rule-example.yaml

- message: all go files
  ruleID: file-001
  description: "Testing that we can get all the go files in the project"
  links:
  - title: "Golang"
    url: "https://go.dev"
  labels:
  - "testing"
  - "test"
  category: potential
  effort: 3
  when:
    builtin.file:
      pattern: "*.go"
- message: not any go files
  ruleID: file-002
  when:
    builtin.file:
      pattern:  "*.go"
    not: true
- message: POM XML dependencies - '{{{matchingXML}}}'
  ruleID: xml-pom-001
  when:
    builtin.xml:
      xpath: "//dependencies/dependency"
- message: '{{{matchingXML}}}'
  ruleID: chain-pom-001
  when:
    or:
    - builtin.xml:
        xpath: "//dependencies/dependency"
        filepaths: "{{poms.extras.filepaths}}"
      from: poms
    - builtin.file:
        pattern: pom.xml
      as: poms
      ignore: true
- message: apiextensions/v1beta1/customresourcedefinitions is deprecated, apiextensions/v1/customresourcedefinitions should be used instead
  ruleID: lang-ref-001
  when:
    or:
    - java.referenced:
        pattern: "*apiextensions.v1beta1.CustomResourceDefinition*"
        location: TYPE
    - go.referenced:
        pattern: "v1beta1.CustomResourceDefinition"
- message: 'golang apiextensions/v1/customresourcedefinitions found {{file}}:{{lineNumber}}'
  ruleID: go-lang-ref-001
  when:
    go.referenced:
        pattern: "v1beta1.CustomResourceDefinition"
- message: testing nested conditions
  ruleID: lang-ref-002
  when:
    # This is purposfully failing, the golang reference will not
    # find anything. testing that `and` will work correctly
    and:
    - go.referenced:
          pattern: "*CustomResourceDefinition*"
    - java.referenced:
          pattern: "*CustomResourceDefinition*"
          location: TYPE
- message: 'java found apiextensions/v1/customresourcedefinitions found {{file}}:{{lineNumber}}'
  ruleID: lang-ref-003
  when:
    java.referenced:
      pattern: "*apiextensions.v1beta1.CustomResourceDefinition*"
      location: TYPE
- tag:
    - License={{matchingText}}
  ruleID: tag-license
  when:
    builtin.filecontent:
      pattern: "Apache"
- tag:
    - Language=Golang
  ruleID: tag-go-000
  when:
    builtin.file:
      pattern: "go.mod"
- tag:
    - Infra=Kubernetes
  ruleID: tag-k8s-000
  when:
    builtin.filecontent:
      pattern: ".*k8s.io/.*"
      filePattern: ".*go.mod"
- tag:
    - Java
  ruleID: tag-java-000
  when:
    or:
      - builtin.file:
          pattern: "pom.xml"
      - builtin.file:
          pattern: "*.ear"
      - builtin.file:
          pattern: "*.jar"
      - builtin.file:
          pattern: "*.war"
- message: "Tags {{tags}} found"
  ruleID: tech-tag-001
  when:
    or:
    - builtin.hasTags:
      - Golang
      - Kubernetes
    - builtin.hasTags:
      - Java
- message: "dependency {{name}} with {{version}} is bad and you should feel bad for using it"
  ruleID: golang-gomod-dependencies
  when:
    and:
      - go.dependency:
          name: golang.org/x/text
          upperbound: v0.3.8
      - go.dependency:
          name: k8s.io/apimachinery
          lowerbound: v0.24.3
      - go.dependency:
          name: sigs.k8s.io/structured-merge-diff/v4
          lowerbound: v4.2.0
          upperbound: v4.2.2
- message: "dependency {{name}} with {{version}} is bad and you should feel bad for using it"
  ruleID: java-pomxml-dependencies
  when:
    and:
      - java.dependency:
          name: junit.junit
          upperbound: 4.12.2
          lowerbound: 4.4.0
      - java.dependency:
          name: io.fabric8.kubernetes-client
          lowerbound: 5.0.100
- message: "found generic call"
  ruleID: lang-ref-004
  customVariables:
   - pattern: '([A-z]+)\.get\(\)'
     name: VariableName
  when:
    java.referenced:
      location: METHOD_CALL
      pattern: com.example.apps.GenericClass.get
- message: condition entries should evaluate out of order
  ruleID: singleton-sessionbean-00001
  when:
    or:
    - as: sessionbean
      from: singleton
      java.referenced:
        location: IMPLEMENTS_TYPE
        pattern: javax.ejb.SessionBean
    - as: singleton
      java.referenced:
        location: ANNOTATION
        pattern: javax.ejb.Singleton
- message: condition entries should evaluate in order
  ruleID: singleton-sessionbean-00002
  when:
    or:
    - as: singleton
      java.referenced:
        location: ANNOTATION
        pattern: javax.ejb.Singleton
    - as: sessionbean
      from: singleton
      java.referenced:
        location: IMPLEMENTS_TYPE
        pattern: javax.ejb.SessionBean
- message: "error test"
  ruleID: error-rule-001
  when:
    builtin.xml:
      xpath:
        invalid-query: "test"
- message: "JBoss 5.x EAR descriptor (jboss-app.xml) was found with public-id"
  ruleID: jboss-eap5-7-xml-02000
  when:
    builtin.xmlPublicID:
      regex: .*JBoss.+DTD Java EE.+5.*
- message: "Tags {{tags}} found, creating message and new tag both"
  ruleID: multiple-actions-001
  tag:
  - Backend=Golang
  when:
    builtin.hasTags:
    - Golang
- message: "Found usage of openjdk base image"
  ruleID: filecontent-codesnip-test
  when:
    builtin.filecontent:
      pattern: "^FROM.*openjdk-11.*"
      filePattern: "Dockerfile"

- message: python sample rule 001
  ruleID: python-sample-rule-001
  when:
    python.referenced:
      pattern: "hello_world"
- message: python sample rule 002
  ruleID: python-sample-rule-002
  when:
    python.referenced:
      pattern: "speak"
- message: python sample rule 003
  ruleID: python-sample-rule-003
  when:
    python.referenced:
      pattern: "create_custom_resource_definition"
- message: Deprecated/removed Kubernetes API version 'extensions/v1beta1' is used for 'Deployment'. Consider using 'apps/v1'.
  ruleID: k8s-deprecated-api-001
  description: "Check for usage of deprecated Kubernetes API versions"
  category: potential
  effort: 2
  when:
    yaml.k8sResourceMatched:
        apiVersion: "extensions/v1beta1"
        kind: "Deployment"
        deprecatedIn: "v1.9.0"
        removedIn: "v1.16.0"
        replacementAPI: "apps/v1"
- message: Deprecated Kubernetes API version 'apps/v1beta1' is used for 'StatefulSet'. Consider using 'apps/v1'.
  ruleID: k8s-deprecated-api-002
  description: "Check for usage of deprecated Kubernetes API versions"
  category: potential
  effort: 2
  when:
    yaml.k8sResourceMatched:
        apiVersion: "extensions/v1beta1"
        kind: "ReplicaSet"
        deprecatedIn: "v1.9.0"
        removedIn: "v1.16.0"
        replacementAPI: "apps/v1"
- category: potential
  description: "Test code snippets when match is a key of a XML node"
  message: "The code snippet should point to <beans> in the beans.xml file"
  ruleID: xml-test-key-match
  when:
    builtin.xml:
      filepaths:
      - beans.xml
      namespaces:
        b: http://xmlns.jcp.org/xml/ns/javaee
      xpath: /b:beans
- category: potential
  description: Move to Jakarta EE Maven Artifacts - replace groupId javax.activation
  effort: 1
  message: If you migrate your application to JBoss EAP 7.3, or later, and want to
    ensure its Maven building, running or testing works as expected, use instead the
    Jakarta EE dependency with groupId `com.sun.activation`
  ruleID: maven-javax-to-jakarta-00002
  when:
    java.dependency:
      lowerbound: 0.0.0
      name: javax.activation.activation
- category: mandatory
  description: |
    This rule tests includedPaths config of the java provider. There should be two instances of this issue in the example app. 
    We are filtering one of them using includedPaths in provider config.
  effort: 3
  message: Only incidents in util/FileReader.java should be found
  ruleID: java-inclusion-test
  when:
    java.referenced:
      pattern: java.io.File
- category: optional
  description: |
    This is same as java-io-file-usage but for the builtin providers. There are multiple instances of the same incidents in different directories.
    We are filtering some out using includedPaths setting.
  message: Only incidents in dir-0/test.json should be found
  ruleID: builtin-inclusion-test-json
  when:
    and:
    - builtin.json:
        xpath: //inclusionTestNode
    - builtin.file:
        pattern: inclusion-test.json
    - builtin.filecontent:
        pattern: "inclusionTestNode"
- category: optional
  description: |
    This is same as java-io-file-usage but for the builtin providers. There are multiple instances of the same incidents in different directories.
    We are filtering some out using includedPaths setting.
  message: Only incidents in dir-0/test.xml should be found
  ruleID: builtin-inclusion-test-xml
  when:
    and:
    - builtin.xml:
        xpath: //inclusionTestNode
    - builtin.file:
        pattern: inclusion-test.xml
    - builtin.filecontent:
        pattern: "<inclusionTestNode>"