feat(docker): Add Python DSL advanced features

[shivasurya]

Summary

Adds advanced DSL features for writing complex multi-condition container security rules.

Changes

Logic Combinators:

• all_of() - AND logic (all conditions must match)
• any_of() - OR logic (any condition can match)
• none_of() - NOT logic (no conditions should match)

Sequence Validation:

• instruction_after() - Ensure instruction ordering
• instruction_before() - Validate instruction placement

Multi-Stage Build Support:

• stage() - Query specific build stages
• final_stage_has() - Check final stage properties

Programmatic Access:

• custom_check() - Custom validation functions
• DockerfileAccess - Wrapper for Dockerfile graph queries
• ComposeAccess - Wrapper for docker-compose graph queries

Example Usage

from rules import dockerfile_rule, all_of, instruction, missing, instruction_after

@dockerfile_rule(id="DOCKER-003", severity="HIGH")
def insecure_base_and_no_user():
    return all_of(
        instruction(type="FROM", image_tag="latest"),
        missing(instruction="USER")
    )

@dockerfile_rule(id="DOCKER-004", severity="MEDIUM")
def cmd_before_user():
    return instruction_after(instruction="CMD", after="USER")

@dockerfile_rule(id="DOCKER-005", severity="CRITICAL")
def custom_multi_stage_check():
    def check(dockerfile):
        if not dockerfile.is_multi_stage():
            return False
        final = dockerfile.get_final_stage()
        return final.is_running_as_root()
    return custom_check(check, "Multi-stage runs as root")

Testing

• 44 new tests with 97-100% coverage
• All logic combinators tested with nesting
• Sequence matchers tested with strings and matchers
• Mock graph objects for programmatic access testing

Stack

• Depends on: feat(docker): Add Python DSL core for container rules #420 (Python DSL Core)
• Part of: Dockerfile & Docker Compose Support

[shivasurya]

• feat(docker): Expand container security rules from 18 to 47 (+29 new rules) #428
• feat(docker): Container security rule executor and infrastructure (PR 7/8) #422
• feat(docker): Add Python DSL advanced features #421 👈 (View in Graphite)
• feat(docker): Add Python DSL core for container rules #420
• feat(docker): Add docker-compose parser with security queries #419
• feat(docker): Add comprehensive instruction converters for all 18 Dockerfile instructions #418
• feat(docker): Add tree-sitter Dockerfile parsing integration #417
• feat(docker): Add core data structures for Dockerfile parsing #416
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[shivasurya]

Merge activity

• Dec 10, 6:17 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Dec 10, 6:26 AM UTC: Graphite rebased this pull request as part of a merge.
• Dec 10, 6:27 AM UTC: @shivasurya merged this pull request with Graphite.