# =============================================================================
# L0 STATIC — Prometheus receives aggregates only (R-VULN-06, docs/17 "Alerting").
# Offline, no cluster. Depends on platform/vuln-scanner/src/metrics.py (the SCANNER's file).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-metrics-no-per-cve-label
  labels:
    conformance.home.k3s/R-VULN-06: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-06"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      No vuln_scanner_* metric or alert rule carries a label other than state, severity or fixable,
      so Prometheus can never hold a per-CVE, per-image or per-workload series. Proven by mutation.
spec:
  steps:
    - name: assert-metric-labels-are-aggregates
      description: >-
        Extract every vuln_scanner_* metric label from metrics.py and alerts.yaml, assert the
        allowlist, and run the extractor on mutated text to prove it can fail.
      try:
        - script:
            content: bash ./check.sh