@produtype/core 1.18.0 → 1.20.0

package/dist/analyzer/detectObservability.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 /**
  * Logging packages, which the ecosystem names and the author does not.
  *
@@ -78,7 +79,42 @@ async function detectObservability(ctx) {
     const actuator = (0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-actuator']);
     for (const dep of actuator)
         evidence.push({ type: 'dependency', value: dep, claim: 'health' });
-    const hasHealth = healthFiles.length > 0
+    /**
+     * The probe a platform declares, which is the operator's half of the same answer.
+     *
+     * immich declares `healthcheck:` for its services in all four of its compose files
+     * and was told it has no health endpoint. Something is being probed — that is what
+     * the key means — and the endpoint it probes is inside the image, where no text
+     * search here will find it.
+     *
+     * `HEALTHCHECK` is Docker's instruction, `healthcheck:` is compose's key, and
+     * `livenessProbe:` and `readinessProbe:` are Kubernetes' field names. None is the
+     * author's word, and each one is a statement that this service answers a health
+     * question.
+     *
+     * `disable: true` is the one that says the opposite — compose's way of switching
+     * off an image's own check — so a block carrying it is not counted.
+     */
+    const deploymentManifests = ctx.files.all.filter((file) => /(^|\/)(docker-compose[\w.-]*\.ya?ml|compose[\w.-]*\.ya?ml|Dockerfile[\w.-]*)$/.test(file)
+        || /(^|\/)(k8s|kubernetes|helm|deploy|charts)\/.*\.ya?ml$/i.test(file)).slice(0, 12);
+    const declaredProbes = [];
+    for (const file of deploymentManifests) {
+        const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        const lines = text.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            if (!/^\s*(?:HEALTHCHECK\s|healthcheck\s*:|livenessProbe\s*:|readinessProbe\s*:)/.test(lines[i]))
+                continue;
+            /** compose writes `healthcheck:` then `disable: true` to switch the image's own off. */
+            if (lines.slice(i + 1, i + 3).some((line) => /^\s*disable\s*:\s*true/.test(line)))
+                continue;
+            declaredProbes.push({ type: 'snippet', value: lines[i].trim().slice(0, 200), file, line: i + 1, claim: 'health' });
+            break;
+        }
+    }
+    for (const probe of declaredProbes.slice(0, 3))
+        evidence.push(probe);
+    const hasHealth = declaredProbes.length > 0
+        || healthFiles.length > 0
         || actuator.length > 0
         || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
@@ -146,7 +182,7 @@ async function detectObservability(ctx) {
     const hasStructuredLogging = logDeps.length > 0 || structuredHits.length > 0;
     const hasAnyLogging = hasStructuredLogging || plainLogging.length > 0;
     if (!hasHealth) {
-        evidence.push(...(0, absenceEvidence_1.searchedFor)('a health endpoint', ['/health', '/healthz', '/readyz', 'a health, healthz, readyz, liveness or readiness route file'], 'health'));
+        evidence.push(...(0, absenceEvidence_1.searchedFor)('a health endpoint', ['/health', '/healthz', '/readyz', 'a health, healthz, readyz, liveness or readiness route file', 'a HEALTHCHECK, a compose healthcheck or a Kubernetes liveness probe'], 'health'));
     }
     if (!hasAnyLogging) {
         evidence.push(...(0, absenceEvidence_1.searchedFor)('logging', ['winston', 'pino', 'morgan', 'bunyan', 'Monolog', 'slog', 'zap', 'logrus', 'slf4j', 'Rails.logger', 'tracing::', 'logger.info/warn/error/debug', 'Logger.info', 'error_log(', 'JSON.stringify with a level field'], 'logging'));

package/dist/utils/textSearch.js

@@ -26,6 +26,26 @@ const blockComments_1 = require("../analyzer/blockComments");
  * and is left alone.
  */
 const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\\.)+\/[gimsuy]*\s*[,;]?$/;
+/**
+ * A header name on a line of its own says which header, not what value.
+ *
+ * saleor's ASGI handler writes the response headers as a list of tuples, so
+ * `b"access-control-allow-origin",` sits alone on line 50 and the origin it will
+ * carry is on line 51. Saleor only appends that pair when the caller's origin matched
+ * its allowlist, and answers 400 when it did not — a strict policy, reported at
+ * `high` as one with no restrictions, on the strength of a line that cannot show a
+ * policy because there is no value on it.
+ *
+ * The bare-string-in-a-list rule this file already records stays intact:
+ * `'django.contrib.auth',` in an INSTALLED_APPS array *is* the behaviour. A header
+ * name is not, for the reason above — it names the slot, and the slot is filled
+ * somewhere else.
+ */
+const LONE_HEADER_NAME = /^[bru]?(['"`])([^'"`]+)\1\s*,?$/i;
+function isALoneHeaderName(trimmed) {
+    const literal = LONE_HEADER_NAME.exec(trimmed);
+    return literal !== null && HTTP_HEADER_NAME.test(literal[2].replace(/\b[a-z]/g, (c) => c.toUpperCase()));
+}
 /**
  * An entry that says what something is called.
  *
@@ -167,7 +187,7 @@ function declaresAType(trimmed) {
 }
 function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
-    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed) || NAMES_SOMETHING.test(trimmed);
+    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed) || NAMES_SOMETHING.test(trimmed) || isALoneHeaderName(trimmed);
 }
 /**
  * Whether this line may be quoted back to the reader as something the code does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {