# Ported from alibaba/open-code-review (Apache-2.0):
#   internal/config/rules/rule_docs/bicep.md
#   at commit 89ec55b14442c9f2601fb55b5f554fb6fabbe2c7.
# OCR tool names were replaced with this workflow's read-only
# exploration language. See the NOTICE.md and LICENSE files
# in rules/builtin/ for attribution and license details.
version: 1

rules:
  - id: format.bicep
    description: "> Favor precision over recall: only raise an issue when you are confident it is a real defect, and stay silent when the surrounding context is unclear — a false alarm costs more reviewer trust than a missed minor issue. Treat security and correctness findings as blocking, and style or idiom suggestions as non-blocking. Review only what is observable in the Bicep under review; do not infer Azure subscription/tenant configuration, deployed resource state, or policy assignments that live outside this file."
    match:
      paths:
        - "**/*.bicep"
    checks:
      - id: obvious-typos-or-spelling-errors
        category: conventions
        guidance: |
          - Spelling errors in resource/module/parameter/variable/output names at their declaration sites; do not report spelling errors at reference sites
          - Typos in `@description()` text that affect readability of the module's public interface
      - id: hardcoded-secrets-and-credentials
        category: correctness
        guidance: |
          - A literal password, connection string, API key, or access token assigned directly to a resource property, parameter default, or variable instead of coming from a Key Vault reference (`getSecret()` / `Microsoft.KeyVault/vaults/secrets` resource) or a secure parameter supplied at deployment time
          - A parameter whose name or description clearly indicates a credential (password, secret, token, connectionString, apiKey) declared without the `@secure()` decorator, which is what prevents the value from being logged or shown in deployment history
      - id: overly-permissive-access
        category: correctness
        guidance: |
          - A `Microsoft.Authorization/roleAssignments` resource granting a broad built-in role (`Owner`, `Contributor`) at subscription or resource-group scope where a narrower, resource-scoped or custom role would suffice, especially when sibling assignments in the same file use narrower scopes
          - A network security group rule (`Microsoft.Network/networkSecurityGroups/securityRules`) with `sourceAddressPrefix` set to `*`/`Internet`/`0.0.0.0/0` on a sensitive port (SSH/22, RDP/3389, or a database port such as MySQL/3306, PostgreSQL/5432, SQL Server/1433, MongoDB/27017) or on all ports (`destinationPortRange: '*'`)
          - A storage account, key vault, or SQL server resource with `publicNetworkAccess` explicitly set to `'Enabled'` (or left at a default that resolves to public) alongside no compensating `networkAcls`/private-endpoint configuration elsewhere in the same file
      - id: insecure-resource-defaults
        category: correctness
        guidance: |
          - A storage account without `minimumTlsVersion` set to a current version, or with `supportsHttpsTrafficOnly` explicitly set to `false`
          - A resource property that disables encryption-at-rest or transparent data encryption where the resource type supports enabling it
          - Do not flag a resource for merely omitting an optional hardening property when the diff gives no indication either way — only flag an explicit insecure value or an explicit disabling of a secure default
      - id: versioning-and-reproducibility
        category: correctness
        guidance: |
          - An `api-version` in a resource's type string that is unusually old relative to sibling resources of the same provider in the same diff — inconsistency worth flagging, not an absolute "must be latest" rule
          - A module reference (`module ... 'path/to/module.bicep'` or a registry reference) with no version/tag pinning where the surrounding file otherwise pins versions
      - id: style-and-structure
        category: conventions
        guidance: |
          - Parameters declared but never referenced anywhere in the diff's scope, or referenced parameters/variables never declared in the diff's scope
          - Duplicate resource symbolic names within the same file (would fail compilation, if not already caught by other tooling)
          - Do not flag formatting/whitespace that the Bicep formatter would silently fix — focus on structural and semantic issues
