feat: add 5 best-practice checks and 16 tests to validator (37 → 53)

New Tier 2 WARN checks: __init__.py, .dockerignore, CORS/rate-limit
middleware, migration file structure, health endpoint in code.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baijum

tests/fixtures/valid-app/.dockerignore

@@ -0,0 +1,5 @@
+.git
+.github
+__pycache__
+.env
+*.md

tests/fixtures/valid-app/app/__init__.py

@@ -0,0 +1,2 @@
+"""initial migration"""
+revision = "0001"

tests/fixtures/valid-app/app/alembic/versions/0001_initial.py

@@ -1,4 +1,6 @@
 from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from slowapi import Limiter
 
 app = FastAPI()
 

tests/fixtures/valid-app/app/main.py

@@ -204,6 +204,113 @@ def test_no_alembic_dep_skips(self, tmp_path):
         assert has_result(v, Result.SKIP, "Alembic config")
 
 
+class TestTier2InitPy:
+    def test_init_py_present_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "app/__init__.py exists")
+
+    def test_init_py_missing_warns(self, tmp_path):
+        (tmp_path / "app").mkdir()
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_init_py()
+        assert has_result(v, Result.WARN, "app/__init__.py exists")
+
+
+class TestTier2Dockerignore:
+    def test_dockerignore_all_present_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, ".dockerignore exists")
+        assert has_result(v, Result.PASS, ".dockerignore excludes .git")
+        assert has_result(v, Result.PASS, ".dockerignore excludes .env")
+
+    def test_dockerignore_missing_warns(self, tmp_path):
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_dockerignore()
+        assert has_result(v, Result.WARN, ".dockerignore exists")
+
+    def test_dockerignore_missing_git_warns(self, tmp_path):
+        (tmp_path / ".dockerignore").write_text(".env\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_dockerignore()
+        assert has_result(v, Result.WARN, ".dockerignore excludes .git")
+
+    def test_dockerignore_missing_env_warns(self, tmp_path):
+        (tmp_path / ".dockerignore").write_text(".git\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_dockerignore()
+        assert has_result(v, Result.WARN, ".dockerignore excludes .env")
+
+
+class TestTier2Middleware:
+    def test_both_middleware_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "CORS middleware referenced")
+        assert has_result(v, Result.PASS, "Rate limiting referenced")
+
+    def test_missing_cors_warns(self, tmp_path):
+        (tmp_path / "app").mkdir()
+        (tmp_path / "app" / "main.py").write_text("from fastapi import FastAPI\nfrom slowapi import Limiter\napp = FastAPI()\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_middleware()
+        assert has_result(v, Result.WARN, "CORS middleware referenced")
+
+    def test_missing_rate_limiting_warns(self, tmp_path):
+        (tmp_path / "app").mkdir()
+        (tmp_path / "app" / "main.py").write_text("from fastapi import FastAPI\nfrom fastapi.middleware.cors import CORSMiddleware\napp = FastAPI()\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_middleware()
+        assert has_result(v, Result.WARN, "Rate limiting referenced")
+
+
+class TestTier2MigrationStructure:
+    def test_migration_structure_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "Migration versions present")
+
+    def test_no_alembic_dep_skips(self, tmp_path):
+        (tmp_path / "requirements.txt").write_text("fastapi\nuvicorn\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_migration_structure()
+        assert has_result(v, Result.SKIP, "Migration structure")
+
+    def test_missing_versions_dir_warns(self, tmp_path):
+        (tmp_path / "requirements.txt").write_text("fastapi\nalembic\n")
+        (tmp_path / "app").mkdir()
+        (tmp_path / "app" / "alembic").mkdir()
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_migration_structure()
+        assert has_result(v, Result.WARN, "Migration versions directory")
+
+    def test_empty_versions_dir_warns(self, tmp_path):
+        (tmp_path / "requirements.txt").write_text("fastapi\nalembic\n")
+        (tmp_path / "app" / "alembic" / "versions").mkdir(parents=True)
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_migration_structure()
+        assert has_result(v, Result.WARN, "Migration versions present")
+
+
+class TestTier2HealthEndpointCode:
+    def test_health_in_main_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "Health endpoint in code")
+
+    def test_no_health_endpoint_warns(self, tmp_path):
+        (tmp_path / "app").mkdir()
+        (tmp_path / "app" / "main.py").write_text("from fastapi import FastAPI\napp = FastAPI()\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_health_endpoint_code()
+        assert has_result(v, Result.WARN, "Health endpoint in code")
+
+    def test_health_in_router_passes(self, tmp_path):
+        (tmp_path / "app").mkdir()
+        (tmp_path / "app" / "main.py").write_text("from fastapi import FastAPI\napp = FastAPI()\n")
+        (tmp_path / "app" / "routers").mkdir()
+        (tmp_path / "app" / "routers" / "health.py").write_text('@router.get("/health")\ndef health(): return {"status":"ok"}\n')
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_health_endpoint_code()
+        assert has_result(v, Result.PASS, "Health endpoint in code")
+
+
 class TestTier3WithMocking:
     """Tier 3 tests using mocked subprocess.run — no Docker required."""
 

tests/test_validator.py

@@ -130,6 +130,11 @@ def check_content(self):
         self._check_alembic_config()
         self._check_resource_limits()
         self._check_read_only_fs()
+        self._check_init_py()
+        self._check_dockerignore()
+        self._check_middleware()
+        self._check_migration_structure()
+        self._check_health_endpoint_code()
 
     def _check_compose(self):
         content = self._read("deploy", "docker-compose.yml")
@@ -384,6 +389,85 @@ def _check_read_only_fs(self):
         else:
             self._record(Result.WARN, "Read-only filesystem enabled", "read_only: true not found")
 
+    def _check_init_py(self):
+        if self._exists("app", "__init__.py"):
+            self._record(Result.PASS, "app/__init__.py exists")
+        else:
+            self._record(Result.WARN, "app/__init__.py exists", "missing — app/ may not be importable as a package")
+
+    def _check_dockerignore(self):
+        content = self._read(".dockerignore")
+        if content is None:
+            self._record(Result.WARN, ".dockerignore exists", "missing — builds may include unnecessary files")
+            return
+
+        self._record(Result.PASS, ".dockerignore exists")
+
+        if ".git" in content:
+            self._record(Result.PASS, ".dockerignore excludes .git")
+        else:
+            self._record(Result.WARN, ".dockerignore excludes .git", ".git not excluded")
+
+        if ".env" in content:
+            self._record(Result.PASS, ".dockerignore excludes .env")
+        else:
+            self._record(Result.WARN, ".dockerignore excludes .env", ".env not excluded — secrets may leak into image")
+
+    def _check_middleware(self):
+        content = self._read("app", "main.py")
+        if content is None:
+            self._record(Result.SKIP, "Middleware checks", "app/main.py missing")
+            return
+
+        if re.search(r"CORS|CORSMiddleware|cors", content):
+            self._record(Result.PASS, "CORS middleware referenced")
+        else:
+            self._record(Result.WARN, "CORS middleware referenced", "no CORS reference found in app/main.py")
+
+        if re.search(r"slowapi|Limiter|RateLimiter|rate.limit", content, re.IGNORECASE):
+            self._record(Result.PASS, "Rate limiting referenced")
+        else:
+            self._record(Result.WARN, "Rate limiting referenced", "no rate limiting reference found in app/main.py")
+
+    def _check_migration_structure(self):
+        deps_content = self._read("requirements.txt") or self._read("pyproject.toml") or ""
+        if "alembic" not in deps_content.lower():
+            self._record(Result.SKIP, "Migration structure", "alembic not in dependencies")
+            return
+
+        versions_dir = self._path("app", "alembic", "versions")
+        if not os.path.isdir(versions_dir):
+            self._record(Result.WARN, "Migration versions directory", "app/alembic/versions/ not found")
+            return
+
+        py_files = [f for f in os.listdir(versions_dir) if f.endswith(".py") and f != "__init__.py"]
+        if py_files:
+            self._record(Result.PASS, "Migration versions present")
+        else:
+            self._record(Result.WARN, "Migration versions present", "app/alembic/versions/ is empty")
+
+    def _check_health_endpoint_code(self):
+        found = False
+        # Check app/main.py
+        content = self._read("app", "main.py")
+        if content and re.search(r'["\'/]health', content):
+            found = True
+
+        # Check app/routers/*.py
+        routers_dir = self._path("app", "routers")
+        if os.path.isdir(routers_dir):
+            for fname in os.listdir(routers_dir):
+                if fname.endswith(".py"):
+                    router_content = self._read("app", "routers", fname)
+                    if router_content and re.search(r'["\'/]health', router_content):
+                        found = True
+                        break
+
+        if found:
+            self._record(Result.PASS, "Health endpoint in code")
+        else:
+            self._record(Result.WARN, "Health endpoint in code", "no /health route found in app/main.py or app/routers/")
+
     # ── Tier 3: Runtime ────────────────────────────────────────────────
 
     def check_runtime(self):