
+        )
+
+
+Engine = ConfigValidationEngine