id       = "datree"
name     = "Datree"
homepage = "https://hub.datree.io"
description = "Prevent Kubernetes misconfigurations from reaching production."
# Datree's square logo mark, from its own repository.
icon     = "https://raw.githubusercontent.com/datreeio/datree/main/images/datree-logo.svg"
executables   = ["datree"]

[dotfiles]

# https://hub.datree.io/cli/cli-arguments — "after running your first policy
# check, a default config file will be created (defaults to
# $HOME/.datree/config.yaml)", holding client_id, offline and token, and
# `datree config set` rewrites it. The GitHub repository was archived in June
# 2024; the CLI still runs in offline mode and still keeps this file.
paths = ["~/.datree/config.yaml"]

exclude = []

# Not a whole-file secret: `offline` is a preference worth carrying, and
# client_id names the account rather than authenticating it.
secret = []

# Read once per policy check by a process that then exits.
side_effect = false

# token is the credential that links this CLI to the Datree dashboard; the
# docs tell users to read their token out of this field.
[[dotfiles.secret_paths]]
file  = "~/.datree/config.yaml"
match = { key_path = ["token"] }

[commands]
format = 1
label = "Datree policy check"
description = "Run datree test against Kubernetes manifests or Helm output. Other subcommands are left out."
quality = "ai-draft"
base = "fig:datree"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/datree.ts"
license = "MIT"

[[commands.subcommand]]
path = ["test"]
label = "Check manifests"
description = "Runs policy checks on one or more manifest paths or globs."

[[commands.subcommand.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/datree.ts"
license = "MIT"

[[commands.subcommand.field]]
id = "files"
label = "Manifest files or globs"
type = "path"
position = 0
multiple = true
path = { kind = "any", role = "input" }
sources = ["fig"]

[[commands.subcommand.field]]
id = "policy"
label = "Policy name"
type = "string"
option = ["--policy", "-p"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "output"
label = "Output format"
type = "string"
option = ["--output", "-o"]
suggestions = [{ value = "simple", label = "simple" }, { value = "yaml", label = "yaml" }, { value = "json", label = "json" }, { value = "xml", label = "xml" }, { value = "junit", label = "junit" }]
sources = ["fig"]

[[commands.subcommand.field]]
id = "schema_version"
label = "Kubernetes version"
type = "string"
option = ["--schema-version", "-s"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "ignore_missing_schemas"
label = "Ignore missing schemas"
type = "boolean"
option = ["--ignore-missing-schemas"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "only_k8s_files"
label = "Only Kubernetes YAML"
type = "boolean"
option = ["--only-k8s-files"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "no_record"
label = "Do not send metadata to backend"
type = "boolean"
option = ["--no-record"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "verbose"
label = "Show how-to-fix links"
type = "boolean"
option = ["--verbose"]
sources = ["fig"]

[[commands.subcommand.field]]
id = "policy_config"
label = "Local policy file"
type = "path"
option = ["--policy-config"]
path = { kind = "file", role = "input" }
sources = ["fig"]

[[commands.subcommand.task]]
id = "basic"
label = "Check manifests"
fields = ["files", "policy", "output"]
required = ["files"]

[[commands.subcommand.task]]
id = "offline"
label = "Check without reporting"
set = { no_record = [true] }
fields = ["files", "no_record", "ignore_missing_schemas"]
required = ["files"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["files", "policy", "output", "no_record"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["ignore_missing_schemas", "only_k8s_files", "verbose", "policy_config", "schema_version"]