configsentry 0.0.26 → 0.0.28

package/README.md

@@ -102,6 +102,7 @@ Tip: for machine output use `--format json` / `--format sarif`.
 
 ## Docs
 
+- Proof in the wild (public repo tests): [`repo-tests/`](repo-tests/)
 - GitHub Action usage examples: [`docs/action-usage.md`](docs/action-usage.md)
 - Baselines (incremental adoption): [`docs/baselines.md`](docs/baselines.md)
 - Compatibility & scope: [`docs/compatibility.md`](docs/compatibility.md)

package/dist/rules.js

@@ -1,4 +1,43 @@
 const SENSITIVE_PORTS = new Set([5432, 3306, 6379, 27017, 9200]);
+const SECRET_KEY_RE = /(pass(word)?|secret|token|api[_-]?key|private[_-]?key)/i;
+const PLACEHOLDER_VALUE_RE = /^(changeme|change-me|password|secret|token|example|example_password|yourpassword|your_password|replace_me|replace-me|TODO)$/i;
+function extractEnv(svc) {
+    const env = svc?.environment;
+    const res = [];
+    // environment:
+    //   KEY: value
+    // or
+    // environment:
+    //   - KEY=value
+    //   - KEY
+    if (env && typeof env === 'object' && !Array.isArray(env)) {
+        for (const [k, v] of Object.entries(env)) {
+            if (typeof k !== 'string')
+                continue;
+            if (v == null)
+                continue;
+            res.push({ key: k, value: String(v), raw: `${k}=${String(v)}` });
+        }
+        return res;
+    }
+    if (Array.isArray(env)) {
+        for (const item of env) {
+            if (typeof item !== 'string')
+                continue;
+            const idx = item.indexOf('=');
+            if (idx === -1) {
+                // KEY (value from environment at runtime) — not a hardcoded secret
+                continue;
+            }
+            const key = item.slice(0, idx);
+            const value = item.slice(idx + 1);
+            if (!key)
+                continue;
+            res.push({ key, value, raw: item });
+        }
+    }
+    return res;
+}
 function normalizePorts(ports) {
     if (!Array.isArray(ports))
         return [];
@@ -224,6 +263,44 @@ export function runRules(compose, targetPath) {
                 });
             }
         }
+        // Rule: depends_on without healthchecks / service_healthy
+        // Compose nuance: service_healthy requires healthchecks and is not universally used.
+        // We keep this as a gentle reliability warning.
+        const dependsOn = svc?.depends_on;
+        if (dependsOn != null) {
+            // Collect dependency service names.
+            const deps = [];
+            if (Array.isArray(dependsOn)) {
+                for (const d of dependsOn)
+                    if (typeof d === 'string')
+                        deps.push(d);
+            }
+            else if (dependsOn && typeof dependsOn === 'object') {
+                for (const k of Object.keys(dependsOn))
+                    deps.push(k);
+            }
+            // Detect whether any condition: service_healthy is used.
+            let hasServiceHealthy = false;
+            if (dependsOn && typeof dependsOn === 'object' && !Array.isArray(dependsOn)) {
+                for (const v of Object.values(dependsOn)) {
+                    if (v && typeof v === 'object' && String(v.condition ?? '').toLowerCase() === 'service_healthy') {
+                        hasServiceHealthy = true;
+                    }
+                }
+            }
+            const depsMissingHealthchecks = deps.filter((d) => services?.[d]?.healthcheck == null);
+            if (depsMissingHealthchecks.length > 0 || !hasServiceHealthy) {
+                findings.push({
+                    id: 'compose.depends-on-without-health',
+                    title: 'depends_on without healthcheck gating',
+                    severity: 'low',
+                    message: `Service '${serviceName}' uses depends_on without robust healthcheck gating.`,
+                    service: serviceName,
+                    path: `${targetPath}#services.${serviceName}.depends_on`,
+                    suggestion: "Prefer adding healthchecks and (where supported) depends_on: { <svc>: { condition: service_healthy } } to avoid startup race conditions."
+                });
+            }
+        }
         // Rule: restart policy
         if (svc?.restart == null) {
             findings.push({
@@ -261,6 +338,27 @@ export function runRules(compose, targetPath) {
                 suggestion: 'Set user: "1000:1000" (or a dedicated UID/GID) and ensure the image supports running unprivileged.'
             });
         }
+        // Rule: hardcoded secrets in environment
+        for (const { key, value, raw } of extractEnv(svc)) {
+            if (!SECRET_KEY_RE.test(key))
+                continue;
+            const v = String(value).trim();
+            if (v.length === 0)
+                continue;
+            // ${VAR} / ${VAR:-default} / ${VAR?err}
+            if (v.startsWith('${') && v.endsWith('}'))
+                continue;
+            const placeholder = PLACEHOLDER_VALUE_RE.test(v) || v.toLowerCase().includes('changeme');
+            findings.push({
+                id: 'compose.hardcoded-secret',
+                title: 'Possible hardcoded secret in compose environment',
+                severity: placeholder ? 'medium' : 'high',
+                message: `Service '${serviceName}' sets '${key}' to a literal value in environment ('${raw}').`,
+                service: serviceName,
+                path: `${targetPath}#services.${serviceName}.environment`,
+                suggestion: 'Avoid committing secrets in docker-compose.yml. Prefer ${VAR} with a .env file (gitignored) or Docker secrets where supported.'
+            });
+        }
         // Rule: filesystem not read-only (hardening)
         // Low severity because many images expect write access unless explicitly designed for read-only.
         if (svc?.read_only !== true) {
@@ -274,6 +372,41 @@ export function runRules(compose, targetPath) {
                 suggestion: 'Consider setting read_only: true + add explicit writable mounts (e.g. tmpfs:/tmp or a data volume) if the app supports it.'
             });
         }
+        // Rule: floating / unpinned image tags
+        const image = svc?.image;
+        if (typeof image === 'string' && image.trim() !== '') {
+            // If pinned by digest, it's reproducible.
+            if (!image.includes('@')) {
+                const lastSlash = image.lastIndexOf('/');
+                const lastColon = image.lastIndexOf(':');
+                const hasTag = lastColon > lastSlash;
+                if (!hasTag) {
+                    findings.push({
+                        id: 'compose.image-floating-tag',
+                        title: 'Image tag not pinned',
+                        severity: 'medium',
+                        message: `Service '${serviceName}' uses an image without an explicit tag ('${image}').`,
+                        service: serviceName,
+                        path: `${targetPath}#services.${serviceName}.image`,
+                        suggestion: "Pin the image to a version tag (e.g. 'nginx:1.27') or a digest (e.g. 'nginx@sha256:...') for reproducible deployments."
+                    });
+                }
+                else {
+                    const tag = image.slice(lastColon + 1).trim();
+                    if (tag.toLowerCase() === 'latest') {
+                        findings.push({
+                            id: 'compose.image-floating-tag',
+                            title: 'Image tag not pinned',
+                            severity: 'medium',
+                            message: `Service '${serviceName}' uses a floating image tag ('${image}').`,
+                            service: serviceName,
+                            path: `${targetPath}#services.${serviceName}.image`,
+                            suggestion: "Pin the image to a version tag (e.g. 'nginx:1.27') or a digest (e.g. 'nginx@sha256:...') for reproducible deployments."
+                        });
+                    }
+                }
+            }
+        }
         // Rule: exposed sensitive ports
         const ports = normalizePorts(svc?.ports);
         for (const p of ports) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "configsentry",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "description": "Developer-first guardrails for docker-compose.yml (security + ops footguns).",
   "type": "module",
   "license": "MIT",