fix(validate): run the five checks that were CI-only, from one copy each (#175) - #317

Closes #175. All five checks now run locally, from one implementation each.

Plus scripts/check-tracked-artefacts.sh, replacing the two divergent copies.

The three greps went where the issue suggested

check_image_pins.py already runs in both places, and its docstring already explains why a grep cannot see a pin that is simply absent (#65). The greps that paragraph is about now sit beside the parser, so it is checkable rather than a note about code elsewhere.

Scope is git ls-files, not a walk of . — the one deliberate change in behaviour. The shell versions walked the tree, which is right in CI's clean checkout and wrong locally: this repository keeps git worktrees under .claude/worktrees/, so a local run would have descended into full copies of itself and reported another branch's findings as this one's. Verified: an untracked :latest under .claude/ produces zero hits. Tracked is also the right question, since an untracked scratch file pinning :latest harms nobody.

The floating-tag check keeps the original's blind spot on purpose. FOO=alpine:latest is not caught — both the old grep and this require start-of-line or whitespace before the name. Confirmed identical against the same input. Parity rather than regression, and still a real gap if anyone wants it closed separately.

The digest check reads parsed YAML rather than awk '$1 == "image:"', so a quoted or flow-style value is not a hole, and it fails rather than passes when it finds no compose files.

The tracked-artefact divergence

The issue's table, re-tested against the new single implementation:

The patterns are unanchored, which is where the old copy went wrong: ^certificates/ matched only at the repository root, and a secret does not become safe by being nested.

Two things that bit during the work

• The emitted PromQL file needed chmod 0644. mktemp creates 0600, and when PROMTOOL is the docker fallback the reader is the image's own unprivileged user — it fails as permission denied, which looks exactly like a broken query and is not one. It is also written inside REPO_ROOT, because that fallback bind-mounts REPO_ROOT and nothing else.
• check-sops-encrypted.sh fails when the glob matches nothing, rather than reporting "all encrypted" over zero files. That is the --emit-promql guard's argument (make validate and CI have drifted apart in both directions #68) applied to the one artefact whose absence would otherwise be silent.

Checks

validate.sh — 48 PASS (up from 45), 0 FAIL, 2 SKIP, the usual environmental two. New lines:

  PASS observability: dashboard panel queries parse as PromQL
  PASS lab: no dashboards — no panel queries to parse
  PASS every SOPS file is encrypted
  PASS no rendered, decrypted, purge-secrets, certificate or backup files tracked

Each folded-in check was also tested against a violation in a throwaway clone: a version pin outside compose.yaml, a space-preceded :latest, and a digest stripped from a real image were all caught with the right message.

🤖 Generated with Claude Code