feat: unpinned resources (images/repos/files) warning on zarf prepare lint

Makefile

@@ -8,8 +8,10 @@ KEY ?= ""
 
 # Figure out which Zarf binary we should use based on the operating system we are on
 ZARF_BIN := ./build/zarf
+BUILD_CLI_FOR_SYSTEM := build-cli-linux-amd
 ifeq ($(OS),Windows_NT)
 	ZARF_BIN := $(addsuffix .exe,$(ZARF_BIN))
+	BUILD_CLI_FOR_SYSTEM := build-cli-windows-amd
 else
 	UNAME_S := $(shell uname -s)
 	UNAME_P := $(shell uname -p)
@@ -19,9 +21,11 @@ else
 		endif
 		ifeq ($(UNAME_P),i386)
 			ZARF_BIN := $(addsuffix -intel,$(ZARF_BIN))
+			BUILD_CLI_FOR_SYSTEM = build-cli-mac-intel
 		endif
 		ifeq ($(UNAME_P),arm)
 			ZARF_BIN := $(addsuffix -apple,$(ZARF_BIN))
+			BUILD_CLI_FOR_SYSTEM = build-cli-mac-apple
 		endif
 	endif
 endif
@@ -48,8 +52,8 @@ BUILD_ARGS += -X k8s.io/component-base/version.buildDate=$(BUILD_DATE)
 .PHONY: help
 help: ## Display this help information
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) \
-	  | sort | awk 'BEGIN {FS = ":.*?## "}; \
-	  {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+		| sort | awk 'BEGIN {FS = ":.*?## "}; \
+		{printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
 
 clean: ## Clean the build directory
 	rm -rf build
@@ -85,10 +89,16 @@ build-cli-linux: build-cli-linux-amd build-cli-linux-arm ## Build the Zarf CLI f
 
 build-cli: build-cli-linux-amd build-cli-linux-arm build-cli-mac-intel build-cli-mac-apple build-cli-windows-amd build-cli-windows-arm ## Build the CLI
 
+build-cli-for-system:
+	$(MAKE) $(BUILD_CLI_FOR_SYSTEM)
+
 docs-and-schema: ## Generate the Zarf Documentation and Schema
 	hack/gen-cli-docs.sh
 	ZARF_CONFIG=hack/empty-config.toml hack/create-zarf-schema.sh
 
+lint-packages-and-examples: build-cli-for-system ## Recurisvely lint all zarf.yaml files in the repo except for those dedicated to tests
+	hack/lint_all_zarf_packages.sh $(ZARF_BIN)
+
 # INTERNAL: a shim used to build the agent image only if needed on Windows using the `test` command
 init-package-local-agent:
 	@test "$(AGENT_IMAGE_TAG)" != "local" || $(MAKE) build-local-agent-image

docs/2-the-zarf-cli/100-cli-commands/zarf_dev.md

@@ -28,7 +28,7 @@ Commands useful for developing packages
 * [zarf dev deploy](zarf_dev_deploy.md)	 - [beta] Creates and deploys a Zarf package from a given directory
 * [zarf dev find-images](zarf_dev_find-images.md)	 - Evaluates components in a Zarf file to identify images specified in their helm charts and manifests
 * [zarf dev generate-config](zarf_dev_generate-config.md)	 - Generates a config file for Zarf
-* [zarf dev lint](zarf_dev_lint.md)	 - Verifies the package schema
+* [zarf dev lint](zarf_dev_lint.md)	 - Lints the given package for valid schema and recommended practices
 * [zarf dev patch-git](zarf_dev_patch-git.md)	 - Converts all .git URLs to the specified Zarf HOST and with the Zarf URL pattern in a given FILE.  NOTE:
 This should only be used for manifests that are not mutated by the Zarf Agent Mutating Webhook.
 * [zarf dev sha256sum](zarf_dev_sha256sum.md)	 - Generates a SHA256SUM for the given file

docs/2-the-zarf-cli/100-cli-commands/zarf_dev_lint.md

@@ -1,11 +1,11 @@
 # zarf dev lint
 <!-- Auto-generated by hack/gen-cli-docs.sh -->
 
-Verifies the package schema
+Lints the given package for valid schema and recommended practices
 
 ## Synopsis
 
-Verifies the package schema and warns the user if they have variables that won't be evaluated
+Verifies the package schema, checks if any variables won't be evaluated, and checks for unpinned images/repos/files
 
 ```
 zarf dev lint [ DIRECTORY ] [flags]
@@ -14,7 +14,9 @@ zarf dev lint [ DIRECTORY ] [flags]
 ## Options
 
 ```
-  -h, --help   help for lint
+  -f, --flavor string        The flavor of components to include in the resulting package (i.e. have a matching or empty "only.flavor" key)
+  -h, --help                 help for lint
+      --set stringToString   Specify package variables to set on the command line (KEY=value) (default [])
 ```
 
 ## Options inherited from parent commands

hack/lint_all_zarf_packages.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+ZARF_BIN=$1
+LINT_SRC_TEST=$2
+SCRIPT=$(realpath "$0")
+SCRIPTPATH=$(dirname "$SCRIPT")
+cd $SCRIPTPATH
+cd ..
+find "." -type f -name 'zarf.yaml' | while read -r yaml_file; do
+  dir=$(dirname "$yaml_file")
+  if [[ "$dir" == *src/test/* ]] && [ "$LINT_SRC_TEST" != true ]; then
+      continue
+  fi
+  echo "Running 'zarf prepare lint' in directory: $dir"
+  $ZARF_BIN prepare lint $dir
+  echo "---"
+done

src/cmd/common/utils.go

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2021-Present The Zarf Authors
+
+// Package common handles command configuration across all commands
+package common
+
+import (
+	"github.com/defenseunicorns/zarf/src/types"
+)
+
+// SetBaseDirectory sets base directory on package config when given in args
+func SetBaseDirectory(args []string, pkgConfig *types.PackagerConfig) {
+	if len(args) > 0 {
+		pkgConfig.CreateOpts.BaseDir = args[0]
+	} else {
+		pkgConfig.CreateOpts.BaseDir = "."
+	}
+}

src/cmd/dev.go

@@ -38,17 +38,9 @@ var devDeployCmd = &cobra.Command{
 	Use:   "deploy",
 	Args:  cobra.MaximumNArgs(1),
 	Short: lang.CmdDevDeployShort,
-	Long: lang.CmdDevDeployLong,
+	Long:  lang.CmdDevDeployLong,
 	Run: func(cmd *cobra.Command, args []string) {
-		if len(args) > 0 {
-			pkgConfig.CreateOpts.BaseDir = args[0]
-		} else {
-			var err error
-			pkgConfig.CreateOpts.BaseDir, err = os.Getwd()
-			if err != nil {
-				message.Fatalf(err, lang.CmdPackageCreateErr, err.Error())
-			}
-		}
+		common.SetBaseDirectory(args, &pkgConfig)
 
 		v := common.GetViper()
 		pkgConfig.CreateOpts.SetVariables = helpers.TransformAndMergeMap(
@@ -194,15 +186,7 @@ var devFindImagesCmd = &cobra.Command{
 	Long:    lang.CmdPrepareFindImagesLong,
 	Run: func(cmd *cobra.Command, args []string) {
 		// If a directory was provided, use that as the base directory
-		if len(args) > 0 {
-			pkgConfig.CreateOpts.BaseDir = args[0]
-		} else {
-			cwd, err := os.Getwd()
-			if err != nil {
-				message.Fatalf(err, lang.CmdPrepareFindImagesErr, err.Error())
-			}
-			pkgConfig.CreateOpts.BaseDir = cwd
-		}
+		common.SetBaseDirectory(args, &pkgConfig)
 
 		// Ensure uppercase keys from viper
 		v := common.GetViper()
@@ -245,20 +229,14 @@ var devLintCmd = &cobra.Command{
 	Use:     "lint [ DIRECTORY ]",
 	Args:    cobra.MaximumNArgs(1),
 	Aliases: []string{"l"},
-	Short:   lang.CmdPrepareLintShort,
-	Long:    lang.CmdPrepareLintLong,
+	Short:   lang.CmdDevLintShort,
+	Long:    lang.CmdDevLintLong,
 	Run: func(cmd *cobra.Command, args []string) {
-		baseDir := ""
-		if len(args) > 0 {
-			baseDir = args[0]
-		} else {
-			var err error
-			baseDir, err = os.Getwd()
-			if err != nil {
-				message.Fatalf(err, lang.CmdPrepareLintErr, err.Error())
-			}
-		}
-		validator, err := lint.ValidateZarfSchema(baseDir)
+		common.SetBaseDirectory(args, &pkgConfig)
+		v := common.GetViper()
+		pkgConfig.CreateOpts.SetVariables = helpers.TransformAndMergeMap(
+			v.GetStringMapString(common.VPkgCreateSet), pkgConfig.CreateOpts.SetVariables, strings.ToUpper)
+		validator, err := lint.Validate(pkgConfig.CreateOpts)
 		if err != nil {
 			message.Fatal(err, err.Error())
 		}
@@ -290,6 +268,8 @@ func init() {
 	// allow for the override of the default helm KubeVersion
 	devFindImagesCmd.Flags().StringVar(&pkgConfig.FindImagesOpts.KubeVersionOverride, "kube-version", "", lang.CmdPrepareFlagKubeVersion)
 
+	devLintCmd.Flags().StringToStringVar(&pkgConfig.CreateOpts.SetVariables, "set", v.GetStringMapString(common.VPkgCreateSet), lang.CmdPackageCreateFlagSet)
+	devLintCmd.Flags().StringVarP(&pkgConfig.CreateOpts.Flavor, "flavor", "f", v.GetString(common.VPkgCreateFlavor), lang.CmdPackageCreateFlagFlavor)
 	devTransformGitLinksCmd.Flags().StringVar(&pkgConfig.InitOpts.GitServer.PushUsername, "git-account", config.ZarfGitPushUser, lang.CmdPrepareFlagGitAccount)
 }
 

src/cmd/package.go

@@ -6,7 +6,6 @@ package cmd
 
 import (
 	"fmt"
-	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -41,17 +40,7 @@ var packageCreateCmd = &cobra.Command{
 	Short:   lang.CmdPackageCreateShort,
 	Long:    lang.CmdPackageCreateLong,
 	Run: func(cmd *cobra.Command, args []string) {
-
-		// If a directory was provided, use that as the base directory
-		if len(args) > 0 {
-			pkgConfig.CreateOpts.BaseDir = args[0]
-		} else {
-			var err error
-			pkgConfig.CreateOpts.BaseDir, err = os.Getwd()
-			if err != nil {
-				message.Fatalf(err, lang.CmdPackageCreateErr, err.Error())
-			}
-		}
+		common.SetBaseDirectory(args, &pkgConfig)
 
 		var isCleanPathRegex = regexp.MustCompile(`^[a-zA-Z0-9\_\-\/\.\~\\:]+$`)
 		if !isCleanPathRegex.MatchString(config.CommonOptions.CachePath) {

src/cmd/tools/zarf.go

@@ -88,8 +88,10 @@ var updateCredsCmd = &cobra.Command{
 			// If no distro the zarf secret did not load properly
 			message.Fatalf(nil, lang.ErrLoadState)
 		}
-
-		newState := c.MergeZarfState(oldState, updateCredsInitOpts, args)
+		var newState *types.ZarfState
+		if newState, err = c.MergeZarfState(oldState, updateCredsInitOpts, args); err != nil {
+			message.Fatal(err, lang.CmdToolsUpdateCredsUnableUpdateCreds)
+		}
 
 		message.PrintCredentialUpdates(oldState, newState, args)
 

src/config/lang/english.go

@@ -15,20 +15,26 @@ import "errors"
 // Debug messages will not be a part of the language strings since they are not intended to be user facing
 // Include sprintf formatting directives in the string if needed.
 const (
-	ErrLoadState           = "Failed to load the Zarf State from the cluster."
-	ErrSaveState           = "Failed to save the Zarf State to the cluster."
-	ErrLoadPackageSecret   = "Failed to load %s's secret from the cluster"
-	ErrNoClusterConnection = "Failed to connect to the cluster."
-	ErrTunnelFailed        = "Failed to create a tunnel to the cluster."
-	ErrUnmarshal           = "failed to unmarshal file: %w"
-	ErrWritingFile         = "failed to write file %s: %s"
-	ErrDownloading         = "failed to download %s: %s"
-	ErrCreatingDir         = "failed to create directory %s: %s"
-	ErrRemoveFile          = "failed to remove file %s: %s"
-	ErrUnarchive           = "failed to unarchive %s: %s"
-	ErrConfirmCancel       = "confirm selection canceled: %s"
-	ErrFileExtract         = "failed to extract filename %s from archive %s: %s"
-	ErrFileNameExtract     = "failed to extract filename from URL %s: %s"
+	ErrLoadState                    = "Failed to load the Zarf State from the cluster."
+	ErrSaveState                    = "Failed to save the Zarf State to the cluster."
+	ErrLoadPackageSecret            = "Failed to load %s's secret from the cluster"
+	ErrNoClusterConnection          = "Failed to connect to the cluster."
+	ErrTunnelFailed                 = "Failed to create a tunnel to the cluster."
+	ErrUnmarshal                    = "failed to unmarshal file: %w"
+	ErrWritingFile                  = "failed to write file %s: %s"
+	ErrDownloading                  = "failed to download %s: %s"
+	ErrCreatingDir                  = "failed to create directory %s: %s"
+	ErrRemoveFile                   = "failed to remove file %s: %s"
+	ErrUnarchive                    = "failed to unarchive %s: %s"
+	ErrConfirmCancel                = "confirm selection canceled: %s"
+	ErrFileExtract                  = "failed to extract filename %s from archive %s: %s"
+	ErrFileNameExtract              = "failed to extract filename from URL %s: %s"
+	ErrUnableToGenerateRandomSecret = "unable to generate a random secret"
+)
+
+// Lint messages
+const (
+	UnsetVarLintWarning = "There are templates that are not set and won't be evaluated during lint"
 )
 
 // Zarf CLI commands.
@@ -365,9 +371,9 @@ $ zarf package publish ./path/to/dir oci://my-registry.com/my-namespace
 	CmdPrepareFlagGitAccount    = "User or organization name for the git account that the repos are created under."
 	CmdPrepareFlagKubeVersion   = "Override the default helm template KubeVersion when performing a package chart template"
 
-	CmdPrepareLintShort = "Verifies the package schema"
-	CmdPrepareLintLong  = "Verifies the package schema and warns the user if they have variables that won't be evaluated"
-	CmdPrepareLintErr   = "Unable to lint package: %s"
+	CmdDevLintShort = "Lints the given package for valid schema and recommended practices"
+	CmdDevLintLong  = "Verifies the package schema, checks if any variables won't be evaluated, and checks for unpinned images/repos/files"
+	CmdDevLintErr   = "Unable to lint package: %s"
 
 	// zarf tools
 	CmdToolsShort = "Collection of additional tools to make airgap easier"
@@ -563,6 +569,7 @@ $ zarf tools update-creds artifact --artifact-push-username={USERNAME} --artifac
 	CmdToolsUpdateCredsUnableUpdateRegistry = "Unable to update Zarf Registry values: %s"
 	CmdToolsUpdateCredsUnableUpdateGit      = "Unable to update Zarf Git Server values: %s"
 	CmdToolsUpdateCredsUnableUpdateAgent    = "Unable to update Zarf Agent TLS secrets: %s"
+	CmdToolsUpdateCredsUnableUpdateCreds    = "Unable to update Zarf credentials"
 
 	// zarf version
 	CmdVersionShort = "Shows the version of the running Zarf binary"
@@ -604,7 +611,7 @@ const (
 
 // src/internal/packager/validate.
 const (
-	PkgValidateTemplateDeprecation        = "Package template %q is using the deprecated syntax ###ZARF_PKG_VAR_%s###.  This will be removed in Zarf v1.0.0.  Please update to ###ZARF_PKG_TMPL_%s###."
+	PkgValidateTemplateDeprecation        = "Package template %q is using the deprecated syntax ###ZARF_PKG_VAR_%s###. This will be removed in Zarf v1.0.0. Please update to ###ZARF_PKG_TMPL_%s###."
 	PkgValidateMustBeUppercase            = "variable name %q must be all uppercase and contain no special characters except _"
 	PkgValidateErrAction                  = "invalid action: %w"
 	PkgValidateErrActionVariables         = "component %q cannot contain setVariables outside of onDeploy in actions"