yaml-doctor-cli 1.0.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- yaml_doctor_cli-1.0.0/LICENSE +21 -0
- yaml_doctor_cli-1.0.0/PKG-INFO +345 -0
- yaml_doctor_cli-1.0.0/README.md +312 -0
- yaml_doctor_cli-1.0.0/pyproject.toml +75 -0
- yaml_doctor_cli-1.0.0/tests/__init__.py +0 -0
- yaml_doctor_cli-1.0.0/tests/test_cli.py +164 -0
- yaml_doctor_cli-1.0.0/tests/test_compose.py +90 -0
- yaml_doctor_cli-1.0.0/tests/test_demo.py +53 -0
- yaml_doctor_cli-1.0.0/tests/test_detection.py +47 -0
- yaml_doctor_cli-1.0.0/tests/test_github_actions.py +116 -0
- yaml_doctor_cli-1.0.0/tests/test_gitlab_ci.py +90 -0
- yaml_doctor_cli-1.0.0/tests/test_html_report.py +100 -0
- yaml_doctor_cli-1.0.0/tests/test_kubernetes.py +192 -0
- yaml_doctor_cli-1.0.0/tests/test_models.py +138 -0
- yaml_doctor_cli-1.0.0/tests/test_rules.py +51 -0
- yaml_doctor_cli-1.0.0/tests/test_scanner.py +144 -0
- yaml_doctor_cli-1.0.0/tests/test_utils.py +68 -0
- yaml_doctor_cli-1.0.0/tests/test_yaml_lint.py +65 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/__init__.py +3 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/__main__.py +4 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/analyzers/__init__.py +53 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/analyzers/compose.py +107 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/analyzers/github_actions.py +122 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/analyzers/gitlab_ci.py +108 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/analyzers/kubernetes.py +151 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/analyzers/yaml_lint.py +103 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/cli.py +204 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/demo.py +121 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/models.py +133 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/output/__init__.py +1 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/output/console.py +196 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/output/html_report.py +192 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/rules.py +92 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/scanner.py +145 -0
- yaml_doctor_cli-1.0.0/yaml_doctor/utils.py +44 -0
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 Sanjay Sundar Murthy
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,345 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: yaml-doctor-cli
|
|
3
|
+
Version: 1.0.0
|
|
4
|
+
Summary: Validate & lint K8s manifests, Helm charts, Docker Compose, CI configs โ 60+ rules with beautiful reports
|
|
5
|
+
Project-URL: Homepage, https://github.com/SanjaySundarMurthy/yaml-doctor
|
|
6
|
+
Project-URL: Repository, https://github.com/SanjaySundarMurthy/yaml-doctor
|
|
7
|
+
Project-URL: Issues, https://github.com/SanjaySundarMurthy/yaml-doctor/issues
|
|
8
|
+
Author-email: Sanjay S <sanjaysundarmurthy@gmail.com>
|
|
9
|
+
License-Expression: MIT
|
|
10
|
+
License-File: LICENSE
|
|
11
|
+
Keywords: cli,devops,docker-compose,github-actions,gitlab-ci,helm,kubernetes,lint,validate,yaml
|
|
12
|
+
Classifier: Development Status :: 5 - Production/Stable
|
|
13
|
+
Classifier: Environment :: Console
|
|
14
|
+
Classifier: Intended Audience :: Developers
|
|
15
|
+
Classifier: Intended Audience :: System Administrators
|
|
16
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
17
|
+
Classifier: Operating System :: OS Independent
|
|
18
|
+
Classifier: Programming Language :: Python :: 3
|
|
19
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
20
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
21
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
22
|
+
Classifier: Topic :: Software Development :: Quality Assurance
|
|
23
|
+
Classifier: Topic :: System :: Systems Administration
|
|
24
|
+
Requires-Python: >=3.10
|
|
25
|
+
Requires-Dist: click>=8.0
|
|
26
|
+
Requires-Dist: pyyaml>=6.0
|
|
27
|
+
Requires-Dist: rich>=13.0
|
|
28
|
+
Provides-Extra: dev
|
|
29
|
+
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
|
|
30
|
+
Requires-Dist: pytest>=8.0; extra == 'dev'
|
|
31
|
+
Requires-Dist: ruff>=0.4; extra == 'dev'
|
|
32
|
+
Description-Content-Type: text/markdown
|
|
33
|
+
|
|
34
|
+
# ๐ฉบ yaml-doctor
|
|
35
|
+
|
|
36
|
+
**YAML Linter & Security Scanner for DevOps Engineers**
|
|
37
|
+
|
|
38
|
+
Validate and lint Kubernetes manifests, Docker Compose files, GitHub Actions workflows, GitLab CI pipelines, and generic YAML with **60+ built-in rules** covering security, reliability, and best practices.
|
|
39
|
+
|
|
40
|
+
[](https://pypi.org/project/yaml-doctor/)
|
|
41
|
+
[](https://pypi.org/project/yaml-doctor/)
|
|
42
|
+
[](https://opensource.org/licenses/MIT)
|
|
43
|
+
[]()
|
|
44
|
+
|
|
45
|
+
---
|
|
46
|
+
|
|
47
|
+
## โจ Features
|
|
48
|
+
|
|
49
|
+
- ๐ **60+ Lint Rules** โ Security, reliability, and best practice checks
|
|
50
|
+
- ๐ฏ **Auto-Detection** โ Automatically identifies Kubernetes, Docker Compose, GitHub Actions, GitLab CI, and Helm files
|
|
51
|
+
- ๐ **Grading System** โ A+ to F grades with detailed scoring
|
|
52
|
+
- ๐ **HTML Dashboard** โ Beautiful dark-theme HTML reports with severity charts
|
|
53
|
+
- ๐ **JSON Export** โ Machine-readable reports for CI/CD integration
|
|
54
|
+
- ๐ง **Fix Suggestions** โ Actionable remediation for every finding
|
|
55
|
+
- ๐ฎ **Demo Mode** โ Try it instantly with built-in sample files
|
|
56
|
+
- ๐ **Zero Config** โ Works out of the box, no configuration needed
|
|
57
|
+
|
|
58
|
+
## ๐ฆ Installation
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
pip install yaml-doctor
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
## ๐ Quick Start
|
|
65
|
+
|
|
66
|
+
```bash
|
|
67
|
+
# Lint a single file
|
|
68
|
+
yaml-doctor lint deployment.yaml
|
|
69
|
+
|
|
70
|
+
# Scan a directory recursively
|
|
71
|
+
yaml-doctor scan ./k8s/
|
|
72
|
+
|
|
73
|
+
# Run demo with sample files
|
|
74
|
+
yaml-doctor demo
|
|
75
|
+
|
|
76
|
+
# Show all 60 rules
|
|
77
|
+
yaml-doctor rules
|
|
78
|
+
|
|
79
|
+
# Get fix suggestions
|
|
80
|
+
yaml-doctor fix deployment.yaml
|
|
81
|
+
|
|
82
|
+
# Export HTML dashboard
|
|
83
|
+
yaml-doctor scan . --html report.html
|
|
84
|
+
|
|
85
|
+
# Export JSON report
|
|
86
|
+
yaml-doctor lint config.yaml -j report.json
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
## ๐ฏ Supported File Types
|
|
90
|
+
|
|
91
|
+
| Type | Detection | Rules |
|
|
92
|
+
|------|-----------|-------|
|
|
93
|
+
| **Kubernetes** | `apiVersion` + `kind` | 20 rules (K8S001-K8S020) |
|
|
94
|
+
| **Docker Compose** | `services` + `image/build` | 12 rules (DC001-DC012) |
|
|
95
|
+
| **GitHub Actions** | `.github/workflows/` + `on/jobs` | 10 rules (GHA001-GHA010) |
|
|
96
|
+
| **GitLab CI** | `.gitlab-ci.yml` + `stages/script` | 10 rules (GL001-GL010) |
|
|
97
|
+
| **Helm** | `Chart.yaml` / `values.yaml` | K8s rules applied |
|
|
98
|
+
| **Generic YAML** | Any `.yml`/`.yaml` file | 8 rules (YML001-YML008) |
|
|
99
|
+
|
|
100
|
+
## ๐ Security Rules
|
|
101
|
+
|
|
102
|
+
### Kubernetes (20 rules)
|
|
103
|
+
|
|
104
|
+
| Rule | Severity | Description |
|
|
105
|
+
|------|----------|-------------|
|
|
106
|
+
| K8S001 | ๐ด CRITICAL | Container running as root |
|
|
107
|
+
| K8S004 | ๐ด CRITICAL | Privileged container |
|
|
108
|
+
| K8S002 | ๐ HIGH | Missing resource limits |
|
|
109
|
+
| K8S003 | ๐ HIGH | Missing resource requests |
|
|
110
|
+
| K8S005 | ๐ HIGH | Using `:latest` image tag |
|
|
111
|
+
| K8S006 | ๐ HIGH | Missing liveness probe |
|
|
112
|
+
| K8S011 | ๐ HIGH | Host network enabled |
|
|
113
|
+
| K8S012 | ๐ HIGH | Host PID enabled |
|
|
114
|
+
| K8S016 | ๐ HIGH | Secrets in environment variables |
|
|
115
|
+
| K8S007 | ๐ก MEDIUM | Missing readiness probe |
|
|
116
|
+
| K8S008 | ๐ก MEDIUM | Read-only filesystem not set |
|
|
117
|
+
| K8S013 | ๐ก MEDIUM | Single replica deployment |
|
|
118
|
+
| K8S014 | ๐ก MEDIUM | Privilege escalation allowed |
|
|
119
|
+
| K8S017 | ๐ก MEDIUM | Missing update strategy |
|
|
120
|
+
| K8S018 | ๐ก MEDIUM | Capabilities not dropped |
|
|
121
|
+
| K8S020 | ๐ก MEDIUM | Missing restart policy |
|
|
122
|
+
| K8S009 | ๐ต LOW | Missing recommended labels |
|
|
123
|
+
| K8S015 | ๐ต LOW | Missing PodDisruptionBudget |
|
|
124
|
+
| K8S019 | ๐ต LOW | No anti-affinity rules |
|
|
125
|
+
| K8S010 | โช INFO | Missing namespace |
|
|
126
|
+
|
|
127
|
+
### Docker Compose (12 rules)
|
|
128
|
+
|
|
129
|
+
| Rule | Severity | Description |
|
|
130
|
+
|------|----------|-------------|
|
|
131
|
+
| DC002 | ๐ด CRITICAL | Privileged container |
|
|
132
|
+
| DC001 | ๐ HIGH | Using `:latest` tag |
|
|
133
|
+
| DC005 | ๐ HIGH | Secrets in environment |
|
|
134
|
+
| DC009 | ๐ HIGH | Host volume with write access |
|
|
135
|
+
| DC012 | ๐ก MEDIUM | Host network mode |
|
|
136
|
+
| DC003 | ๐ก MEDIUM | No restart policy |
|
|
137
|
+
| DC004 | ๐ก MEDIUM | No healthcheck defined |
|
|
138
|
+
| DC007 | ๐ก MEDIUM | Exposed to all interfaces |
|
|
139
|
+
| DC011 | ๐ก MEDIUM | No depends_on |
|
|
140
|
+
| DC006 | ๐ต LOW | No resource limits |
|
|
141
|
+
| DC010 | ๐ต LOW | No logging configuration |
|
|
142
|
+
| DC008 | โช INFO | Deprecated version key |
|
|
143
|
+
|
|
144
|
+
### GitHub Actions (10 rules)
|
|
145
|
+
|
|
146
|
+
| Rule | Severity | Description |
|
|
147
|
+
|------|----------|-------------|
|
|
148
|
+
| GHA001 | ๐ด CRITICAL | Mutable action reference (using @main) |
|
|
149
|
+
| GHA002 | ๐ HIGH | Persist credentials enabled |
|
|
150
|
+
| GHA003 | ๐ HIGH | Secrets in run commands |
|
|
151
|
+
| GHA009 | ๐ HIGH | Script injection risk |
|
|
152
|
+
| GHA004 | ๐ก MEDIUM | Overly broad permissions |
|
|
153
|
+
| GHA005 | ๐ก MEDIUM | No job timeout |
|
|
154
|
+
| GHA006 | ๐ก MEDIUM | pull_request_target trigger |
|
|
155
|
+
| GHA007 | ๐ต LOW | No concurrency control |
|
|
156
|
+
| GHA008 | ๐ต LOW | Unversioned runner image |
|
|
157
|
+
| GHA010 | โช INFO | Missing workflow name |
|
|
158
|
+
|
|
159
|
+
### GitLab CI (10 rules)
|
|
160
|
+
|
|
161
|
+
| Rule | Severity | Description |
|
|
162
|
+
|------|----------|-------------|
|
|
163
|
+
| GL001 | ๐ HIGH | Secrets in script blocks |
|
|
164
|
+
| GL007 | ๐ HIGH | allow_failure on security jobs |
|
|
165
|
+
| GL002 | ๐ก MEDIUM | No retry configuration |
|
|
166
|
+
| GL004 | ๐ก MEDIUM | Using `:latest` image |
|
|
167
|
+
| GL005 | ๐ก MEDIUM | No timeout set |
|
|
168
|
+
| GL009 | ๐ก MEDIUM | No rules/conditions |
|
|
169
|
+
| GL003 | ๐ต LOW | No cache defined |
|
|
170
|
+
| GL008 | ๐ต LOW | No artifacts defined |
|
|
171
|
+
| GL010 | ๐ต LOW | Missing job description |
|
|
172
|
+
| GL006 | โช INFO | No stages defined |
|
|
173
|
+
|
|
174
|
+
### Generic YAML (8 rules)
|
|
175
|
+
|
|
176
|
+
| Rule | Severity | Description |
|
|
177
|
+
|------|----------|-------------|
|
|
178
|
+
| YML005 | ๐ HIGH | Hardcoded credentials |
|
|
179
|
+
| YML001 | ๐ก MEDIUM | Inconsistent indentation |
|
|
180
|
+
| YML006 | ๐ก MEDIUM | Duplicate keys |
|
|
181
|
+
| YML002 | ๐ต LOW | Trailing whitespace |
|
|
182
|
+
| YML003 | ๐ต LOW | Line too long (>200 chars) |
|
|
183
|
+
| YML007 | ๐ต LOW | Empty values |
|
|
184
|
+
| YML004 | โช INFO | Missing document start marker |
|
|
185
|
+
| YML008 | โช INFO | File too long (>1000 lines) |
|
|
186
|
+
|
|
187
|
+
## ๐ Grading System
|
|
188
|
+
|
|
189
|
+
| Grade | Score | Description |
|
|
190
|
+
|-------|-------|-------------|
|
|
191
|
+
| A+ | 95-100 | Excellent โ production ready |
|
|
192
|
+
| A | 85-94 | Great โ minor improvements possible |
|
|
193
|
+
| B | 75-84 | Good โ some issues to address |
|
|
194
|
+
| C | 65-74 | Fair โ significant improvements needed |
|
|
195
|
+
| D | 50-64 | Poor โ many issues found |
|
|
196
|
+
| F | 0-49 | Failing โ critical issues present |
|
|
197
|
+
|
|
198
|
+
**Score deductions per finding:**
|
|
199
|
+
- ๐ด Critical: -15 points
|
|
200
|
+
- ๐ High: -8 points
|
|
201
|
+
- ๐ก Medium: -3 points
|
|
202
|
+
- ๐ต Low: -1 point
|
|
203
|
+
- โช Info: 0 points
|
|
204
|
+
|
|
205
|
+
## ๐ฅ๏ธ CLI Commands
|
|
206
|
+
|
|
207
|
+
### `yaml-doctor lint <file>`
|
|
208
|
+
|
|
209
|
+
Lint a single YAML file with auto-detection.
|
|
210
|
+
|
|
211
|
+
```bash
|
|
212
|
+
yaml-doctor lint deployment.yaml
|
|
213
|
+
yaml-doctor lint docker-compose.yml --html report.html
|
|
214
|
+
yaml-doctor lint .github/workflows/ci.yml -j report.json
|
|
215
|
+
```
|
|
216
|
+
|
|
217
|
+
### `yaml-doctor scan <directory>`
|
|
218
|
+
|
|
219
|
+
Scan all YAML files in a directory.
|
|
220
|
+
|
|
221
|
+
```bash
|
|
222
|
+
yaml-doctor scan ./k8s/
|
|
223
|
+
yaml-doctor scan . --html dashboard.html
|
|
224
|
+
yaml-doctor scan ./configs --no-recursive
|
|
225
|
+
```
|
|
226
|
+
|
|
227
|
+
### `yaml-doctor demo`
|
|
228
|
+
|
|
229
|
+
Run a demo with built-in sample files.
|
|
230
|
+
|
|
231
|
+
```bash
|
|
232
|
+
yaml-doctor demo
|
|
233
|
+
yaml-doctor demo --type kubernetes
|
|
234
|
+
yaml-doctor demo --type compose
|
|
235
|
+
yaml-doctor demo --html demo-report.html
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
### `yaml-doctor rules`
|
|
239
|
+
|
|
240
|
+
Display all 60 available lint rules.
|
|
241
|
+
|
|
242
|
+
```bash
|
|
243
|
+
yaml-doctor rules
|
|
244
|
+
```
|
|
245
|
+
|
|
246
|
+
### `yaml-doctor fix <file>`
|
|
247
|
+
|
|
248
|
+
Show fix suggestions for all findings.
|
|
249
|
+
|
|
250
|
+
```bash
|
|
251
|
+
yaml-doctor fix deployment.yaml
|
|
252
|
+
```
|
|
253
|
+
|
|
254
|
+
## ๐ CI/CD Integration
|
|
255
|
+
|
|
256
|
+
### GitHub Actions
|
|
257
|
+
|
|
258
|
+
```yaml
|
|
259
|
+
- name: YAML Lint
|
|
260
|
+
run: |
|
|
261
|
+
pip install yaml-doctor
|
|
262
|
+
yaml-doctor scan . --html report.html -j report.json
|
|
263
|
+
|
|
264
|
+
- name: Upload Report
|
|
265
|
+
uses: actions/upload-artifact@v4
|
|
266
|
+
with:
|
|
267
|
+
name: yaml-doctor-report
|
|
268
|
+
path: report.html
|
|
269
|
+
```
|
|
270
|
+
|
|
271
|
+
### GitLab CI
|
|
272
|
+
|
|
273
|
+
```yaml
|
|
274
|
+
yaml-lint:
|
|
275
|
+
stage: test
|
|
276
|
+
script:
|
|
277
|
+
- pip install yaml-doctor
|
|
278
|
+
- yaml-doctor scan . --html report.html -j report.json
|
|
279
|
+
artifacts:
|
|
280
|
+
paths:
|
|
281
|
+
- report.html
|
|
282
|
+
- report.json
|
|
283
|
+
```
|
|
284
|
+
|
|
285
|
+
### Pre-commit Hook
|
|
286
|
+
|
|
287
|
+
```yaml
|
|
288
|
+
# .pre-commit-config.yaml
|
|
289
|
+
repos:
|
|
290
|
+
- repo: local
|
|
291
|
+
hooks:
|
|
292
|
+
- id: yaml-doctor
|
|
293
|
+
name: yaml-doctor
|
|
294
|
+
entry: yaml-doctor lint
|
|
295
|
+
language: python
|
|
296
|
+
types: [yaml]
|
|
297
|
+
additional_dependencies: [yaml-doctor]
|
|
298
|
+
```
|
|
299
|
+
|
|
300
|
+
## ๐ Project Structure
|
|
301
|
+
|
|
302
|
+
```
|
|
303
|
+
yaml-doctor/
|
|
304
|
+
โโโ yaml_doctor/
|
|
305
|
+
โ โโโ __init__.py # Package version
|
|
306
|
+
โ โโโ __main__.py # python -m support
|
|
307
|
+
โ โโโ cli.py # Click CLI commands
|
|
308
|
+
โ โโโ scanner.py # Core scanning engine
|
|
309
|
+
โ โโโ models.py # Data models & enums
|
|
310
|
+
โ โโโ rules.py # Rule registry (60 rules)
|
|
311
|
+
โ โโโ utils.py # Helper utilities
|
|
312
|
+
โ โโโ demo.py # Demo sample data
|
|
313
|
+
โ โโโ analyzers/
|
|
314
|
+
โ โ โโโ __init__.py # File type detection
|
|
315
|
+
โ โ โโโ kubernetes.py # 20 K8s rules
|
|
316
|
+
โ โ โโโ compose.py # 12 Docker Compose rules
|
|
317
|
+
โ โ โโโ github_actions.py # 10 GitHub Actions rules
|
|
318
|
+
โ โ โโโ gitlab_ci.py # 10 GitLab CI rules
|
|
319
|
+
โ โ โโโ yaml_lint.py # 8 generic YAML rules
|
|
320
|
+
โ โโโ output/
|
|
321
|
+
โ โโโ console.py # Rich terminal output
|
|
322
|
+
โ โโโ html_report.py # HTML dashboard reports
|
|
323
|
+
โโโ tests/ # 188 tests
|
|
324
|
+
โโโ pyproject.toml
|
|
325
|
+
โโโ LICENSE
|
|
326
|
+
โโโ README.md
|
|
327
|
+
```
|
|
328
|
+
|
|
329
|
+
## ๐งช Development
|
|
330
|
+
|
|
331
|
+
```bash
|
|
332
|
+
git clone https://github.com/SanjaySundarMurthy/yaml-doctor.git
|
|
333
|
+
cd yaml-doctor
|
|
334
|
+
pip install -e ".[dev]"
|
|
335
|
+
pytest
|
|
336
|
+
ruff check .
|
|
337
|
+
```
|
|
338
|
+
|
|
339
|
+
## ๐ License
|
|
340
|
+
|
|
341
|
+
MIT License โ see [LICENSE](LICENSE) for details.
|
|
342
|
+
|
|
343
|
+
## ๐จโ๐ป Author
|
|
344
|
+
|
|
345
|
+
**Sanjay S** โ [GitHub](https://github.com/SanjaySundarMurthy) ยท [Email](mailto:sanjaysundarmurthy@gmail.com)
|
|
@@ -0,0 +1,312 @@
|
|
|
1
|
+
# ๐ฉบ yaml-doctor
|
|
2
|
+
|
|
3
|
+
**YAML Linter & Security Scanner for DevOps Engineers**
|
|
4
|
+
|
|
5
|
+
Validate and lint Kubernetes manifests, Docker Compose files, GitHub Actions workflows, GitLab CI pipelines, and generic YAML with **60+ built-in rules** covering security, reliability, and best practices.
|
|
6
|
+
|
|
7
|
+
[](https://pypi.org/project/yaml-doctor/)
|
|
8
|
+
[](https://pypi.org/project/yaml-doctor/)
|
|
9
|
+
[](https://opensource.org/licenses/MIT)
|
|
10
|
+
[]()
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## โจ Features
|
|
15
|
+
|
|
16
|
+
- ๐ **60+ Lint Rules** โ Security, reliability, and best practice checks
|
|
17
|
+
- ๐ฏ **Auto-Detection** โ Automatically identifies Kubernetes, Docker Compose, GitHub Actions, GitLab CI, and Helm files
|
|
18
|
+
- ๐ **Grading System** โ A+ to F grades with detailed scoring
|
|
19
|
+
- ๐ **HTML Dashboard** โ Beautiful dark-theme HTML reports with severity charts
|
|
20
|
+
- ๐ **JSON Export** โ Machine-readable reports for CI/CD integration
|
|
21
|
+
- ๐ง **Fix Suggestions** โ Actionable remediation for every finding
|
|
22
|
+
- ๐ฎ **Demo Mode** โ Try it instantly with built-in sample files
|
|
23
|
+
- ๐ **Zero Config** โ Works out of the box, no configuration needed
|
|
24
|
+
|
|
25
|
+
## ๐ฆ Installation
|
|
26
|
+
|
|
27
|
+
```bash
|
|
28
|
+
pip install yaml-doctor
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
## ๐ Quick Start
|
|
32
|
+
|
|
33
|
+
```bash
|
|
34
|
+
# Lint a single file
|
|
35
|
+
yaml-doctor lint deployment.yaml
|
|
36
|
+
|
|
37
|
+
# Scan a directory recursively
|
|
38
|
+
yaml-doctor scan ./k8s/
|
|
39
|
+
|
|
40
|
+
# Run demo with sample files
|
|
41
|
+
yaml-doctor demo
|
|
42
|
+
|
|
43
|
+
# Show all 60 rules
|
|
44
|
+
yaml-doctor rules
|
|
45
|
+
|
|
46
|
+
# Get fix suggestions
|
|
47
|
+
yaml-doctor fix deployment.yaml
|
|
48
|
+
|
|
49
|
+
# Export HTML dashboard
|
|
50
|
+
yaml-doctor scan . --html report.html
|
|
51
|
+
|
|
52
|
+
# Export JSON report
|
|
53
|
+
yaml-doctor lint config.yaml -j report.json
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
## ๐ฏ Supported File Types
|
|
57
|
+
|
|
58
|
+
| Type | Detection | Rules |
|
|
59
|
+
|------|-----------|-------|
|
|
60
|
+
| **Kubernetes** | `apiVersion` + `kind` | 20 rules (K8S001-K8S020) |
|
|
61
|
+
| **Docker Compose** | `services` + `image/build` | 12 rules (DC001-DC012) |
|
|
62
|
+
| **GitHub Actions** | `.github/workflows/` + `on/jobs` | 10 rules (GHA001-GHA010) |
|
|
63
|
+
| **GitLab CI** | `.gitlab-ci.yml` + `stages/script` | 10 rules (GL001-GL010) |
|
|
64
|
+
| **Helm** | `Chart.yaml` / `values.yaml` | K8s rules applied |
|
|
65
|
+
| **Generic YAML** | Any `.yml`/`.yaml` file | 8 rules (YML001-YML008) |
|
|
66
|
+
|
|
67
|
+
## ๐ Security Rules
|
|
68
|
+
|
|
69
|
+
### Kubernetes (20 rules)
|
|
70
|
+
|
|
71
|
+
| Rule | Severity | Description |
|
|
72
|
+
|------|----------|-------------|
|
|
73
|
+
| K8S001 | ๐ด CRITICAL | Container running as root |
|
|
74
|
+
| K8S004 | ๐ด CRITICAL | Privileged container |
|
|
75
|
+
| K8S002 | ๐ HIGH | Missing resource limits |
|
|
76
|
+
| K8S003 | ๐ HIGH | Missing resource requests |
|
|
77
|
+
| K8S005 | ๐ HIGH | Using `:latest` image tag |
|
|
78
|
+
| K8S006 | ๐ HIGH | Missing liveness probe |
|
|
79
|
+
| K8S011 | ๐ HIGH | Host network enabled |
|
|
80
|
+
| K8S012 | ๐ HIGH | Host PID enabled |
|
|
81
|
+
| K8S016 | ๐ HIGH | Secrets in environment variables |
|
|
82
|
+
| K8S007 | ๐ก MEDIUM | Missing readiness probe |
|
|
83
|
+
| K8S008 | ๐ก MEDIUM | Read-only filesystem not set |
|
|
84
|
+
| K8S013 | ๐ก MEDIUM | Single replica deployment |
|
|
85
|
+
| K8S014 | ๐ก MEDIUM | Privilege escalation allowed |
|
|
86
|
+
| K8S017 | ๐ก MEDIUM | Missing update strategy |
|
|
87
|
+
| K8S018 | ๐ก MEDIUM | Capabilities not dropped |
|
|
88
|
+
| K8S020 | ๐ก MEDIUM | Missing restart policy |
|
|
89
|
+
| K8S009 | ๐ต LOW | Missing recommended labels |
|
|
90
|
+
| K8S015 | ๐ต LOW | Missing PodDisruptionBudget |
|
|
91
|
+
| K8S019 | ๐ต LOW | No anti-affinity rules |
|
|
92
|
+
| K8S010 | โช INFO | Missing namespace |
|
|
93
|
+
|
|
94
|
+
### Docker Compose (12 rules)
|
|
95
|
+
|
|
96
|
+
| Rule | Severity | Description |
|
|
97
|
+
|------|----------|-------------|
|
|
98
|
+
| DC002 | ๐ด CRITICAL | Privileged container |
|
|
99
|
+
| DC001 | ๐ HIGH | Using `:latest` tag |
|
|
100
|
+
| DC005 | ๐ HIGH | Secrets in environment |
|
|
101
|
+
| DC009 | ๐ HIGH | Host volume with write access |
|
|
102
|
+
| DC012 | ๐ก MEDIUM | Host network mode |
|
|
103
|
+
| DC003 | ๐ก MEDIUM | No restart policy |
|
|
104
|
+
| DC004 | ๐ก MEDIUM | No healthcheck defined |
|
|
105
|
+
| DC007 | ๐ก MEDIUM | Exposed to all interfaces |
|
|
106
|
+
| DC011 | ๐ก MEDIUM | No depends_on |
|
|
107
|
+
| DC006 | ๐ต LOW | No resource limits |
|
|
108
|
+
| DC010 | ๐ต LOW | No logging configuration |
|
|
109
|
+
| DC008 | โช INFO | Deprecated version key |
|
|
110
|
+
|
|
111
|
+
### GitHub Actions (10 rules)
|
|
112
|
+
|
|
113
|
+
| Rule | Severity | Description |
|
|
114
|
+
|------|----------|-------------|
|
|
115
|
+
| GHA001 | ๐ด CRITICAL | Mutable action reference (using @main) |
|
|
116
|
+
| GHA002 | ๐ HIGH | Persist credentials enabled |
|
|
117
|
+
| GHA003 | ๐ HIGH | Secrets in run commands |
|
|
118
|
+
| GHA009 | ๐ HIGH | Script injection risk |
|
|
119
|
+
| GHA004 | ๐ก MEDIUM | Overly broad permissions |
|
|
120
|
+
| GHA005 | ๐ก MEDIUM | No job timeout |
|
|
121
|
+
| GHA006 | ๐ก MEDIUM | pull_request_target trigger |
|
|
122
|
+
| GHA007 | ๐ต LOW | No concurrency control |
|
|
123
|
+
| GHA008 | ๐ต LOW | Unversioned runner image |
|
|
124
|
+
| GHA010 | โช INFO | Missing workflow name |
|
|
125
|
+
|
|
126
|
+
### GitLab CI (10 rules)
|
|
127
|
+
|
|
128
|
+
| Rule | Severity | Description |
|
|
129
|
+
|------|----------|-------------|
|
|
130
|
+
| GL001 | ๐ HIGH | Secrets in script blocks |
|
|
131
|
+
| GL007 | ๐ HIGH | allow_failure on security jobs |
|
|
132
|
+
| GL002 | ๐ก MEDIUM | No retry configuration |
|
|
133
|
+
| GL004 | ๐ก MEDIUM | Using `:latest` image |
|
|
134
|
+
| GL005 | ๐ก MEDIUM | No timeout set |
|
|
135
|
+
| GL009 | ๐ก MEDIUM | No rules/conditions |
|
|
136
|
+
| GL003 | ๐ต LOW | No cache defined |
|
|
137
|
+
| GL008 | ๐ต LOW | No artifacts defined |
|
|
138
|
+
| GL010 | ๐ต LOW | Missing job description |
|
|
139
|
+
| GL006 | โช INFO | No stages defined |
|
|
140
|
+
|
|
141
|
+
### Generic YAML (8 rules)
|
|
142
|
+
|
|
143
|
+
| Rule | Severity | Description |
|
|
144
|
+
|------|----------|-------------|
|
|
145
|
+
| YML005 | ๐ HIGH | Hardcoded credentials |
|
|
146
|
+
| YML001 | ๐ก MEDIUM | Inconsistent indentation |
|
|
147
|
+
| YML006 | ๐ก MEDIUM | Duplicate keys |
|
|
148
|
+
| YML002 | ๐ต LOW | Trailing whitespace |
|
|
149
|
+
| YML003 | ๐ต LOW | Line too long (>200 chars) |
|
|
150
|
+
| YML007 | ๐ต LOW | Empty values |
|
|
151
|
+
| YML004 | โช INFO | Missing document start marker |
|
|
152
|
+
| YML008 | โช INFO | File too long (>1000 lines) |
|
|
153
|
+
|
|
154
|
+
## ๐ Grading System
|
|
155
|
+
|
|
156
|
+
| Grade | Score | Description |
|
|
157
|
+
|-------|-------|-------------|
|
|
158
|
+
| A+ | 95-100 | Excellent โ production ready |
|
|
159
|
+
| A | 85-94 | Great โ minor improvements possible |
|
|
160
|
+
| B | 75-84 | Good โ some issues to address |
|
|
161
|
+
| C | 65-74 | Fair โ significant improvements needed |
|
|
162
|
+
| D | 50-64 | Poor โ many issues found |
|
|
163
|
+
| F | 0-49 | Failing โ critical issues present |
|
|
164
|
+
|
|
165
|
+
**Score deductions per finding:**
|
|
166
|
+
- ๐ด Critical: -15 points
|
|
167
|
+
- ๐ High: -8 points
|
|
168
|
+
- ๐ก Medium: -3 points
|
|
169
|
+
- ๐ต Low: -1 point
|
|
170
|
+
- โช Info: 0 points
|
|
171
|
+
|
|
172
|
+
## ๐ฅ๏ธ CLI Commands
|
|
173
|
+
|
|
174
|
+
### `yaml-doctor lint <file>`
|
|
175
|
+
|
|
176
|
+
Lint a single YAML file with auto-detection.
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
yaml-doctor lint deployment.yaml
|
|
180
|
+
yaml-doctor lint docker-compose.yml --html report.html
|
|
181
|
+
yaml-doctor lint .github/workflows/ci.yml -j report.json
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
### `yaml-doctor scan <directory>`
|
|
185
|
+
|
|
186
|
+
Scan all YAML files in a directory.
|
|
187
|
+
|
|
188
|
+
```bash
|
|
189
|
+
yaml-doctor scan ./k8s/
|
|
190
|
+
yaml-doctor scan . --html dashboard.html
|
|
191
|
+
yaml-doctor scan ./configs --no-recursive
|
|
192
|
+
```
|
|
193
|
+
|
|
194
|
+
### `yaml-doctor demo`
|
|
195
|
+
|
|
196
|
+
Run a demo with built-in sample files.
|
|
197
|
+
|
|
198
|
+
```bash
|
|
199
|
+
yaml-doctor demo
|
|
200
|
+
yaml-doctor demo --type kubernetes
|
|
201
|
+
yaml-doctor demo --type compose
|
|
202
|
+
yaml-doctor demo --html demo-report.html
|
|
203
|
+
```
|
|
204
|
+
|
|
205
|
+
### `yaml-doctor rules`
|
|
206
|
+
|
|
207
|
+
Display all 60 available lint rules.
|
|
208
|
+
|
|
209
|
+
```bash
|
|
210
|
+
yaml-doctor rules
|
|
211
|
+
```
|
|
212
|
+
|
|
213
|
+
### `yaml-doctor fix <file>`
|
|
214
|
+
|
|
215
|
+
Show fix suggestions for all findings.
|
|
216
|
+
|
|
217
|
+
```bash
|
|
218
|
+
yaml-doctor fix deployment.yaml
|
|
219
|
+
```
|
|
220
|
+
|
|
221
|
+
## ๐ CI/CD Integration
|
|
222
|
+
|
|
223
|
+
### GitHub Actions
|
|
224
|
+
|
|
225
|
+
```yaml
|
|
226
|
+
- name: YAML Lint
|
|
227
|
+
run: |
|
|
228
|
+
pip install yaml-doctor
|
|
229
|
+
yaml-doctor scan . --html report.html -j report.json
|
|
230
|
+
|
|
231
|
+
- name: Upload Report
|
|
232
|
+
uses: actions/upload-artifact@v4
|
|
233
|
+
with:
|
|
234
|
+
name: yaml-doctor-report
|
|
235
|
+
path: report.html
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
### GitLab CI
|
|
239
|
+
|
|
240
|
+
```yaml
|
|
241
|
+
yaml-lint:
|
|
242
|
+
stage: test
|
|
243
|
+
script:
|
|
244
|
+
- pip install yaml-doctor
|
|
245
|
+
- yaml-doctor scan . --html report.html -j report.json
|
|
246
|
+
artifacts:
|
|
247
|
+
paths:
|
|
248
|
+
- report.html
|
|
249
|
+
- report.json
|
|
250
|
+
```
|
|
251
|
+
|
|
252
|
+
### Pre-commit Hook
|
|
253
|
+
|
|
254
|
+
```yaml
|
|
255
|
+
# .pre-commit-config.yaml
|
|
256
|
+
repos:
|
|
257
|
+
- repo: local
|
|
258
|
+
hooks:
|
|
259
|
+
- id: yaml-doctor
|
|
260
|
+
name: yaml-doctor
|
|
261
|
+
entry: yaml-doctor lint
|
|
262
|
+
language: python
|
|
263
|
+
types: [yaml]
|
|
264
|
+
additional_dependencies: [yaml-doctor]
|
|
265
|
+
```
|
|
266
|
+
|
|
267
|
+
## ๐ Project Structure
|
|
268
|
+
|
|
269
|
+
```
|
|
270
|
+
yaml-doctor/
|
|
271
|
+
โโโ yaml_doctor/
|
|
272
|
+
โ โโโ __init__.py # Package version
|
|
273
|
+
โ โโโ __main__.py # python -m support
|
|
274
|
+
โ โโโ cli.py # Click CLI commands
|
|
275
|
+
โ โโโ scanner.py # Core scanning engine
|
|
276
|
+
โ โโโ models.py # Data models & enums
|
|
277
|
+
โ โโโ rules.py # Rule registry (60 rules)
|
|
278
|
+
โ โโโ utils.py # Helper utilities
|
|
279
|
+
โ โโโ demo.py # Demo sample data
|
|
280
|
+
โ โโโ analyzers/
|
|
281
|
+
โ โ โโโ __init__.py # File type detection
|
|
282
|
+
โ โ โโโ kubernetes.py # 20 K8s rules
|
|
283
|
+
โ โ โโโ compose.py # 12 Docker Compose rules
|
|
284
|
+
โ โ โโโ github_actions.py # 10 GitHub Actions rules
|
|
285
|
+
โ โ โโโ gitlab_ci.py # 10 GitLab CI rules
|
|
286
|
+
โ โ โโโ yaml_lint.py # 8 generic YAML rules
|
|
287
|
+
โ โโโ output/
|
|
288
|
+
โ โโโ console.py # Rich terminal output
|
|
289
|
+
โ โโโ html_report.py # HTML dashboard reports
|
|
290
|
+
โโโ tests/ # 188 tests
|
|
291
|
+
โโโ pyproject.toml
|
|
292
|
+
โโโ LICENSE
|
|
293
|
+
โโโ README.md
|
|
294
|
+
```
|
|
295
|
+
|
|
296
|
+
## ๐งช Development
|
|
297
|
+
|
|
298
|
+
```bash
|
|
299
|
+
git clone https://github.com/SanjaySundarMurthy/yaml-doctor.git
|
|
300
|
+
cd yaml-doctor
|
|
301
|
+
pip install -e ".[dev]"
|
|
302
|
+
pytest
|
|
303
|
+
ruff check .
|
|
304
|
+
```
|
|
305
|
+
|
|
306
|
+
## ๐ License
|
|
307
|
+
|
|
308
|
+
MIT License โ see [LICENSE](LICENSE) for details.
|
|
309
|
+
|
|
310
|
+
## ๐จโ๐ป Author
|
|
311
|
+
|
|
312
|
+
**Sanjay S** โ [GitHub](https://github.com/SanjaySundarMurthy) ยท [Email](mailto:sanjaysundarmurthy@gmail.com)
|