compose-guard 0.1.0__tar.gz

compose_guard-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: check (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install
+        run: make install
+      - name: Check
+        run: make check
+
+  web:
+    name: web playground
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - name: Install
+        run: npm ci
+      - name: Lint and type-check
+        run: npm run lint && npm run typecheck
+      - name: Unit tests (including the real analyzer in Pyodide)
+        run: npm test
+      - name: Build
+        run: npm run build
+      - name: End-to-end tests
+        run: npx playwright install --with-deps chromium && npm run test:e2e

compose_guard-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,31 @@
+# Publish compose-guard to PyPI when a GitHub Release is published.
+# Requires a Trusted Publisher on https://pypi.org/manage/account/publishing/
+# for owner yagnang-vyas, repo compose-guard, workflow publish.yml, environment pypi.
+name: Publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: PyPI
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Build
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1

compose_guard-0.1.0/.github/workflows/sarif-demo.yml

@@ -0,0 +1,30 @@
+# Uploads Compose Guard findings for the deliberately insecure example to GitHub code scanning.
+# Manual only, so the example does not create permanent alerts on every push.
+name: SARIF demo
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install Compose Guard
+        run: pip install .
+      - name: Lint the insecure example
+        run: >
+          compose-guard examples/insecure/compose.yaml
+          --format sarif --fail-on never > compose-guard.sarif
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: compose-guard.sarif
+          category: compose-guard

compose_guard-0.1.0/.gitignore

@@ -0,0 +1,36 @@
+# Byte-compiled / cache
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+
+# Packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Coverage
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Local secrets
+.env
+
+# Editors / OS
+.idea/
+.vscode/
+.DS_Store
+
+# Web playground
+web/node_modules/
+web/dist/
+web/public/runtime/

compose_guard-0.1.0/AGENTS.md

@@ -0,0 +1,28 @@
+# Working on Compose Guard
+
+These rules apply to every change, whether made by a person or an AI coding agent.
+
+1. **Real functionality only.** No stubs, `pass` bodies, `TODO` placeholders, or mocked behaviour
+   presented as working.
+2. **Fix, don't report.** When a check fails, fix the code. Never weaken or skip a test, add
+   `# type: ignore` / `# noqa` without a one-line justification comment, or lower the coverage
+   threshold.
+3. **No invented output.** Every sample output in README.md must come from actually running the CLI.
+4. **Never print secret values.** Findings about environment variables name the *key* only. No
+   output format, error message or log line may contain an environment value from the input file.
+5. **Safe YAML only.** Never call `yaml.load` or construct arbitrary Python objects. Parse with
+   `yaml.compose` (node tree) and convert nodes in `loader.py`.
+6. **One runtime dependency:** `PyYAML`. Justify any other in SPEC.md; prefer the standard library.
+7. **Fixtures are synthetic** and use obviously fake values (see `tests/fixtures/README.md`).
+8. **Git:** Conventional Commits (`feat:`, `fix:`, `docs:`, `chore:`, `refactor:`, `test:`).
+   Run `make check` before every commit; do not commit while it fails.
+9. If something is ambiguous or contradictory, take the most conservative interpretation and
+   record it in SPEC.md under "Decisions".
+
+## Commands
+
+```
+make install    # pip install -e ".[dev]"
+make check      # ruff, ruff format --check, mypy --strict, pytest with >=90% branch coverage
+make format     # apply ruff formatting and safe fixes
+```

compose_guard-0.1.0/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Changed
+
+- Renamed the project to **Compose Guard** for PyPI publication (`compose-doctor` was already
+  taken by an unrelated package). Distribution/CLI `compose-guard`, import `compose_guard`,
+  config `.compose-guard.yml`, suppressions `# compose-guard: …`, exception base
+  `ComposeGuardError`, and repository/docs/UI branding. Rule IDs `CD000`–`CD015` are unchanged.
+
+### Added
+
+- Web playground in `web/`: a landing page, docs, examples and an editor that runs the real
+  `compose_guard` package in the browser with Pyodide, with Netlify configuration and CI.
+- GitHub Actions workflow that publishes to PyPI on a published GitHub Release (Trusted Publishing).
+
+## [0.1.0] - 2026-10-25
+
+### Added
+
+- Located YAML loader built on `yaml.compose`: 1-based line and column for every key and list
+  item, YAML 1.1 aliases and merge keys, and protection against alias bombs, recursive aliases and
+  deep nesting.
+- Sixteen rules: CD000 (invalid configuration) and CD001–CD015 covering image pinning, privileged
+  mode, Docker socket and sensitive host mounts, host networking and namespaces, exposed database
+  ports, hard-coded secrets, dangerous capabilities, disabled security profiles, healthchecks,
+  restart policies, `depends_on` conditions, memory limits and fixed container names.
+- Text, JSON (`schema_version` 1) and SARIF 2.1.0 output.
+- Inline suppressions (`# compose-doctor: ignore ...`, `ignore-file`) and a `.compose-doctor.yml`
+  config file with global and per-service ignores, severity overrides and `fail_on`
+  (renamed to Compose Guard in Unreleased).
+- CLI with default-file discovery, standard input, `--fail-on`, `--ignore`, `--show-suppressed`,
+  `--list-rules` and documented exit codes.
+- Insecure and hardened example stacks, CI on Python 3.10–3.13, and a manually triggered SARIF
+  upload workflow.
+
+[0.1.0]: https://github.com/yagnang-vyas/compose-guard/releases/tag/v0.1.0

compose_guard-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yagnang Vyas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

compose_guard-0.1.0/Makefile

@@ -0,0 +1,18 @@
+.PHONY: install lint typecheck test check format
+
+install:
+	pip install -e ".[dev]"
+
+lint:
+	ruff check . && ruff format --check .
+
+typecheck:
+	mypy src
+
+test:
+	pytest --cov=compose_guard --cov-branch --cov-report=term-missing --cov-fail-under=90
+
+check: lint typecheck test
+
+format:
+	ruff format . && ruff check --fix .