rule-example.yaml

- message: all go files
  ruleID: file-001
  description: "Testing that we can get all the go files in the project"
  links:
  - title: "Golang"
    url: "https://go.dev"
  labels:
  - "testing"
  - "test"
  category: potential
  effort: 3
  when:
    builtin.file:
      pattern: "*.go"
- message: not any go files
  ruleID: file-002
  effort: 1
  when:
    builtin.file:
      pattern:  "*.go"
    not: true
- message: POM XML dependencies - '{{{matchingXML}}}'
  ruleID: xml-pom-001
  effort: 1
  when:
    builtin.xml:
      xpath: "//dependencies/dependency"
- message: '{{{matchingXML}}}'
  ruleID: chain-pom-001
  effort: 1
  when:
    or:
    - builtin.xml:
        xpath: "//dependencies/dependency"
        filepaths: "{{poms.filepaths}}"
      from: poms
    - builtin.file:
        pattern: pom.xml
      as: poms
      ignore: true
- message: apiextensions/v1beta1/customresourcedefinitions is deprecated, apiextensions/v1/customresourcedefinitions should be used instead
  ruleID: lang-ref-001
  effort: 1
  when:
    or:
    - java.referenced:
        pattern: "*apiextensions.v1beta1.CustomResourceDefinition*"
        location: TYPE
    - go.referenced:
        pattern: "v1beta1.CustomResourceDefinition"
- message: testing nested conditions
  ruleID: lang-ref-002
  effort: 1
  when:
    # This is purposfully failing, the golang reference will not
    # find anything. testing that `and` will work correctly
    and:
    - go.referenced:
          pattern: "*CustomResourceDefinition*"
    - java.referenced:
          pattern: "*CustomResourceDefinition*"
          location: TYPE
- tag:
    - License={{matchingText}}
  ruleID: tag-license
  when:
    builtin.filecontent:
      pattern: "Apache"
- tag:
    - Language=Golang
  ruleID: tag-go-000
  when:
    builtin.file:
      pattern: "go.mod"
- tag:
    - Infra=Kubernetes
  ruleID: tag-k8s-000
  when:
    builtin.filecontent:
      pattern: ".*k8s.io/.*"
      filePattern: ".*go.mod"
- tag:
    - Java
  ruleID: tag-java-000
  when:
    or:
      - builtin.file:
          pattern: "pom.xml"
      - builtin.file:
          pattern: "*.ear"
      - builtin.file:
          pattern: "*.jar"
      - builtin.file:
          pattern: "*.war"
- message: "Tags {{tags}} found"
  ruleID: tech-tag-001
  when:
    or:
    - builtin.hasTags:
      - Golang
      - Kubernetes
    - builtin.hasTags:
      - Java
- message: "error test"
  ruleID: error-rule-001
  effort: 1
  when:
    builtin.xml:
      xpath:
        invalid-query: "test"
- message: "JBoss 5.x EAR descriptor (jboss-app.xml) was found with public-id"
  ruleID: jboss-eap5-7-xml-02000
  effort: 1
  when:
    builtin.xmlPublicID:
      regex: .*JBoss.+DTD Java EE.+5.*
- message: "Tags {{tags}} found, creating message and new tag both"
  ruleID: multiple-actions-001
  tag:
  - Backend=Golang
  when:
    builtin.hasTags:
    - Golang
- message: "Found usage of openjdk base image"
  ruleID: filecontent-codesnip-test
  effort: 1
  when:
    builtin.filecontent:
      pattern: "^FROM.*openjdk-11.*"
      filePattern: "Dockerfile"

- category: potential
  description: "Test code snippets when match is a key of a XML node"
  message: "The code snippet should point to <beans> in the beans.xml file"
  ruleID: xml-test-key-match
  effort: 1
  when:
    builtin.xml:
      filepaths:
      - beans.xml
      namespaces:
        b: http://xmlns.jcp.org/xml/ns/javaee
      xpath: /b:beans
- category: optional
  description: |
    This is same as java-io-file-usage but for the builtin providers. There are multiple instances of the same incidents in different directories.
    We are filtering some out using includedPaths setting.
  message: Only incidents in dir-0/test.json should be found
  ruleID: builtin-inclusion-test-json
  effort: 1
  when:
    and:
    - builtin.json:
        xpath: //inclusionTestNode
        filepaths: "{{incTest.filepaths}}"
      from: incTest
    - builtin.file:
        pattern: inclusion-test.json
      as: incTest
      ignore: true
- category: optional
  description: |
    This is same as java-io-file-usage but for the builtin providers. There are multiple instances of the same incidents in different directories.
    We are filtering some out using includedPaths setting.
  message: Only incidents in dir-0/test.xml should be found
  ruleID: builtin-inclusion-test-xml
  effort: 1
  when:
    and:
    - builtin.xml:
        xpath: //inclusionTestNode
        filepaths: "{{incTest.filepaths}}"
      from: incTest
    - builtin.file:
        pattern: inclusion-test.xml
      as: incTest
- message: Found React import in .tsx file
  ruleID: test-tsx-support-00000
  description: Test that .tsx files are scanned (builtin provider)
  effort: 1
  category: potential
  when:
    builtin.filecontent:
      pattern: "import.*React"
      filePattern: "\\.tsx$"
- message: Found React reference using regex pattern
  ruleID: test-regex-pattern-00000
  description: Test regex pattern for TypeScript/JavaScript files
  effort: 1
  category: potential
  when:
    builtin.filecontent:
      pattern: "React"
      filePattern: "\\.(j|t)sx?$"
- message: Found PatternFly CSS variable using regex pattern
  ruleID: test-regex-pattern-00010
  description: Test regex pattern for CSS/SCSS files
  effort: 1
  category: potential
  when:
    builtin.filecontent:
      pattern: "--pf-"
      filePattern: "\\.(css|scss)$"
- message: 'System.Net.WebClient found. Consider replacing with System.Net.Http.HttpClient.'
  ruleID: dotnet-deprecated-001
  effort: 2
  when:
    c-sharp.referenced:
      pattern: "System.Console"
      location: CLASS