use anyhow::{Context, Result};
use std::collections::BTreeMap;
use std::path::Path;
use crate::parser;
use crate::repository::{self, DockerignoreProblem};
use crate::rules::{self, Finding, Severity};
pub struct LintOptions {
pub skip_rules: Vec<String>,
pub only_rules: Vec<String>,
pub min_severity: Severity,
pub check_dockerignore: bool,
pub severity_overrides: BTreeMap<String, Severity>,
pub categories: Vec<String>,
pub skip_categories: Vec<String>,
pub inline_suppressions: bool,
pub require_suppression_reason: bool,
pub suppression_reason_pattern: Option<String>,
pub require_suppression_expiration: bool,
pub max_suppression_days: Option<u64>,
pub report_unused_suppressions: bool,
pub approved_registries: Option<Vec<String>>,
pub approved_base_images: Option<Vec<String>>,
pub required_labels: BTreeMap<String, String>,
pub strict_labels: bool,
}
impl Default for LintOptions {
fn default() -> Self {
Self {
skip_rules: Vec::new(),
only_rules: Vec::new(),
min_severity: Severity::Info,
check_dockerignore: true,
severity_overrides: BTreeMap::new(),
categories: Vec::new(),
skip_categories: Vec::new(),
inline_suppressions: true,
require_suppression_reason: false,
suppression_reason_pattern: None,
require_suppression_expiration: false,
max_suppression_days: None,
report_unused_suppressions: false,
approved_registries: None,
approved_base_images: None,
required_labels: BTreeMap::new(),
strict_labels: false,
}
}
}
pub struct LintResult {
pub file: String,
pub findings: Vec<Finding>,
}
pub fn lint_content(content: &str, filename: &str, opts: &LintOptions) -> LintResult {
let mut result = lint_content_without_context(content, filename, opts);
if opts.check_dockerignore && rule_id_enabled(opts, "DF033") {
let context = std::env::current_dir().unwrap_or_else(|_| std::path::PathBuf::from("."));
let stdin_marker = context.join(".droast-stdin");
add_dockerignore_finding(&mut result, &stdin_marker, &context, opts);
}
finalize_findings(content, &mut result.findings, opts);
result
}
fn lint_content_without_context(content: &str, filename: &str, opts: &LintOptions) -> LintResult {
let instructions = parser::parse(content);
let mut findings: Vec<Finding> = Vec::new();
for rule in rules::all_rules() {
if !rule_enabled(opts, &rule) {
continue;
}
if rule.id == "DF065" && opts.approved_registries.is_some() {
continue;
}
let rule_findings = (rule.func)(&instructions, content);
findings.extend(rule_findings);
}
findings.extend(crate::policy::configured_findings(&instructions, opts));
LintResult {
file: filename.to_string(),
findings,
}
}
pub fn lint_file(path: &Path, opts: &LintOptions) -> Result<LintResult> {
let context = path.parent().unwrap_or_else(|| Path::new("."));
lint_file_with_context(path, context, opts)
}
pub fn lint_file_with_context(
path: &Path,
context: &Path,
opts: &LintOptions,
) -> Result<LintResult> {
let content = std::fs::read_to_string(path)
.with_context(|| format!("Failed to read '{}'", path.display()))?;
let mut result = lint_content_without_context(&content, &path.display().to_string(), opts);
if opts.check_dockerignore && rule_id_enabled(opts, "DF033") {
add_dockerignore_finding(&mut result, path, context, opts);
}
finalize_findings(&content, &mut result.findings, opts);
Ok(result)
}
fn rule_enabled(opts: &LintOptions, rule: &rules::Rule) -> bool {
let selected_by_id = opts.only_rules.is_empty()
|| opts
.only_rules
.iter()
.any(|selected| selected.eq_ignore_ascii_case(rule.id));
let selected_by_category = !opts.only_rules.is_empty()
|| opts.categories.is_empty()
|| matches!(rule.id, "DF071" | "DF072")
|| rule.categories().iter().any(|category| {
opts.categories
.iter()
.any(|selected| selected.eq_ignore_ascii_case(category))
});
let skipped_by_category = opts.only_rules.is_empty()
&& rule.categories().iter().any(|category| {
opts.skip_categories
.iter()
.any(|skipped| skipped.eq_ignore_ascii_case(category))
});
selected_by_id
&& selected_by_category
&& !skipped_by_category
&& !opts
.skip_rules
.iter()
.any(|skipped| skipped.eq_ignore_ascii_case(rule.id))
}
pub(crate) fn rule_id_enabled(opts: &LintOptions, id: &str) -> bool {
rules::all_rules()
.iter()
.find(|rule| rule.id.eq_ignore_ascii_case(id))
.is_some_and(|rule| rule_enabled(opts, rule))
}
fn finalize_findings(content: &str, findings: &mut Vec<Finding>, opts: &LintOptions) {
crate::policy::apply_inline_suppressions(content, findings, opts);
for finding in findings.iter_mut() {
if let Some(severity) = opts.severity_overrides.get(finding.rule) {
finding.severity = *severity;
}
}
findings.retain(|finding| finding.severity >= opts.min_severity);
findings.sort_by(|a, b| a.line.cmp(&b.line).then(b.severity.cmp(&a.severity)));
}
fn add_dockerignore_finding(
result: &mut LintResult,
dockerfile: &Path,
context: &Path,
opts: &LintOptions,
) {
if !rule_id_enabled(opts, "DF033") {
return;
}
let problem = match repository::dockerignore_problem(dockerfile, context) {
Ok(problem) => problem,
Err(error) => {
result.findings.push(Finding {
rule: "DF033",
severity: Severity::Info,
line: 0,
message: format!("Cannot read the effective .dockerignore: {error}"),
roast: "The build-context filter is unreadable, so nobody can tell what Docker will receive.".to_string(),
});
return;
}
};
let Some(problem) = problem else {
return;
};
let message = match problem {
DockerignoreProblem::Missing { expected } => format!(
"No effective .dockerignore for build context '{}' (expected '{}')",
context.display(),
expected.display()
),
DockerignoreProblem::Empty { path } => format!(
"Effective .dockerignore '{}' has no exclusion patterns",
path.display()
),
};
result.findings.push(Finding {
rule: "DF033",
severity: Severity::Info,
line: 0,
message,
roast: "This build context has no effective exclusions, so caches, repositories, dependencies, and secrets can all join the image-build road trip.".to_string(),
});
}
pub fn has_errors(findings: &[Finding]) -> bool {
findings.iter().any(|f| f.severity == Severity::Error)
}