rulestamp-docker-hub-pull-limit-lint 1.0.2__tar.gz

rulestamp_docker_hub_pull_limit_lint-1.0.2/LICENSE.txt

@@ -0,0 +1,15 @@
+Docker Hub Pull Limit Lint — CI rate limit guard — Licence
+
+Free scope
+  Lint the open workflow, compose, GitLab CI, Kubernetes or Dockerfile: every anonymous Docker Hub pull, with line and fix. is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Scan the whole workspace in one run and export a pull inventory report (Markdown) to attach to the CI ticket. is the paid part. It asks for a licence key issued at purchase (one seat, one key). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

rulestamp_docker_hub_pull_limit_lint-1.0.2/PKG-INFO

@@ -0,0 +1,85 @@
+Metadata-Version: 2.4
+Name: rulestamp-docker-hub-pull-limit-lint
+Version: 1.0.2
+Summary: Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per  (bundled Node.js runtime)
+Author-email: Rulestamp <support@getreadystack.com>
+License: Proprietary - see LICENSE.txt
+Project-URL: Homepage, https://getreadystack.com/tools/docker-hub-pull-limit-lint?ref=pypi
+Project-URL: Documentation, https://getreadystack.com/tools/docker-hub-pull-limit-lint?ref=pypi
+Project-URL: Support, https://getreadystack.com/support
+Keywords: docker,docker hub,rate limit,toomanyrequests,github actions,docker-compose,ci,kubernetes
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: nodejs-wheel-binaries>=20
+Dynamic: license-file
+
+# Docker Hub Pull Limit Lint
+
+> Runs the same checker as our npm package on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+![Docker Hub Pull Limit Lint — finds the line](https://getreadystack.com/img/promo/docker-hub-pull-limit-lint_demo.gif)
+
+![Docker Hub Pull Limit Lint](https://getreadystack.com/img/promo/sku324640_result_card.jpg)
+
+Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per 6 hours per IPv4 address or IPv6 /64 subnet (docs.docker.com, checked 2026-09-27).
+
+## Install
+
+```
+docker-hub-pull-limit-lint file
+```
+
+Node 18+. The same 10 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Lint the open workflow, compose, GitLab CI, Kubernetes or Dockerfile and see every anonymous Docker Hub pull with line and fix, using all 10 rules.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scan the whole workspace in one run and export a Markdown pull inventory report to attach to the CI ticket.
+
+```
+docker-hub-pull-limit-lint --dir ./templates --report html --out report.html
+```
+
+Docker Pro costs $9 per user per month billed yearly ($108 a year), and it only lifts the limit for pulls that log in; this lint costs $29 once.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "docker-hub-pull-limit-lint": { "command": "docker-hub-pull-limit-lint", "args": ["--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: Docker Hub Pull Limit Lint
+  run: pip install rulestamp-docker-hub-pull-limit-lint && docker-hub-pull-limit-lint --dir . --ci
+```
+
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://getreadystack.com/api/buy/cl/polar_cl_xEh5IeTeNYGk8do3WVOUYZxBSCx2BseojEiBQ38O9Ky)
+
+
+<!-- docker hub pull limit lint -->
+
+
+## Install (PyPI)
+
+```
+pip install rulestamp-docker-hub-pull-limit-lint
+docker-hub-pull-limit-lint --help
+```

rulestamp_docker_hub_pull_limit_lint-1.0.2/README.md

@@ -0,0 +1,65 @@
+# Docker Hub Pull Limit Lint
+
+> Runs the same checker as our npm package on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+![Docker Hub Pull Limit Lint — finds the line](https://getreadystack.com/img/promo/docker-hub-pull-limit-lint_demo.gif)
+
+![Docker Hub Pull Limit Lint](https://getreadystack.com/img/promo/sku324640_result_card.jpg)
+
+Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per 6 hours per IPv4 address or IPv6 /64 subnet (docs.docker.com, checked 2026-09-27).
+
+## Install
+
+```
+docker-hub-pull-limit-lint file
+```
+
+Node 18+. The same 10 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Lint the open workflow, compose, GitLab CI, Kubernetes or Dockerfile and see every anonymous Docker Hub pull with line and fix, using all 10 rules.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scan the whole workspace in one run and export a Markdown pull inventory report to attach to the CI ticket.
+
+```
+docker-hub-pull-limit-lint --dir ./templates --report html --out report.html
+```
+
+Docker Pro costs $9 per user per month billed yearly ($108 a year), and it only lifts the limit for pulls that log in; this lint costs $29 once.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "docker-hub-pull-limit-lint": { "command": "docker-hub-pull-limit-lint", "args": ["--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: Docker Hub Pull Limit Lint
+  run: pip install rulestamp-docker-hub-pull-limit-lint && docker-hub-pull-limit-lint --dir . --ci
+```
+
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://getreadystack.com/api/buy/cl/polar_cl_xEh5IeTeNYGk8do3WVOUYZxBSCx2BseojEiBQ38O9Ky)
+
+
+<!-- docker hub pull limit lint -->
+
+
+## Install (PyPI)
+
+```
+pip install rulestamp-docker-hub-pull-limit-lint
+docker-hub-pull-limit-lint --help
+```

rulestamp_docker_hub_pull_limit_lint-1.0.2/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "rulestamp-docker-hub-pull-limit-lint"
+version = "1.0.2"
+description = "Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per  (bundled Node.js runtime)"
+readme = "README.md"
+requires-python = ">=3.9"
+dependencies = ["nodejs-wheel-binaries>=20"]
+license = {text = "Proprietary - see LICENSE.txt"}
+keywords = ["docker", "docker hub", "rate limit", "toomanyrequests", "github actions", "docker-compose", "ci", "kubernetes"]
+authors = [{name = "Rulestamp", email = "support@getreadystack.com"}]
+classifiers = ["Programming Language :: Python :: 3", "Environment :: Console", "Topic :: Software Development :: Quality Assurance", "Operating System :: OS Independent"]
+
+[project.urls]
+Homepage = "https://getreadystack.com/tools/docker-hub-pull-limit-lint?ref=pypi"
+Documentation = "https://getreadystack.com/tools/docker-hub-pull-limit-lint?ref=pypi"
+Support = "https://getreadystack.com/support"
+
+[project.scripts]
+"docker-hub-pull-limit-lint" = "rulestamp_docker_hub_pull_limit_lint.__main__:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+"rulestamp_docker_hub_pull_limit_lint" = ["js/*"]

rulestamp_docker_hub_pull_limit_lint-1.0.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/__init__.py

@@ -0,0 +1 @@
+__version__ = '1.0.2'

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/__main__.py

@@ -0,0 +1,12 @@
+import os, sys
+
+
+def main():
+    # Runs the same checker as the npm package on the Node.js runtime installed with this package (nodejs-wheel-binaries).
+    from nodejs_wheel import node
+    here = os.path.dirname(os.path.abspath(__file__))
+    return node([os.path.join(here, "js", "cli.js")] + sys.argv[1:])
+
+
+if __name__ == "__main__":
+    sys.exit(main())

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/js/cli.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (['node_modules', '.git', '.hg', '.svn', '.venv', 'venv', '.tox', '.cache', '.next', '.nuxt', '.terraform', '__pycache__'].includes(e.name)) continue;   // s158 — .github · .gitlab-ci.yml · .env · .well-known 은 본다 (옛 줄은 점으로 시작하는 것을 전부 건너뛰어 워크플로 검사기가 .github/workflows 를 못 봤다)
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  // s158 — ⚑7일 무료 없음: 새 체험은 ⛔열지 않는다 · 이미 시작된 체험(trial.json)만 끝까지 지킨다 (읽기 전용)
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    const t = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return { active: !!(t && t.until) && new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t && t.until };
+  } catch (e) { return { active: false }; }
+}
+// ★s158 2026-09-23 — the free run SPEAKS about the rest of the folder (vsix: auto.js · crx: welcome tab).
+//   The answer for the named files is complete and free; the next step is shown with the user's OWN numbers:
+//   "this folder has N more matching files - M issues in K of them" + the one command that sweeps them.
+//   Never blocks, never starts a trial (s158: no free trial - the free answer on the named files is the "try it"), human seat only, 400 files / 1.5 s cap.
+function folderHint(done) {
+  if (!process.stderr.isTTY || process.env.CI || process.env.READYSTACK_NO_HINT || !done.length) return;
+  const base = path.dirname(path.resolve(done[0]));
+  const seen = new Set(done.map((f) => path.resolve(f)));
+  const all = walk(base, S.exts || [], []).filter((f) => !seen.has(path.resolve(f)));
+  if (!all.length) return;
+  const t0 = Date.now(); let issues = 0, hitFiles = 0, scanned = 0;
+  for (const f of all.slice(0, 400)) { if (Date.now() - t0 > 1500) break; let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } scanned++; const h = scan(t, f); if (h.length) { issues += h.length; hitFiles++; } }
+  const rel = path.relative(process.cwd(), base) || '.';
+  const tail = trialState().active ? 'free during your trial' : '$' + S.price + ' once';
+  const more = all.length + ' more matching file' + (all.length > 1 ? 's' : '');
+  const found = issues ? ' - ' + (scanned < all.length ? 'at least ' : '') + issues + ' issue' + (issues > 1 ? 's' : '') + ' in ' + hitFiles + ' of them' : ' - no issues found in them';
+  process.stderr.write('\n' + (rel === '.' ? 'This folder' : rel) + ' has ' + more + found + '.\n' + (issues ? 'Sweep them all: ' + S.bin + ' --dir ' + (/\s/.test(rel) ? JSON.stringify(rel) : rel) + '   (' + tail + ')\n' : ''));
+}
+let _usePinged = false;
+function pingUse() {
+  try {
+    if (_usePinged) return; _usePinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;
+    if (!(process.stdout.isTTY || process.stdin.isTTY)) return;   // human seat only (s152)
+    const https = require('https');
+    const body = JSON.stringify({ t: 'use', slug: S.bin, src: 'cli', why: 'free' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + S.bin } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) {}
+}
+function mcpServe() {
+  process.env.READYSTACK_MCP = '1';   // s152 - 에이전트(Claude Code·Cursor)가 부른 세션은 사람 자리다 · 키 판 핑 src=mcp
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (s158: no free trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; $' + S.price + ' once)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s158 — ⚑7일 무료 없음 · 이미 시작된 체험만 지킨다
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once. Get a licence: ' + lic.BUY_URL + '\n');
+      else {
+        // s158 — the key is asked WITH the customer's own count (endowment · open loop): how many issues this folder holds.
+        let own = '';
+        if (dir) { try { const all = walk(dir, exts, []); let n = 0, k = 0, sc = 0; const t0 = Date.now();
+          for (const f of all.slice(0, 2000)) { if (Date.now() - t0 > 4000) break; let tx = ''; try { tx = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } sc++; const h = scan(tx, f); if (h.length) { n += h.length; k++; } }
+          if (n) own = dir + ': ' + (sc < all.length ? 'at least ' : '') + n + ' issue' + (n > 1 ? 's' : '') + ' in ' + k + ' of ' + all.length + ' files.\n'; } catch (e) {} }
+        process.stderr.write(own + S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ' once): ' + lic.BUY_URL + '\n'); process.exit(2);
+      }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  if (!paid) { try { folderHint(files); } catch (e) {} pingUse(); }   // s158 — a free run ends with the user's own folder count + one anonymous 'used' count (human seat only)
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/js/engine.js

@@ -0,0 +1,161 @@
+(function () {
+  const RULES = (typeof module !== 'undefined') ? require('./rules.json') : window.DH_RULES;
+  const BY = {};
+  RULES.forEach(r => { BY[r.id] = r; });
+  const HUB_HOSTS = ['docker.io', 'index.docker.io', 'registry-1.docker.io', 'registry.hub.docker.com'];
+  const VALUE_OPTS = ['-v', '--volume', '-e', '--env', '-w', '--workdir', '--name', '-p', '--publish', '--network', '--net',
+    '--entrypoint', '-u', '--user', '--mount', '--env-file', '--platform', '-l', '--label', '-h', '--hostname', '--add-host', '--pull'];
+
+  function clean(v) {
+    return String(v || '').replace(/\s+#.*$/, '').trim().replace(/^['"]|['"]$/g, '').trim();
+  }
+  // returns the image reference when it resolves to Docker Hub, else null
+  function hubImage(ref) {
+    ref = clean(ref).replace(/^docker:\/\//, '');
+    if (!ref || /\$/.test(ref) || ref === 'scratch') return null;
+    const parts = ref.split('/');
+    const first = parts[0].toLowerCase();
+    if (parts.length > 1 && (first.includes('.') || first.includes(':') || first === 'localhost')) {
+      return HUB_HOSTS.includes(first) ? ref : null;
+    }
+    return ref;
+  }
+  function indent(s) { return s.match(/^\s*/)[0].length; }
+  function blank(s) { return !s.trim() || /^\s*#/.test(s); }
+  // line index of the parent mapping key of line i (-1 if none)
+  function parentOf(lines, i) {
+    const n = indent(lines[i].replace(/^(\s*)- /, '$1  '));
+    for (let j = i - 1; j >= 0; j--) {
+      if (blank(lines[j])) continue;
+      if (indent(lines[j]) < n) return j;
+    }
+    return -1;
+  }
+  function keyOf(line) { const m = (line || '').match(/^\s*-?\s*([\w.-]+):/); return m ? m[1] : ''; }
+  // does the mapping that contains line i have sibling key `key`?
+  function siblingHas(lines, i, key) {
+    const n = indent(lines[i]);
+    const re = new RegExp('^\\s{' + n + '}' + key + ':');
+    for (let j = i - 1; j >= 0; j--) {
+      if (blank(lines[j])) continue;
+      if (indent(lines[j]) < n) break;
+      if (re.test(lines[j])) return true;
+    }
+    for (let j = i + 1; j < lines.length; j++) {
+      if (blank(lines[j])) continue;
+      if (indent(lines[j]) < n) break;
+      if (re.test(lines[j])) return true;
+    }
+    return false;
+  }
+  function cliImage(cmd) {
+    const m = cmd.match(/\bdocker\s+(?:container\s+|image\s+)?(pull|run|create)\s+(.*)$/);
+    if (!m) return null;
+    const toks = m[2].split(/\s+/).filter(Boolean);
+    for (let k = 0; k < toks.length; k++) {
+      const t = toks[k];
+      if (/^[<>|&;]/.test(t)) return null;
+      if (t.startsWith('-')) { if (VALUE_OPTS.includes(t)) k++; continue; }
+      return t;
+    }
+    return null;
+  }
+  function kindOf(text) {
+    if (/^jobs:\s*$/m.test(text) && /runs-on:/.test(text)) return 'workflow';
+    if (/^\s*apiVersion:/m.test(text) && /^\s*kind:\s*\w+/m.test(text)) return 'k8s';
+    if (/^services:\s*$/m.test(text)) return 'compose';
+    if (/^\s+script:/m.test(text) || /^stages:/m.test(text)) return 'gitlab';
+    if (/^\s*FROM\s+\S+/im.test(text)) return 'dockerfile';
+    return 'unknown';
+  }
+  function hit(out, id, line, image, extra) {
+    const r = BY[id];
+    out.push({ check: id, sev: r.sev, msg: r.title + ' — ' + image + '. ' + r.msg + (extra || ''), fix: r.fix, line: line + 1, image });
+  }
+
+  function check(text, opts) {
+    opts = opts || {};
+    const lines = String(text || '').replace(/\r\n?/g, '\n').split('\n');
+    const kind = opts.kind || kindOf(text);
+    const out = [];
+
+    if (kind === 'workflow') {
+      let loggedIn = false, jobIndent = -1, nonHubLogin = null, selfHosted = -1;
+      lines.forEach((ln, i) => {
+        if (blank(ln)) return;
+        const n = indent(ln);
+        if (/^jobs:\s*$/.test(ln)) { jobIndent = -2; return; }
+        if (jobIndent === -2 && n > 0) jobIndent = n;
+        if (n === jobIndent && /^\s*[\w-]+:\s*$/.test(ln)) { loggedIn = false; return; }
+        if (/runs-on:.*self-hosted/.test(ln) && selfHosted < 0) selfHosted = i;
+        let m;
+        if ((m = ln.match(/uses:\s*['"]?docker\/login-action/))) {
+          let reg = '';
+          for (let j = i + 1; j < Math.min(lines.length, i + 10); j++) {
+            if (/^\s*- /.test(lines[j])) break;
+            const r = lines[j].match(/^\s*registry:\s*(.+)$/);
+            if (r) reg = clean(r[1]);
+          }
+          if (!reg || HUB_HOSTS.includes(reg.toLowerCase())) loggedIn = true; else if (!nonHubLogin) nonHubLogin = { i, reg };
+          return;
+        }
+        if ((m = ln.match(/\bdocker\s+login\b(.*)$/))) {
+          const host = (m[1].split(/\s+/).filter(t => t && !t.startsWith('-') && !/^\$|^['"]?\$/.test(t)).pop() || '');
+          if (!host || !host.includes('.') || HUB_HOSTS.includes(host.toLowerCase())) loggedIn = true;
+          return;
+        }
+        if ((m = ln.match(/^\s*-?\s*uses:\s*['"]?docker:\/\/(\S+)/))) {
+          const img = hubImage(m[1]); if (img) hit(out, 'gha-docker-uri-action', i, img); return;
+        }
+        if ((m = ln.match(/^\s*container:\s*(\S.*)$/)) && clean(m[1])) {
+          const img = hubImage(m[1]); if (img) hit(out, 'gha-container-no-credentials', i, img); return;
+        }
+        if ((m = ln.match(/^\s*image:\s*(\S.*)$/))) {
+          const img = hubImage(m[1]); if (!img) return;
+          if (siblingHas(lines, i, 'credentials')) return;
+          const p = parentOf(lines, i);
+          if (keyOf(lines[p]) === 'container') { hit(out, 'gha-container-no-credentials', i, img); return; }
+          if (keyOf(lines[parentOf(lines, p)]) === 'services') { hit(out, 'gha-service-no-credentials', i, img); return; }
+          return;
+        }
+        const ci = cliImage(ln);
+        if (ci && !loggedIn) { const img = hubImage(ci); if (img) hit(out, 'cli-pull-before-login', i, img); }
+      });
+      const hubPulls = out.length;
+      if (nonHubLogin && hubPulls) {
+        hit(out, 'login-registry-not-hub', nonHubLogin.i, nonHubLogin.reg);
+      }
+      if (selfHosted >= 0 && hubPulls) hit(out, 'self-hosted-shared-ip', selfHosted, hubPulls + ' anonymous pull line(s) in this file');
+    } else if (kind === 'dockerfile') {
+      const stages = new Set();
+      lines.forEach((ln, i) => {
+        const m = ln.match(/^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)(?:\s+AS\s+(\S+))?/i);
+        if (!m) return;
+        const ref = m[1];
+        if (!stages.has(ref.toLowerCase())) { const img = hubImage(ref); if (img) hit(out, 'dockerfile-from-hub', i, img); }
+        if (m[2]) stages.add(m[2].toLowerCase());
+      });
+    } else if (kind === 'compose' || kind === 'k8s' || kind === 'gitlab') {
+      const id = kind === 'compose' ? 'compose-image-hub' : kind === 'k8s' ? 'k8s-image-hub-no-pull-secret' : 'gitlab-image-hub-no-auth';
+      const covered = kind === 'k8s' ? /imagePullSecrets:/.test(text)
+        : kind === 'gitlab' ? /DOCKER_AUTH_CONFIG|CI_DEPENDENCY_PROXY/.test(text) : false;
+      let loggedIn = false;
+      lines.forEach((ln, i) => {
+        if (/\bdocker\s+login\b/.test(ln)) loggedIn = true;
+        let m = ln.match(/^\s*-?\s*(?:image|name):\s*(\S.*)$/);
+        if (m && (/image:/.test(ln) || keyOf(lines[parentOf(lines, i)]) === 'image')) {
+          const img = hubImage(m[1]);
+          if (img && !covered && !(kind === 'gitlab' && /^\s*-?\s*name:/.test(ln) && !img.includes(':') && !img.includes('/'))) hit(out, id, i, img);
+          return;
+        }
+        const ci = cliImage(ln);
+        if (ci && !loggedIn && !covered) { const img = hubImage(ci); if (img) hit(out, 'cli-pull-before-login', i, img); }
+      });
+    }
+    return { kind, findings: out, pulls: out.filter(f => f.check !== 'self-hosted-shared-ip' && f.check !== 'login-registry-not-hub').length };
+  }
+
+  const api = { engine: { check, hubImage, kindOf }, RULES, RULE_COUNT: RULES.length };
+  if (typeof module !== 'undefined') module.exports = api;
+  if (typeof window !== 'undefined') window.DHENGINE = api;
+})();

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/js/license.js

@@ -0,0 +1,103 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = 'b9df2e85-507b-4cdd-8b55-c0782968bd8f';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://getreadystack.com/api/buy/cl/polar_cl_xEh5IeTeNYGk8do3WVOUYZxBSCx2BseojEiBQ38O9Ky';
+const SLUG = 'docker-hub-pull-limit-lint';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+const ALL_BENEFIT_ID = '22692551-5203-4467-b1a3-e33cdba6589d';   // s149 2026-09-17 — 팀 키(전 린터 한 키 · Polar benefit) · 상품 benefit 다음에 한 번 더 묻는다
+// s170 2026-09-29 — ask OUR worker first (/api/lic): keys bought on Whop open here (a price-tier key binds to the first tool it opens · the team key opens every tool). Then the old Polar check.
+function validate(key) {
+  return validateHub(key).then(function (h) {
+    if (h.ok) return h;
+    return validate1(key, BENEFIT_ID).then(function (r) { return (r.ok || r.offline || !/^[0-9a-f-]{36}$/.test(ALL_BENEFIT_ID)) ? r : validate1(key, ALL_BENEFIT_ID); })
+      .then(function (r) { return r.ok ? r : { ok: false, offline: !!(h.offline || r.offline) }; });
+  });
+}
+function validateHub(key) {
+  return new Promise(function (resolve) {
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/lic?key=' + encodeURIComponent(key) + '&slug=' + encodeURIComponent(SLUG),
+      method: 'GET', timeout: 8000, headers: { 'accept': 'application/json', 'user-agent': 'readystack-cli/' + SLUG } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: res.statusCode >= 500 });
+        try { const j = JSON.parse(buf); resolve({ ok: !!(j && j.ok), offline: false }); } catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.end();
+  });
+}
+function validate1(key, ben) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(ben) ? { key: key, organization_id: ORG_ID, benefit_id: ben } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+// ★s151 2026-09-19 — 키 판(키가 없거나 거절된 순간)을 익명으로 센다 (슬러그·출처·이유만) · DO_NOT_TRACK=1 · READYSTACK_NO_TELEMETRY 면 안 보낸다 · 실패는 조용히 · 프로세스당 한 번.
+let _pinged = false;
+function pingPaywall(why) {
+  try {
+    if (_pinged) return; _pinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;   // s151: CI(깃허브 액션 등)와 우리 빌드는 손님이 아니다
+    if (!(process.stdout.isTTY || process.stdin.isTTY || process.env.READYSTACK_MCP === '1')) return;   // s152: 사람 자리(터미널·MCP 세션)에서만 센다 - 발행 1분 뒤 남의 실행기(JP · 우리 3대는 US)가 돌린 no_key 13건은 손님이 아니다
+    const body = JSON.stringify({ t: 'paywall', slug: SLUG, src: process.env.READYSTACK_MCP === '1' ? 'mcp' : 'cli', why: why || 'no_key' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + SLUG } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) { /* 세는 것이 실패해도 상품은 돈다 */ }
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) { pingPaywall('no_key'); return { ok: false, why: 'no_key' }; }   // s151
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  if (!r.offline) pingPaywall('invalid');   // s151
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/js/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@readystack/docker-hub-pull-limit-lint",
+  "version": "1.0.2",
+  "description": "Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per ",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "docker",
+    "docker hub",
+    "rate limit",
+    "toomanyrequests",
+    "github actions",
+    "docker-compose",
+    "ci",
+    "kubernetes"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://getreadystack.com/api/buy/cl/polar_cl_xEh5IeTeNYGk8do3WVOUYZxBSCx2BseojEiBQ38O9Ky",
+  "bin": {
+    "docker-hub-pull-limit-lint": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "mcpName": "io.github.jmshinhwa/docker-hub-pull-limit-lint",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jmshinhwa/readystack-themes.git",
+    "directory": "docker-hub-pull-limit-lint"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/js/rules.json

@@ -0,0 +1,90 @@
+[
+ {
+  "id": "gha-service-no-credentials",
+  "sev": "error",
+  "kind": "workflow",
+  "title": "Service container pulled from Docker Hub without credentials",
+  "msg": "Service containers are pulled in 'Initialize containers', before any step runs — a docker/login-action step cannot authenticate this pull, so it counts against the anonymous per-IP quota.",
+  "fix": "Add credentials: {username, password} to this service, or pull it from a mirror registry.",
+  "limits": {
+   "unauthenticated": "100 pulls per 6 hours per IPv4 address or IPv6 /64 subnet",
+   "personal": "200 pulls per 6 hours",
+   "paid": "unlimited (Pro, Team, Business)",
+   "source": "https://docs.docker.com/docker-hub/usage/pulls/",
+   "checked": "2026-09-27",
+   "multi_arch": "a multi-arch image counts one pull per architecture"
+  }
+ },
+ {
+  "id": "gha-container-no-credentials",
+  "sev": "error",
+  "kind": "workflow",
+  "title": "Job container pulled from Docker Hub without credentials",
+  "msg": "The job container is pulled before the first step — a docker/login-action step cannot authenticate it, so it counts against the anonymous per-IP quota.",
+  "fix": "Use the long form container: {image, credentials: {username, password}}, or a mirror registry."
+ },
+ {
+  "id": "gha-docker-uri-action",
+  "sev": "error",
+  "kind": "workflow",
+  "title": "uses: docker:// image pulled from Docker Hub at job setup",
+  "msg": "docker:// action images are pulled while the job is set up, before your login step, so the pull is anonymous.",
+  "fix": "Replace with a run: docker run step placed after docker/login-action, or reference the image on a mirror registry."
+ },
+ {
+  "id": "cli-pull-before-login",
+  "sev": "error",
+  "kind": "any",
+  "title": "docker pull / run / create of a Docker Hub image with no Docker Hub login before it",
+  "msg": "No docker login (or docker/login-action for Docker Hub) runs earlier in this job, so this pull is anonymous.",
+  "fix": "Add docker/login-action (no registry: = Docker Hub) with a Docker Hub access token before this step."
+ },
+ {
+  "id": "login-registry-not-hub",
+  "sev": "warn",
+  "kind": "workflow",
+  "title": "Login goes to another registry while the job pulls from Docker Hub",
+  "msg": "This login sets registry: to a non-Docker-Hub host; Docker Hub pulls in the job stay anonymous.",
+  "fix": "Add a second docker/login-action step without registry: for Docker Hub."
+ },
+ {
+  "id": "self-hosted-shared-ip",
+  "sev": "warn",
+  "kind": "workflow",
+  "title": "Self-hosted runner: anonymous Docker Hub pulls share one NAT IP",
+  "msg": "Self-hosted runners behind one NAT or proxy share one public IP, so every anonymous Docker Hub pull from the fleet draws on one per-IP quota.",
+  "fix": "Log every runner in to Docker Hub or put a pull-through cache registry in front of the fleet."
+ },
+ {
+  "id": "dockerfile-from-hub",
+  "sev": "warn",
+  "kind": "dockerfile",
+  "title": "FROM pulls a Docker Hub base image",
+  "msg": "This base image resolves to docker.io; the build pulls it anonymously unless the build host is logged in to Docker Hub.",
+  "fix": "Make sure the build step logs in to Docker Hub, or point FROM at a mirror registry."
+ },
+ {
+  "id": "compose-image-hub",
+  "sev": "warn",
+  "kind": "compose",
+  "title": "Compose service image resolves to Docker Hub",
+  "msg": "docker compose pull / up fetches this from docker.io with the host's credentials — anonymous on a fresh CI runner.",
+  "fix": "Run docker login before compose in CI, or use a mirror registry for this image."
+ },
+ {
+  "id": "k8s-image-hub-no-pull-secret",
+  "sev": "warn",
+  "kind": "k8s",
+  "title": "Kubernetes image from Docker Hub with no imagePullSecrets",
+  "msg": "Nodes pull this from docker.io anonymously; every node that starts the pod counts against its own IP's quota.",
+  "fix": "Add imagePullSecrets with a Docker Hub token, or use a pull-through cache registry."
+ },
+ {
+  "id": "gitlab-image-hub-no-auth",
+  "sev": "warn",
+  "kind": "gitlab",
+  "title": "GitLab CI image from Docker Hub without DOCKER_AUTH_CONFIG or Dependency Proxy",
+  "msg": "The runner pulls this image before the script runs; with no DOCKER_AUTH_CONFIG and no Dependency Proxy prefix the pull is anonymous.",
+  "fix": "Prefix with ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/ or set DOCKER_AUTH_CONFIG for the runner."
+ }
+]

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint/js/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": "Docker Hub Pull Limit Lint",
+ "subtitle": "Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per 6 hours per IPv4 address or IPv6 /64 subnet (docs.docker.com, checked 2026-09-27).",
+ "bin": "docker-hub-pull-limit-lint",
+ "price": 29,
+ "free": "Lint the open workflow, compose, GitLab CI, Kubernetes or Dockerfile and see every anonymous Docker Hub pull with line and fix, using all 10 rules.",
+ "paid": "Scan the whole workspace in one run and export a Markdown pull inventory report to attach to the CI ticket.",
+ "need_key": "This option needs a licence (Docker Hub Pull Limit Lint).",
+ "exts": []
+}

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint.egg-info/PKG-INFO

@@ -0,0 +1,85 @@
+Metadata-Version: 2.4
+Name: rulestamp-docker-hub-pull-limit-lint
+Version: 1.0.2
+Summary: Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per  (bundled Node.js runtime)
+Author-email: Rulestamp <support@getreadystack.com>
+License: Proprietary - see LICENSE.txt
+Project-URL: Homepage, https://getreadystack.com/tools/docker-hub-pull-limit-lint?ref=pypi
+Project-URL: Documentation, https://getreadystack.com/tools/docker-hub-pull-limit-lint?ref=pypi
+Project-URL: Support, https://getreadystack.com/support
+Keywords: docker,docker hub,rate limit,toomanyrequests,github actions,docker-compose,ci,kubernetes
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: nodejs-wheel-binaries>=20
+Dynamic: license-file
+
+# Docker Hub Pull Limit Lint
+
+> Runs the same checker as our npm package on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+![Docker Hub Pull Limit Lint — finds the line](https://getreadystack.com/img/promo/docker-hub-pull-limit-lint_demo.gif)
+
+![Docker Hub Pull Limit Lint](https://getreadystack.com/img/promo/sku324640_result_card.jpg)
+
+Finds every anonymous Docker Hub pull in GitHub Actions, compose, GitLab CI, Kubernetes and Dockerfiles, including the service containers your login step never covers. Docker Hub limit: 100 pulls per 6 hours per IPv4 address or IPv6 /64 subnet (docs.docker.com, checked 2026-09-27).
+
+## Install
+
+```
+docker-hub-pull-limit-lint file
+```
+
+Node 18+. The same 10 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Lint the open workflow, compose, GitLab CI, Kubernetes or Dockerfile and see every anonymous Docker Hub pull with line and fix, using all 10 rules.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scan the whole workspace in one run and export a Markdown pull inventory report to attach to the CI ticket.
+
+```
+docker-hub-pull-limit-lint --dir ./templates --report html --out report.html
+```
+
+Docker Pro costs $9 per user per month billed yearly ($108 a year), and it only lifts the limit for pulls that log in; this lint costs $29 once.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "docker-hub-pull-limit-lint": { "command": "docker-hub-pull-limit-lint", "args": ["--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: Docker Hub Pull Limit Lint
+  run: pip install rulestamp-docker-hub-pull-limit-lint && docker-hub-pull-limit-lint --dir . --ci
+```
+
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://getreadystack.com/api/buy/cl/polar_cl_xEh5IeTeNYGk8do3WVOUYZxBSCx2BseojEiBQ38O9Ky)
+
+
+<!-- docker hub pull limit lint -->
+
+
+## Install (PyPI)
+
+```
+pip install rulestamp-docker-hub-pull-limit-lint
+docker-hub-pull-limit-lint --help
+```

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+LICENSE.txt
+README.md
+pyproject.toml
+src/rulestamp_docker_hub_pull_limit_lint/__init__.py
+src/rulestamp_docker_hub_pull_limit_lint/__main__.py
+src/rulestamp_docker_hub_pull_limit_lint.egg-info/PKG-INFO
+src/rulestamp_docker_hub_pull_limit_lint.egg-info/SOURCES.txt
+src/rulestamp_docker_hub_pull_limit_lint.egg-info/dependency_links.txt
+src/rulestamp_docker_hub_pull_limit_lint.egg-info/entry_points.txt
+src/rulestamp_docker_hub_pull_limit_lint.egg-info/requires.txt
+src/rulestamp_docker_hub_pull_limit_lint.egg-info/top_level.txt
+src/rulestamp_docker_hub_pull_limit_lint/js/cli.js
+src/rulestamp_docker_hub_pull_limit_lint/js/engine.js
+src/rulestamp_docker_hub_pull_limit_lint/js/license.js
+src/rulestamp_docker_hub_pull_limit_lint/js/package.json
+src/rulestamp_docker_hub_pull_limit_lint/js/rules.json
+src/rulestamp_docker_hub_pull_limit_lint/js/strings.json

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+docker-hub-pull-limit-lint = rulestamp_docker_hub_pull_limit_lint.__main__:main

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint.egg-info/requires.txt

@@ -0,0 +1 @@
+nodejs-wheel-binaries>=20

rulestamp_docker_hub_pull_limit_lint-1.0.2/src/rulestamp_docker_hub_pull_limit_lint.egg-info/top_level.txt

@@ -0,0 +1 @@
+rulestamp_docker_hub_pull_limit_lint