Validation rules: build/source mode enforcement

code/go/internal/specschema/folder_item_spec.go

@@ -81,6 +81,12 @@ func (s *ItemSpec) DevelopmentFolder() bool {
 	return s.itemSpec.DevelopmentFolder
 }
 
+// ValidationMode returns the mode in which this item is valid: "source",
+// "build", or "" (both modes).
+func (s *ItemSpec) ValidationMode() string {
+	return s.itemSpec.ValidationMode
+}
+
 // AllowLink returns true if the item allows links.
 func (s *ItemSpec) AllowLink() bool {
 	return s.itemSpec.AllowLink
@@ -142,6 +148,10 @@ type folderItemSpec struct {
 	DevelopmentFolder  bool              `json:"developmentFolder" yaml:"developmentFolder"`
 	AllowLink          bool              `json:"allowLink" yaml:"allowLink"`
 
+	// ValidationMode restricts the item to a specific validation mode: "source",
+	// "build", or "" (both modes).
+	ValidationMode string `json:"validationMode" yaml:"validationMode"`
+
 	// As it is required to be inline both in yaml and json, this struct must be public embedded field
 	SpecLimits `yaml:",inline"`
 

code/go/internal/specschema/folder_spec.go

@@ -97,6 +97,10 @@ func (l *FolderSpecLoader) loadContents(s *folderItemSpec, fs fs.FS, specPath st
 			return fmt.Errorf("item [%s] visibility is expected to be private or public, not [%s]", path.Join(specPath, content.Name), content.Visibility)
 		}
 
+		if vm := content.ValidationMode; vm != "" && vm != spectypes.ValidationModeSource && vm != spectypes.ValidationModeBuild {
+			return fmt.Errorf("item [%s] validationMode is expected to be %q or %q, not [%s]", path.Join(specPath, content.Name), spectypes.ValidationModeSource, spectypes.ValidationModeBuild, vm)
+		}
+
 		// All folders inside a development folder are too.
 		if s.DevelopmentFolder {
 			content.DevelopmentFolder = true

code/go/internal/spectypes/item.go

@@ -16,6 +16,14 @@ const (
 
 	// ItemTypeFolder is the type of an item that represents a folder.
 	ItemTypeFolder = "folder"
+
+	// ValidationModeSource marks an item as valid only in source packages (not in built packages).
+	// The string value must match validator.SourceMode.
+	ValidationModeSource = "source"
+
+	// ValidationModeBuild marks an item as valid only in built packages (not in source packages).
+	// The string value must match validator.BuildMode.
+	ValidationModeBuild = "build"
 )
 
 // LimitsSpec contain the specifications related to limits.
@@ -57,6 +65,10 @@ type ItemSpec interface {
 	// DevelopmentFolder returns true if the item is inside a development folder.
 	DevelopmentFolder() bool
 
+	// ValidationMode returns the mode in which this item is valid: "source",
+	// "build", or "" (both modes).
+	ValidationMode() string
+
 	// AllowLink returns true if the item allows links.
 	AllowLink() bool
 

code/go/internal/validator/folder_item_spec.go

@@ -13,6 +13,15 @@ import (
 	"github.com/elastic/package-spec/v3/code/go/pkg/specerrors"
 )
 
+// itemForbiddenInMode returns true if the item is forbidden in the given mode.
+// LegacyMode is never restricted.
+func itemForbiddenInMode(spec spectypes.ItemSpec, mode Mode) bool {
+	if mode == LegacyMode {
+		return false
+	}
+	return spec.ValidationMode() != "" && spec.ValidationMode() != string(mode)
+}
+
 func matchingFileExists(spec spectypes.ItemSpec, files []fs.DirEntry) (bool, error) {
 	if spec.Name() != "" {
 		for _, file := range files {

code/go/internal/validator/folder_spec.go

@@ -23,21 +23,23 @@ type validator struct {
 	pkg              *packages.Package
 	folderPath       string
 	warningsAsErrors bool
+	mode             Mode
 
 	totalSize     spectypes.FileSize
 	totalContents int
 }
 
-func newValidator(spec spectypes.ItemSpec, pkg *packages.Package, warningsAsErrors bool) *validator {
-	return newValidatorForPath(spec, pkg, ".", warningsAsErrors)
+func newValidator(spec spectypes.ItemSpec, pkg *packages.Package, warningsAsErrors bool, mode Mode) *validator {
+	return newValidatorForPath(spec, pkg, ".", warningsAsErrors, mode)
 }
 
-func newValidatorForPath(spec spectypes.ItemSpec, pkg *packages.Package, folderPath string, warningsAsErrors bool) *validator {
+func newValidatorForPath(spec spectypes.ItemSpec, pkg *packages.Package, folderPath string, warningsAsErrors bool, mode Mode) *validator {
 	return &validator{
 		spec:             spec,
 		pkg:              pkg,
 		folderPath:       folderPath,
 		warningsAsErrors: warningsAsErrors,
+		mode:             mode,
 	}
 }
 
@@ -83,6 +85,15 @@ func (v *validator) Validate() specerrors.ValidationErrors {
 
 	for _, file := range files {
 		fileName := file.Name()
+
+		if isLink, _ := checkLink(fileName); v.mode == BuildMode && isLink {
+			errs = append(errs, specerrors.NewStructuredErrorf(
+				"file %q: .link files are not allowed in built packages",
+				v.pkg.Path(path.Join(v.folderPath, fileName)),
+			))
+			continue
+		}
+
 		itemSpec, err := v.findItemSpec(fileName)
 		if err != nil {
 			errs = append(errs, specerrors.NewStructuredError(err, specerrors.UnassignedCode))
@@ -119,8 +130,18 @@ func (v *validator) Validate() specerrors.ValidationErrors {
 				continue
 			}
 
+			if itemForbiddenInMode(itemSpec, v.mode) {
+				errs = append(errs, specerrors.NewStructuredErrorf(
+					"file %q: %s-only folder is not allowed in %s packages",
+					v.pkg.Path(path.Join(v.folderPath, fileName)),
+					itemSpec.ValidationMode(),
+					string(v.mode),
+				))
+				continue
+			}
+
 			subFolderPath := path.Join(v.folderPath, fileName)
-			itemValidator := newValidatorForPath(itemSpec, v.pkg, subFolderPath, v.warningsAsErrors)
+			itemValidator := newValidatorForPath(itemSpec, v.pkg, subFolderPath, v.warningsAsErrors, v.mode)
 			subErrs := itemValidator.Validate()
 			if len(subErrs) > 0 {
 				errs = append(errs, subErrs...)
@@ -139,6 +160,16 @@ func (v *validator) Validate() specerrors.ValidationErrors {
 				continue
 			}
 
+			if itemForbiddenInMode(itemSpec, v.mode) {
+				errs = append(errs, specerrors.NewStructuredErrorf(
+					"file %q: %s-only file is not allowed in %s packages",
+					v.pkg.Path(path.Join(v.folderPath, fileName)),
+					itemSpec.ValidationMode(),
+					string(v.mode),
+				))
+				continue
+			}
+
 			itemPath := path.Join(v.folderPath, file.Name())
 			itemValidationErrs := validateFile(itemSpec, v.pkg, itemPath)
 			for _, ive := range itemValidationErrs {
@@ -231,9 +262,6 @@ func (v *validator) findItemSpec(folderItemName string) (spectypes.ItemSpec, err
 // checkLink checks if an item is a link and returns the item name without the
 // ".link" suffix if it is a link.
 func checkLink(itemName string) (bool, string) {
-	const linkExtension = ".link"
-	if strings.HasSuffix(itemName, linkExtension) {
-		return true, strings.TrimSuffix(itemName, linkExtension)
-	}
-	return false, itemName
+	stripped, isLink := strings.CutSuffix(itemName, ".link")
+	return isLink, stripped
 }

code/go/internal/validator/modes.go

@@ -14,9 +14,11 @@ const (
 	LegacyMode Mode = "legacy"
 	// SourceMode validates a package as a checked-out source tree: linked files
 	// are resolved transparently and source-only rules are enforced.
+	// The string value must match spectypes.ValidationModeSource.
 	SourceMode Mode = "source"
 	// BuildMode validates a package as a built artifact: linked files are
 	// unconditionally blocked and build-only rules are enforced.
+	// The string value must match spectypes.ValidationModeBuild.
 	BuildMode Mode = "build"
 )
 

code/go/internal/validator/semantic/types.go

@@ -352,9 +352,11 @@ func listDataStreams(fsys fspath.FS) ([]string, error) {
 		return nil, fmt.Errorf("can't list data streams directory: %w", err)
 	}
 
-	list := make([]string, len(dataStreams))
-	for i, dataStream := range dataStreams {
-		list[i] = dataStream.Name()
+	var list []string
+	for _, dataStream := range dataStreams {
+		if dataStream.IsDir() {
+			list = append(list, dataStream.Name())
+		}
 	}
 	return list, nil
 }

code/go/internal/validator/semantic/validate_datastream_package_categories.go

@@ -105,7 +105,7 @@ func ValidateDatastreamPackageCategories(fsys fspath.FS) specerrors.ValidationEr
 			specerrors.NewStructuredErrorf("file \"%s\" is invalid: %w", fsys.Path(manifestPath), err)}
 	}
 
-	if pkgType != packageTypeIntegration {
+	if pkgType != integrationPackageType {
 		return nil
 	}
 

code/go/internal/validator/semantic/validate_integration_inputs_deprecated.go

@@ -47,7 +47,7 @@ func ValidateIntegrationInputsDeprecation(fsys fspath.FS) specerrors.ValidationE
 			specerrors.NewStructuredErrorf("file \"%s\" is invalid: %w", fsys.Path(manifestPath), err)}
 	}
 	// skip if not an integration package
-	if m.Type != packageTypeIntegration {
+	if m.Type != integrationPackageType {
 		return nil
 	}
 

code/go/internal/validator/semantic/validate_integration_policy_template_path.go

@@ -20,11 +20,11 @@ import (
 
 const (
 	defaultStreamTemplatePath = "stream.yml.hbs"
-	packageTypeIntegration    = "integration"
 )
 
 type policyTemplateInput struct {
 	Type          string   `yaml:"type"`
+	Package       string   `yaml:"package"`
 	TemplatePath  string   `yaml:"template_path"`
 	TemplatePaths []string `yaml:"template_paths"`
 }
@@ -41,6 +41,7 @@ type integrationPackageManifest struct { // package manifest
 
 type stream struct {
 	Input         string   `yaml:"input"`
+	Package       string   `yaml:"package"`
 	TemplatePath  string   `yaml:"template_path"`
 	TemplatePaths []string `yaml:"template_paths"`
 }
@@ -78,7 +79,7 @@ func ValidateIntegrationPolicyTemplates(fsys fspath.FS) specerrors.ValidationErr
 			specerrors.NewStructuredErrorf("file \"%s\" is invalid: %w", fsys.Path(manifestPath), errFailedToParseManifest)}
 	}
 
-	if manifest.Type != packageTypeIntegration {
+	if manifest.Type != integrationPackageType {
 		return nil
 	}
 
@@ -110,6 +111,9 @@ func ValidateIntegrationPolicyTemplates(fsys fspath.FS) specerrors.ValidationErr
 // under agent/input when template_paths or template_path is set (Fleet: template_paths first).
 func validateIntegrationPolicyTemplateInputs(fsys fspath.FS, policyTemplate integrationPolicyTemplate) error {
 	for _, input := range policyTemplate.Inputs {
+		// Only validate template files that are explicitly declared; if none are set there
+		// is nothing to check (composable inputs without overlay templates source them from
+		// the dependency package, which is absent from the source tree).
 		if len(input.TemplatePaths) > 0 {
 			for _, tp := range input.TemplatePaths {
 				if err := validateAgentInputTemplatePath(fsys, tp); err != nil {
@@ -141,6 +145,11 @@ func validateAllDataStreamStreamTemplates(fsys fspath.FS, dsMap map[string]dataS
 		dsManifestPath := path.Join(dsDir, "manifest.yml")
 		manifest := dsMap[dsDir]
 		for _, s := range manifest.Streams {
+			// Don't validate template paths if they use a package as input
+			// and they don't define any template.
+			if s.Package != "" && s.TemplatePath == "" && len(s.TemplatePaths) == 0 {
+				continue
+			}
 			if err := validateSingleDataStreamStreamTemplates(fsys, dsDir, s); err != nil {
 				errs = append(errs, specerrors.NewStructuredErrorf(
 					"file \"%s\" is invalid: data stream \"%s\" stream input %q: %w",