feat: expand validator with 7 new checks and 22 new tests

Add 5 Tier 2 checks (Dockerfile security, standalone compose, alembic
config, resource limits, read-only FS) and 2 Tier 3 checks (frontend
build, standalone compose config). All new best-practice checks use WARN
to avoid breaking existing apps. Tier 3 tests use mocked subprocess.run
so they run in CI without Docker. Total: 15 → 37 tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: baijum

tests/fixtures/valid-app/app/Dockerfile

@@ -3,4 +3,6 @@ WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 COPY app/ ./app/
+RUN adduser --disabled-password --no-create-home appuser
+USER appuser
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

tests/fixtures/valid-app/app/alembic/env.py

@@ -5,6 +5,15 @@ services:
       dockerfile: app/Dockerfile
     env_file:
       - .env
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /app/__pycache__
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+          cpus: '0.5'
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 30s

tests/fixtures/valid-app/deploy/docker-compose.yml

@@ -1,7 +1,9 @@
 """Tests for the Towlion spec conformance validator."""
 
 import os
+import subprocess
 import sys
+from unittest.mock import patch, MagicMock
 
 import pytest
 
@@ -114,3 +116,166 @@ def test_non_strict_mode_allows_warnings(self):
         v = Validator(app_dir=VALID_APP, tier=1, strict=False)
         exit_code = v.run()
         assert exit_code == 0
+
+
+class TestTier2DockerfileSecurity:
+    def _make_app(self, tmp_path, dockerfile_content):
+        """Create minimal app structure with given Dockerfile."""
+        (tmp_path / "app").mkdir()
+        (tmp_path / "app" / "Dockerfile").write_text(dockerfile_content)
+        (tmp_path / "app" / "main.py").write_text('from fastapi import FastAPI\napp = FastAPI()\n@app.get("/health")\ndef h(): return {"status":"ok"}')
+        (tmp_path / "deploy").mkdir()
+        (tmp_path / "deploy" / "docker-compose.yml").write_text("services:\n  app:\n    build: .\n    healthcheck:\n      test: curl http://localhost:8000/health\n")
+        (tmp_path / "deploy" / "docker-compose.standalone.yml").write_text("services:\n  app:\n    build: .\n    ports:\n      - '8000:8000'\n")
+        (tmp_path / "deploy" / "Caddyfile").write_text("{$APP_DOMAIN}\nreverse_proxy app:8000\n")
+        (tmp_path / "deploy" / "env.template").write_text("APP_DOMAIN=x\nDATABASE_URL=x\nREDIS_URL=x\nJWT_SECRET=x\n")
+        (tmp_path / ".github" / "workflows").mkdir(parents=True)
+        (tmp_path / ".github" / "workflows" / "deploy.yml").write_text("on: push\n")
+        (tmp_path / "scripts").mkdir()
+        (tmp_path / "scripts" / "health-check.sh").write_text("#!/bin/sh\n")
+        (tmp_path / "README.md").write_text("# App\n")
+        (tmp_path / "requirements.txt").write_text("fastapi\nuvicorn\n")
+
+    def test_dockerfile_with_user_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "Dockerfile sets USER")
+
+    def test_dockerfile_without_user_warns(self, tmp_path):
+        self._make_app(tmp_path, "FROM python:3.12-slim\nWORKDIR /app\nCMD ['python']\n")
+        v = run_validator(str(tmp_path), tier=2)
+        assert has_result(v, Result.WARN, "Dockerfile sets USER")
+
+    def test_dockerfile_add_url_warns(self, tmp_path):
+        self._make_app(tmp_path, "FROM python:3.12-slim\nADD https://example.com/file.tar.gz /app/\nUSER app\nCMD ['python']\n")
+        v = run_validator(str(tmp_path), tier=2)
+        assert has_result(v, Result.WARN, "Dockerfile ADD from URL")
+
+    def test_dockerfile_env_secret_warns(self, tmp_path):
+        self._make_app(tmp_path, "FROM python:3.12-slim\nENV DB_PASSWORD=hunter2\nUSER app\nCMD ['python']\n")
+        v = run_validator(str(tmp_path), tier=2)
+        assert has_result(v, Result.WARN, "Dockerfile ENV secrets")
+
+    def test_dockerfile_missing_skips(self, tmp_path):
+        self._make_app(tmp_path, "")
+        os.remove(tmp_path / "app" / "Dockerfile")
+        v = run_validator(str(tmp_path), tier=2)
+        assert has_result(v, Result.SKIP, "Dockerfile security")
+
+
+class TestTier2ComposeHardening:
+    def test_resource_limits_present(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "Resource limits configured")
+
+    def test_resource_limits_missing_warns(self, tmp_path):
+        (tmp_path / "deploy").mkdir()
+        (tmp_path / "deploy" / "docker-compose.yml").write_text("services:\n  app:\n    build: .\n    healthcheck:\n      test: curl http://localhost:8000/health\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_resource_limits()
+        assert has_result(v, Result.WARN, "Resource limits configured")
+
+    def test_read_only_fs_present(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "Read-only filesystem enabled")
+
+    def test_read_only_fs_missing_warns(self, tmp_path):
+        (tmp_path / "deploy").mkdir()
+        (tmp_path / "deploy" / "docker-compose.yml").write_text("services:\n  app:\n    build: .\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_read_only_fs()
+        assert has_result(v, Result.WARN, "Read-only filesystem enabled")
+
+
+class TestTier2AlembicConfig:
+    def test_alembic_with_config_passes(self):
+        v = run_validator(VALID_APP, tier=2)
+        assert has_result(v, Result.PASS, "Alembic config present")
+
+    def test_alembic_without_config_warns(self, tmp_path):
+        (tmp_path / "requirements.txt").write_text("fastapi\nalembic\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_alembic_config()
+        assert has_result(v, Result.WARN, "Alembic config present")
+
+    def test_no_alembic_dep_skips(self, tmp_path):
+        (tmp_path / "requirements.txt").write_text("fastapi\nuvicorn\n")
+        v = Validator(app_dir=str(tmp_path), tier=2, strict=False)
+        v._check_alembic_config()
+        assert has_result(v, Result.SKIP, "Alembic config")
+
+
+class TestTier3WithMocking:
+    """Tier 3 tests using mocked subprocess.run — no Docker required."""
+
+    def _make_mock_result(self, returncode=0, stdout="", stderr=""):
+        mock = MagicMock()
+        mock.returncode = returncode
+        mock.stdout = stdout
+        mock.stderr = stderr
+        return mock
+
+    @patch("subprocess.run")
+    def test_compose_config_pass(self, mock_run):
+        mock_run.return_value = self._make_mock_result(returncode=0)
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v._check_compose_config()
+        assert has_result(v, Result.PASS, "docker compose config validates")
+
+    @patch("subprocess.run")
+    def test_compose_config_fail(self, mock_run):
+        mock_run.return_value = self._make_mock_result(returncode=1, stderr="invalid yaml")
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v._check_compose_config()
+        assert has_result(v, Result.FAIL, "docker compose config validates")
+
+    @patch("subprocess.run")
+    def test_container_build_pass(self, mock_run):
+        mock_run.return_value = self._make_mock_result(returncode=0)
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v._check_container_build()
+        assert has_result(v, Result.PASS, "Container builds successfully")
+
+    @patch("subprocess.run")
+    def test_container_build_fail(self, mock_run):
+        mock_run.return_value = self._make_mock_result(returncode=1, stderr="build error")
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v._check_container_build()
+        assert has_result(v, Result.FAIL, "Container builds successfully")
+
+    def test_container_build_missing_skips(self, tmp_path):
+        v = Validator(app_dir=str(tmp_path), tier=3, strict=False)
+        v._check_container_build()
+        assert has_result(v, Result.SKIP, "Container build")
+
+    @patch("subprocess.run")
+    def test_docker_not_available_skips_all(self, mock_run):
+        mock_run.side_effect = FileNotFoundError("docker not found")
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v.check_runtime()
+        assert has_result(v, Result.SKIP, "Docker available")
+        assert len(v.results) == 1
+
+    @patch("subprocess.run")
+    def test_frontend_build_pass(self, mock_run):
+        mock_run.return_value = self._make_mock_result(returncode=0)
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v._check_frontend_build()
+        # valid-app has no frontend, so it should skip
+        assert has_result(v, Result.SKIP, "Frontend build")
+
+    def test_frontend_build_missing_skips(self, tmp_path):
+        v = Validator(app_dir=str(tmp_path), tier=3, strict=False)
+        v._check_frontend_build()
+        assert has_result(v, Result.SKIP, "Frontend build")
+
+    @patch("subprocess.run")
+    def test_standalone_compose_config_pass(self, mock_run):
+        mock_run.return_value = self._make_mock_result(returncode=0)
+        v = Validator(app_dir=VALID_APP, tier=3, strict=False)
+        v._check_standalone_compose_config()
+        assert has_result(v, Result.PASS, "Standalone compose config validates")
+
+    def test_standalone_compose_config_missing_skips(self, tmp_path):
+        v = Validator(app_dir=str(tmp_path), tier=3, strict=False)
+        v._check_standalone_compose_config()
+        assert has_result(v, Result.SKIP, "Standalone compose config")

tests/test_validator.py

@@ -125,6 +125,11 @@ def check_content(self):
         self._check_main_py()
         self._check_dependencies()
         self._check_secrets()
+        self._check_dockerfile_security()
+        self._check_standalone_compose()
+        self._check_alembic_config()
+        self._check_resource_limits()
+        self._check_read_only_fs()
 
     def _check_compose(self):
         content = self._read("deploy", "docker-compose.yml")
@@ -295,6 +300,90 @@ def _check_secrets(self):
         else:
             self._record(Result.PASS, "No hardcoded secrets detected")
 
+    def _check_dockerfile_security(self):
+        content = self._read("app", "Dockerfile")
+        if content is None:
+            self._record(Result.SKIP, "Dockerfile security", "app/Dockerfile missing")
+            return
+
+        if re.search(r"^\s*USER\s+", content, re.MULTILINE):
+            self._record(Result.PASS, "Dockerfile sets USER")
+        else:
+            self._record(Result.WARN, "Dockerfile sets USER", "container runs as root")
+
+        if re.search(r"^\s*ADD\s+https?://", content, re.MULTILINE):
+            self._record(Result.WARN, "Dockerfile ADD from URL", "use COPY instead of ADD for remote files")
+        else:
+            self._record(Result.PASS, "Dockerfile no ADD from URL")
+
+        env_secret = re.search(
+            r"^\s*ENV\s+\S*(PASSWORD|SECRET|API_KEY|TOKEN)\s*=\s*\S+",
+            content,
+            re.MULTILINE | re.IGNORECASE,
+        )
+        if env_secret:
+            self._record(Result.WARN, "Dockerfile ENV secrets", "ENV contains sensitive value")
+        else:
+            self._record(Result.PASS, "Dockerfile no ENV secrets")
+
+    def _check_standalone_compose(self):
+        content = self._read("deploy", "docker-compose.standalone.yml")
+        if content is None:
+            self._record(Result.SKIP, "Standalone compose", "file missing")
+            return
+
+        if "services:" not in content:
+            self._record(Result.FAIL, "Standalone compose has services", "no services: key found")
+        else:
+            self._record(Result.PASS, "Standalone compose has services")
+
+        if "8000" in content:
+            self._record(Result.PASS, "Standalone compose references port 8000")
+        else:
+            self._record(Result.WARN, "Standalone compose references port 8000", "not found")
+
+    def _check_alembic_config(self):
+        deps_content = self._read("requirements.txt") or self._read("pyproject.toml") or ""
+        if "alembic" not in deps_content.lower():
+            self._record(Result.SKIP, "Alembic config", "alembic not in dependencies")
+            return
+
+        has_ini = self._exists("alembic.ini")
+        has_dir = os.path.isdir(self._path("app", "alembic"))
+        if has_ini or has_dir:
+            self._record(Result.PASS, "Alembic config present")
+        else:
+            self._record(Result.WARN, "Alembic config present", "alembic dep found but no alembic.ini or app/alembic/")
+
+    def _check_resource_limits(self):
+        content = self._read("deploy", "docker-compose.yml")
+        if content is None:
+            self._record(Result.SKIP, "Resource limits", "file missing")
+            return
+
+        has_memory = "memory:" in content
+        has_cpus = "cpus:" in content
+        if has_memory and has_cpus:
+            self._record(Result.PASS, "Resource limits configured")
+        else:
+            missing = []
+            if not has_memory:
+                missing.append("memory")
+            if not has_cpus:
+                missing.append("cpus")
+            self._record(Result.WARN, "Resource limits configured", f"missing: {', '.join(missing)}")
+
+    def _check_read_only_fs(self):
+        content = self._read("deploy", "docker-compose.yml")
+        if content is None:
+            self._record(Result.SKIP, "Read-only filesystem", "file missing")
+            return
+
+        if re.search(r"read_only:\s*true", content):
+            self._record(Result.PASS, "Read-only filesystem enabled")
+        else:
+            self._record(Result.WARN, "Read-only filesystem enabled", "read_only: true not found")
+
     # ── Tier 3: Runtime ────────────────────────────────────────────────
 
     def check_runtime(self):
@@ -313,6 +402,8 @@ def check_runtime(self):
 
         self._check_compose_config()
         self._check_container_build()
+        self._check_frontend_build()
+        self._check_standalone_compose_config()
         self._check_health_endpoint()
 
     def _check_compose_config(self):
@@ -349,6 +440,40 @@ def _check_container_build(self):
         else:
             self._record(Result.FAIL, "Container builds successfully", result.stderr.strip()[:200])
 
+    def _check_frontend_build(self):
+        dockerfile = self._path("frontend", "Dockerfile")
+        if not os.path.exists(dockerfile):
+            self._record(Result.SKIP, "Frontend build", "frontend/Dockerfile missing")
+            return
+
+        result = subprocess.run(
+            ["docker", "build", "-f", dockerfile, "-t", "towlion-validate-frontend", self._path("frontend")],
+            capture_output=True,
+            text=True,
+            timeout=300,
+        )
+        if result.returncode == 0:
+            self._record(Result.PASS, "Frontend builds successfully")
+        else:
+            self._record(Result.FAIL, "Frontend builds successfully", result.stderr.strip()[:200])
+
+    def _check_standalone_compose_config(self):
+        compose_path = self._path("deploy", "docker-compose.standalone.yml")
+        if not os.path.exists(compose_path):
+            self._record(Result.SKIP, "Standalone compose config", "file missing")
+            return
+
+        result = subprocess.run(
+            ["docker", "compose", "-f", compose_path, "config"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        if result.returncode == 0:
+            self._record(Result.PASS, "Standalone compose config validates")
+        else:
+            self._record(Result.FAIL, "Standalone compose config validates", result.stderr.strip()[:200])
+
     def _check_health_endpoint(self):
         import json
         import time