"""Central registry of all lint rules."""

from __future__ import annotations

from .models import LintRule, Severity


def all_rules() -> list[LintRule]:
    """Return all available lint rules sorted by ID."""
    rules: list[LintRule] = []

    # Kubernetes rules (K8S001-K8S020)
    rules.extend([
        LintRule("K8S001", "Security", Severity.CRITICAL, "Container running as root", "Container has no securityContext or runs as root", "Add securityContext.runAsNonRoot: true"),
        LintRule("K8S002", "Security", Severity.HIGH, "Missing resource limits", "Container missing CPU/memory limits", "Add resources.limits.cpu and resources.limits.memory"),
        LintRule("K8S003", "Security", Severity.HIGH, "Missing resource requests", "Container missing CPU/memory requests", "Add resources.requests.cpu and resources.requests.memory"),
        LintRule("K8S004", "Security", Severity.CRITICAL, "Privileged container", "Container running in privileged mode", "Set securityContext.privileged: false"),
        LintRule("K8S005", "Security", Severity.HIGH, "Using :latest image tag", "Image tag is :latest or unspecified", "Pin image to a specific version tag"),
        LintRule("K8S006", "Reliability", Severity.HIGH, "Missing liveness probe", "No livenessProbe configured", "Add livenessProbe with httpGet, tcpSocket, or exec"),
        LintRule("K8S007", "Reliability", Severity.MEDIUM, "Missing readiness probe", "No readinessProbe configured", "Add readinessProbe for proper load balancing"),
        LintRule("K8S008", "Security", Severity.MEDIUM, "Read-only filesystem not set", "Root filesystem is writable", "Set securityContext.readOnlyRootFilesystem: true"),
        LintRule("K8S009", "Best Practice", Severity.LOW, "Missing recommended labels", "Pod/Deployment missing standard labels", "Add app.kubernetes.io/name, app.kubernetes.io/version labels"),
        LintRule("K8S010", "Best Practice", Severity.INFO, "Missing namespace", "Resource has no namespace specified", "Add metadata.namespace or deploy with -n flag"),
        LintRule("K8S011", "Security", Severity.HIGH, "Host network enabled", "Pod uses host network namespace", "Remove hostNetwork: true unless absolutely needed"),
        LintRule("K8S012", "Security", Severity.HIGH, "Host PID enabled", "Pod uses host PID namespace", "Remove hostPID: true"),
        LintRule("K8S013", "Reliability", Severity.MEDIUM, "Single replica deployment", "Deployment has replicas: 1", "Use at least 2 replicas for high availability"),
        LintRule("K8S014", "Security", Severity.MEDIUM, "Privilege escalation allowed", "allowPrivilegeEscalation not set to false", "Set securityContext.allowPrivilegeEscalation: false"),
        LintRule("K8S015", "Best Practice", Severity.LOW, "Missing PodDisruptionBudget", "No PDB for the deployment", "Create a PodDisruptionBudget resource"),
        LintRule("K8S016", "Security", Severity.HIGH, "Secrets in environment variables", "Secrets referenced directly in env instead of secretKeyRef", "Use secretKeyRef or mount secrets as volumes"),
        LintRule("K8S017", "Reliability", Severity.MEDIUM, "Missing update strategy", "Deployment missing strategy specification", "Add strategy.type: RollingUpdate with maxSurge/maxUnavailable"),
        LintRule("K8S018", "Security", Severity.MEDIUM, "Capabilities not dropped", "Container not dropping Linux capabilities", "Add securityContext.capabilities.drop: [ALL]"),
        LintRule("K8S019", "Best Practice", Severity.LOW, "No anti-affinity rules", "Deployment has no pod anti-affinity for HA", "Add podAntiAffinity to spread pods across nodes"),
        LintRule("K8S020", "Reliability", Severity.MEDIUM, "Missing restart policy", "Pod has no restartPolicy specified", "Explicitly set restartPolicy"),
    ])

    # Docker Compose rules (DC001-DC012)
    rules.extend([
        LintRule("DC001", "Security", Severity.HIGH, "Using :latest tag", "Image uses :latest or no tag", "Pin image to specific version"),
        LintRule("DC002", "Security", Severity.CRITICAL, "Privileged container", "Container runs in privileged mode", "Remove privileged: true"),
        LintRule("DC003", "Reliability", Severity.MEDIUM, "No restart policy", "Service has no restart policy", "Add restart: unless-stopped"),
        LintRule("DC004", "Reliability", Severity.MEDIUM, "No healthcheck defined", "Service missing healthcheck", "Add healthcheck with test command"),
        LintRule("DC005", "Security", Severity.HIGH, "Secrets in environment", "Hardcoded secrets in environment variables", "Use secrets or .env file"),
        LintRule("DC006", "Best Practice", Severity.LOW, "No resource limits", "No deploy.resources limits set", "Add deploy.resources.limits"),
        LintRule("DC007", "Security", Severity.MEDIUM, "Exposed to all interfaces", "Port bound to 0.0.0.0", "Bind to 127.0.0.1 instead"),
        LintRule("DC008", "Best Practice", Severity.INFO, "Deprecated version key", "Top-level version key is deprecated", "Remove the version key"),
        LintRule("DC009", "Security", Severity.MEDIUM, "Host volume mount", "Sensitive host path mounted", "Use named volumes instead"),
        LintRule("DC010", "Best Practice", Severity.LOW, "No logging config", "No logging driver configured", "Add logging configuration"),
        LintRule("DC011", "Best Practice", Severity.INFO, "Missing depends_on", "No depends_on for service ordering", "Add depends_on for startup order"),
        LintRule("DC012", "Security", Severity.HIGH, "Host network mode", "Using network_mode: host", "Use bridge or custom network"),
    ])

    # GitHub Actions rules (GHA001-GHA010)
    rules.extend([
        LintRule("GHA001", "Security", Severity.CRITICAL, "Mutable action reference", "Action uses branch ref instead of SHA or version tag", "Pin to specific commit SHA or version tag"),
        LintRule("GHA002", "Security", Severity.HIGH, "Persist credentials enabled", "Git credentials persisted unnecessarily", "Set persist-credentials: false"),
        LintRule("GHA003", "Security", Severity.HIGH, "Secrets in run commands", "Secrets used directly in run scripts", "Use environment variables for secrets"),
        LintRule("GHA004", "Security", Severity.MEDIUM, "Overly broad permissions", "Workflow has write-all or broad permissions", "Use least-privilege permissions per job"),
        LintRule("GHA005", "Reliability", Severity.MEDIUM, "No job timeout", "Job has no timeout-minutes set", "Add timeout-minutes to prevent hanging jobs"),
        LintRule("GHA006", "Security", Severity.MEDIUM, "pull_request_target trigger", "Potentially unsafe trigger for untrusted code", "Use pull_request instead if possible"),
        LintRule("GHA007", "Best Practice", Severity.LOW, "No concurrency control", "No concurrency group defined", "Add concurrency to prevent duplicate runs"),
        LintRule("GHA008", "Best Practice", Severity.LOW, "Unversioned runner image", "Using -latest runner image", "Pin runner to specific version"),
        LintRule("GHA009", "Security", Severity.HIGH, "Script injection risk", "User-controlled input in run command", "Use environment variables instead of inline expressions"),
        LintRule("GHA010", "Best Practice", Severity.INFO, "Missing job name", "Job has no descriptive name", "Add a name field to the job"),
    ])

    # GitLab CI rules (GL001-GL010)
    rules.extend([
        LintRule("GL001", "Security", Severity.HIGH, "Secrets in script", "Hardcoded secrets in script block", "Use CI/CD variables ($CI_*) instead"),
        LintRule("GL002", "Reliability", Severity.MEDIUM, "No retry configuration", "Job has no retry config for flaky steps", "Add retry: 2 or retry with when conditions"),
        LintRule("GL003", "Best Practice", Severity.LOW, "No cache defined", "Pipeline has no caching", "Add cache key and paths for faster builds"),
        LintRule("GL004", "Security", Severity.MEDIUM, "Using :latest image", "Job image uses :latest tag", "Pin image to specific version"),
        LintRule("GL005", "Reliability", Severity.MEDIUM, "No timeout set", "Job has no timeout configured", "Add timeout: 30m or appropriate value"),
        LintRule("GL006", "Best Practice", Severity.INFO, "No stages defined", "Pipeline has no explicit stages", "Define stages for clear pipeline structure"),
        LintRule("GL007", "Security", Severity.HIGH, "allow_failure on security jobs", "Security-related job allows failure", "Remove allow_failure from security jobs"),
        LintRule("GL008", "Best Practice", Severity.LOW, "No artifacts defined", "Job produces no artifacts", "Add artifacts for test reports or builds"),
        LintRule("GL009", "Best Practice", Severity.MEDIUM, "No rules/conditions", "Job has no rules or only/except", "Add rules for conditional execution"),
        LintRule("GL010", "Best Practice", Severity.INFO, "Missing job description", "Job has no description", "Add description for documentation"),
    ])

    # Generic YAML rules (YML001-YML008)
    rules.extend([
        LintRule("YML001", "Quality", Severity.MEDIUM, "Inconsistent indentation", "Mixed indentation levels detected", "Use consistent 2-space indentation"),
        LintRule("YML002", "Quality", Severity.LOW, "Trailing whitespace", "Lines have trailing whitespace", "Remove trailing whitespace"),
        LintRule("YML003", "Quality", Severity.LOW, "Line too long", "Line exceeds 200 characters", "Break long lines"),
        LintRule("YML004", "Quality", Severity.INFO, "Missing document marker", "No --- document start marker", "Add --- at the start of the file"),
        LintRule("YML005", "Security", Severity.HIGH, "Hardcoded credentials", "Potential password/key in YAML values", "Use environment variables or secret management"),
        LintRule("YML006", "Quality", Severity.MEDIUM, "Duplicate keys", "Duplicate key detected in mapping", "Remove duplicate keys"),
        LintRule("YML007", "Quality", Severity.LOW, "Empty values", "Key mapped to null/empty value", "Provide a value or remove the key"),
        LintRule("YML008", "Quality", Severity.INFO, "File too long", "File exceeds 1000 lines", "Split into smaller files"),
    ])

    return rules
