Extend lint rule for daemon flags

pkg/lint/rules.go

@@ -21,6 +21,29 @@ import (
 )
 
 var (
+	daemonFlags = []string{
+		`-d\b`,
+		`--daemon\b`,
+		`--daemonize\b`,
+		`--detach\b`,
+		`-daemon\b`,
+	}
+
+	redirPatterns = []string{
+		`>\s*\S+`,
+		`>>\s*\S+`,
+		`2>\s*\S+`,
+		`2>>\s*\S+`,
+		`&>\s*\S+`,
+		`&>>\s*\S+`,
+		`>\s*\S+.*2>&1`,
+		`2>&1.*>\s*\S+`,
+		`>\s*/dev/null`,
+		`2>\s*/dev/null`,
+		`&>\s*/dev/null`,
+		`\d+>&\d+`,
+	}
+
 	reValidSHA256 = regexp.MustCompile(`^[a-fA-F0-9]{64}$`)
 	reValidSHA512 = regexp.MustCompile(`^[a-fA-F0-9]{128}$`)
 	reValidSHA1   = regexp.MustCompile(`^[a-fA-F0-9]{40}$`)
@@ -44,8 +67,11 @@ var (
 		"www.libssh.org": "www.libssh2.org",
 	}
 
-	// Detect background processes (commands ending with '&' or '& sleep ...') that do not redirect output
+	// Detect background processes (commands ending with '&' or '& sleep ...') or daemonized commands
 	reBackgroundProcess = regexp.MustCompile(`&(?:\s*$|\s+sleep\b)`) // matches 'cmd &' or 'cmd & sleep'
+	reDaemonProcess     = regexp.MustCompile(`.*(?:` + strings.Join(daemonFlags, "|") + `).*`)
+	// Detect output redirection in shell commands
+	reOutputRedirect = regexp.MustCompile(strings.Join(redirPatterns, "|"))
 )
 
 const gitCheckout = "git-checkout"
@@ -469,7 +495,8 @@ var AllRules = func(l *Linter) Rules { //nolint:gocyclo
 						if s.Runs == "" {
 							continue
 						}
-						if reBackgroundProcess.MatchString(s.Runs) && !strings.Contains(s.Runs, "2>&1") && !strings.Contains(s.Runs, "&>") {
+						needsRedirect := reBackgroundProcess.MatchString(s.Runs) || reDaemonProcess.MatchString(s.Runs)
+						if needsRedirect && !reOutputRedirect.MatchString(s.Runs) {
 							return fmt.Errorf("background process missing output redirect: %s", s.Runs)
 						}
 					}

pkg/lint/rules_test.go

@@ -494,6 +494,31 @@ func TestLinter_Rules(t *testing.T) {
 			wantErr:     false,
 			matches:     0,
 		},
+		{
+			file:        "daemon-flag-no-redirect.yaml",
+			minSeverity: SeverityWarning,
+			want: EvalResult{
+				File: "daemon-flag-no-redirect",
+				Errors: EvalRuleErrors{
+					{
+						Rule: Rule{
+							Name:     "background-process-without-redirect",
+							Severity: SeverityWarning,
+						},
+						Error: fmt.Errorf("[background-process-without-redirect]: background process missing output redirect: croc relay --daemon (WARNING)"),
+					},
+				},
+			},
+			wantErr: false,
+			matches: 1,
+		},
+		{
+			file:        "daemon-flag-with-redirect.yaml",
+			minSeverity: SeverityWarning,
+			want:        EvalResult{},
+			wantErr:     false,
+			matches:     0,
+		},
 	}
 
 	for _, tt := range tests {

pkg/lint/testdata/files/daemon-flag-no-redirect.yaml

@@ -0,0 +1,20 @@
+package:
+  name: daemon-flag-no-redirect
+  version: 1.0.0
+  epoch: 0
+  description: Package with daemon flag without redirect
+  copyright:
+    - paths:
+        - "*"
+      attestation: TODO
+      license: GPL-2.0-only
+pipeline:
+  - uses: fetch
+    with:
+      uri: https://test.com/daemon/${{package.version}}.tar.gz
+      expected-sha256: ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+test:
+  pipeline:
+    - runs: "croc relay --daemon"
+update:
+  enabled: true

pkg/lint/testdata/files/daemon-flag-with-redirect.yaml

@@ -0,0 +1,20 @@
+package:
+  name: daemon-flag-with-redirect
+  version: 1.0.0
+  epoch: 0
+  description: Package with daemon flag and redirect
+  copyright:
+    - paths:
+        - "*"
+      attestation: TODO
+      license: GPL-2.0-only
+pipeline:
+  - uses: fetch
+    with:
+      uri: https://test.com/daemon/${{package.version}}.tar.gz
+      expected-sha256: ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+test:
+  pipeline:
+    - runs: "croc relay --daemon > croc.log 2>&1"
+update:
+  enabled: true