Earthly Lunar is a Guardrails Engine for your Engineering Stack

- on: [all-services]
  hook:
    type: code
  runBash: |-
    # Download codeowners-validator
    # from github.com/mszostok/codeowners-validator
    curl -L ...

    # Check if CODEOWNERS file doesn't exist
    if [ ! -f .github/CODEOWNERS ]; then
      lunar collect ".repo.codeowners.exists" false
      exit 0
    fi
    lunar collect ".repo.codeowners.exists" true

    # Validate CODEOWNERS file syntax and format
    if ! codeowners-validator -c .github/CODEOWNERS > validation_output.txt 2>&1; then
      lunar collect ".repo.codeowners.valid" false
      error=$(cat validation_output.txt)
      lunar collect ".repo.codeowners.validation_error" "$error"
    else
      lunar collect ".repo.codeowners.valid" true
    fi

    # Count teams referenced in CODEOWNERS
    teams=$(grep -oP '@\S+' .github/CODEOWNERS | sort -u | wc -l)
    lunar collect ".repo.codeowners.teams_count" "$teams"

- enforcement: block-pr
  runPython: |-
    with Check("codeowners", "CODEOWNERS file must be valid") as c:
      c.assert_equals(".repo.codeowners.exists", True)
      is_valid = c.get(".repo.codeowners.valid", False)
      if not is_valid:
        validation_error = c.get(".repo.codeowners.validation_error", "Unknown validation error")
        c.fail(f"CODEOWNERS file validation failed: {validation_error}")

      teams_count = c.get(".repo.codeowners.teams_count", 0)
      if teams_count == 0:
        c.fail("CODEOWNERS file must reference at least one team")

- on: [all-services]
  hook:
    type: code
  runBash: |-
    yq e -o=j -I=0 \
      '.spec.template.spec.containers[].resources' \
      deployment.yaml | jq -s | lunar collect ".kubernetes.deployment.resources" -

- enforcement: block-pr
  runPython: |-
    with Check("k8s", "K8s manifest must define resource requirements") as c:
      c.assert_exists(".kubernetes.deployment.resources.requests.cpu")
      c.assert_exists(".kubernetes.deployment.resources.requests.memory")

- on: [all-services]
  hook:
    type: code
  runBash: |-
    # Download dockerfile-json
    # from github.com/keilerkonzept/dockerfile-json
    curl -L ...
    
    # Find all Dockerfiles and parse them into JSON ASTs
    find . -name 'Dockerfile' -o -name '*.Dockerfile' | while read -r file; do
      json=$(dockerfile-json "$file")
      echo "{\"path\":\"${file#./}\", \"json\": $json}"
    done > dockerfiles.json
    
    # Combine into an array
    jq -s '.' dockerfiles.json > dockerfile_asts.json
    
    # Extract referenced base images
    jq '[.[] | {path: .path, tags: [((.json.Stages // [])[] | (.From.Image // empty))]}]' \
      dockerfile_asts.json | lunar collect -j ".dockerfile.images" -

- enforcement: block-pr
  runPython: |-
    with Check("dockerfiles", "Prevent Dockerfile :latest tags") as c:
      imgs = c.get(".dockerfile.images")
      for dockerfile in imgs:
        for image in dockerfile.get("tags", []):
          if ":latest" in image:
            path = dockerfile.get("path", "")
            c.fail(f'File \"{path}\" contains images with \"latest\" tag: \"{image}\"')

collectors:
  - on: [all-services]
    hook:
      type: ci-before-command
      pattern: ^snyk.*
    runBash: |-
      lunar collect ".snyk.ran" true

- enforcement: score
  runPython: |-
    with Check("use-snyk", "Must use Snyk") as c:
      c.assert_exists(".snyk.ran")

- on: [all-services]
  hook:
    type: code
  runBash: |-
    # Check for structured logging libraries
    if grep -qE "(winston|pino|bunyan)" package.json 2>/dev/null || \
       grep -qE "(logrus|zap)" go.mod 2>/dev/null || \
       grep -qE "(structlog|python-json-logger)" requirements.txt 2>/dev/null; then
      lunar collect ".observability.structured_logging.enabled" true
    else
      lunar collect ".observability.structured_logging.enabled" false
    fi

- enforcement: block-pr
  runPython: |-
    with Check("structured-logging", "Structured logging must be enabled") as c:
      c.assert_equals(".observability.structured_logging.enabled", True,
        message="Production services must use structured logging (winston, pino, logrus, zap, or structlog)")

- on: [all-services]
  hook:
    type: ci-after-command
    pattern: ^(syft|cyclonedx|trivy).*sbom.*
  runBash: |-
    lunar collect ".compliance.sbom.generated" true
    # Extract SBOM format if available
    if echo "$COMMAND" | grep -q "cyclonedx"; then
      lunar collect ".compliance.sbom.format" "cyclonedx"
    elif echo "$COMMAND" | grep -q "spdx"; then
      lunar collect ".compliance.sbom.format" "spdx"
    fi

- enforcement: block-pr
  runPython: |-
    with Check("nist-ssdf-sbom", "NIST SSDF: SBOM must be generated") as c:
      c.assert_exists(".compliance.sbom.generated",
        message="NIST Secure Software Development Framework requires SBOM generation")
      sbom_format = c.get(".compliance.sbom.format", None)
      if sbom_format not in ["cyclonedx", "spdx"]:
        c.fail("SBOM must use CycloneDX or SPDX format")

- on: [all-services]
  use: github.com/earthly/lunar-lib/collectors/claude
  with:
    prompt: Analyze this codebase and identify all public APIs (exported functions, public methods, HTTP endpoints, etc.). For each API, provide 1. The API name (function/method/endpoint name), 2. File path where it's defined, 3. Line number where it starts, 4. A brief summary of what it does, 5. A documentation score from 0 to 1. Consider docstrings, inline comments, parameter descriptions, return value documentation, and usage examples.
    path: ".apis.public"
    jsonSchema: ...

- enforcement: report-pr
  runPython: |-
    with Check("api-documentation", "Public APIs must be well-documented") as c:
      for api in c.get(".apis.public", []):
        score = api.get("documentation_score", 0)
        c.assert_greater(score, 0.5, message=f"{api['name']} at {api['file_path']}:{api['line_number']} has score {score:.2f}")