fix(docker-to-sealos): block license-gated s3 options (#70)

Author: yangchuansheng

skills/docker-to-sealos/SKILL.md

@@ -180,6 +180,7 @@ For login-gated web applications, live validation must prove the real credential
 - Omit ConfigMap volume `defaultMode` unless the application explicitly needs a non-default mode. ConfigMap scripts invoked through `/bin/sh /path/script` do not need executable bits.
 - Avoid long inline startup scripts or heredocs in `command`/`args`; place initialization/start scripts in ConfigMap files and invoke them with a short command.
 - When object storage is required and Sealos can satisfy it, create `ObjectStorageBucket` and inject Sealos object-storage secrets; managed Sealos toggles such as `use_sealos_objectstorage` may control the `ObjectStorageBucket` branch; external S3/object-storage credential inputs require `metadata.annotations.docker-to-sealos.external-object-storage-source` evidence, and must not coexist with `ObjectStorageBucket`.
+- If object storage/S3 integration is Enterprise, paid, commercial, subscription, or license-gated in the upstream application, keep the public template on the community-supported storage path (for example filesystem/PVC) and expose no standard `ObjectStorageBucket` or S3 input for that feature.
 
 ### Env and secrets
 

skills/docker-to-sealos/references/conversion-mappings.md

@@ -903,6 +903,8 @@ When docs offer local file storage and S3-compatible object storage as a binary
 
 When an app needs S3-compatible storage, prefer Sealos `ObjectStorageBucket` and inject the managed object-storage secrets into the app. Preserve managed Sealos toggles such as `use_sealos_objectstorage` when they control an optional `ObjectStorageBucket` branch. Expose external S3/object-storage credential inputs only when source docs or the user require an externally managed bucket, and record that evidence in `metadata.annotations.docker-to-sealos.external-object-storage-source`. Do not combine external S3 credential inputs with a managed `ObjectStorageBucket`.
 
+Before adding Sealos ObjectStorage for an application feature, verify the upstream edition and license requirements. When S3/external object storage support is Enterprise, paid, commercial, subscription, or license-gated, the public template must use the community-supported storage path (usually filesystem/PVC) and must not expose a standard deployment input that provisions `ObjectStorageBucket` or injects S3 env vars for that feature. Add an enterprise-specific template branch only when the user explicitly requests that scope.
+
 ### Docker Compose (Using Minio)
 ```yaml
 services:

skills/docker-to-sealos/references/must-rules-map.yaml

@@ -216,6 +216,10 @@ must_rules:
     enforcement:
       type: rule
       target: R047
+  - must: "If object storage/S3 integration is Enterprise, paid, commercial, subscription, or license-gated in the upstream application, keep the public template on the community-supported storage path (for example filesystem/PVC) and expose no standard `ObjectStorageBucket` or S3 input for that feature."
+    enforcement:
+      type: rule
+      target: R049
   - must: "Non-database sensitive values/inputs use direct `env[].value`."
     enforcement:
       type: manual

skills/docker-to-sealos/references/rules-registry.yaml

@@ -148,3 +148,6 @@ rules:
   - id: R011
     description: All PVC storage requests must be concrete values and less than or equal to 1Gi.
     severity: error
+  - id: R049
+    description: Public templates must not expose standard ObjectStorage/S3 inputs for features that require Enterprise, paid, commercial, subscription, or license-gated upstream editions.
+    severity: error

skills/docker-to-sealos/references/sealos-specs.md

@@ -593,6 +593,8 @@ metadata:
 
 ## Object Storage Configuration
 
+Use ObjectStorage only for application features available in the upstream self-hosted/community edition. If S3/object-storage support requires Enterprise, paid, commercial, subscription, or license activation, the public template must keep the supported filesystem/PVC storage path and must not expose an `ObjectStorageBucket` or S3 toggle for that feature.
+
 ### Environment Variable Settings
 
 Object storage environment variable configuration must follow this format:

skills/docker-to-sealos/scripts/check_consistency_rules_app.py

@@ -134,6 +134,14 @@
 MAIN_CONTAINER_MAX_SCRIPT_CHARS = 160
 MAIN_CONTAINER_MAX_SCRIPT_COMMANDS = 2
 CONFIGMAP_DATA_KEY_RE = re.compile(r"^vn-[a-z0-9]+(?:vn-[a-z0-9]+)*$")
+OBJECT_STORAGE_INPUT_TEXT_RE = re.compile(
+    r"\b(?:object\s*storage|objectstorage|s3|s3-compatible|bucket|binary\s+data|external\s+storage)\b",
+    re.IGNORECASE,
+)
+LICENSE_GATED_TEXT_RE = re.compile(
+    r"\b(?:enterprise|paid|commercial|premium|subscription|license|licensed|licence|licenced)\b",
+    re.IGNORECASE,
+)
 OBJECT_STORAGE_BRANCH_MARKER_RE = re.compile(
     r"\b(?:ObjectStorageBucket|object-storage-key|object\s+storage|s3[_-]|aws_access_key_id|"
     r"aws_secret_access_key|storage_s3|s3-compatible|bucket|bucket_name|minio)\b",
@@ -152,9 +160,13 @@
     "ENABLE_S3_STORAGE",
     "ENABLE_SEALOS_OBJECT_STORAGE",
     "ENABLE_SEALOS_OBJECTSTORAGE",
+    "ENABLE_S3",
     "USE_OBJECT_STORAGE",
+    "USE_MANAGED_OBJECT_STORAGE",
+    "USE_MANAGED_S3",
     "USE_SEALOS_OBJECT_STORAGE",
     "USE_SEALOS_OBJECTSTORAGE",
+    "USE_SEALOS_S3",
 }
 TEMPLATE_IF_RE = re.compile(r"\$\{\{\s*if\s*\((.*?)\)\s*\}\}")
 TEMPLATE_ENDIF_RE = re.compile(r"\$\{\{\s*endif\(\)\s*\}\}")
@@ -2295,6 +2307,105 @@ def _external_object_storage_source(doc: YamlDocument) -> str:
     return value.strip() if isinstance(value, str) else ""
 
 
+def _iter_template_inputs(spec: Dict[str, Any]) -> Iterable[Tuple[str, Any]]:
+    inputs = spec.get("inputs")
+    if isinstance(inputs, dict):
+        for name, input_spec in inputs.items():
+            if isinstance(name, str):
+                yield name, input_spec
+        return
+    if isinstance(inputs, list):
+        for item in inputs:
+            if not isinstance(item, dict):
+                continue
+            name = item.get("name")
+            if isinstance(name, str):
+                yield name, item
+
+
+def _template_input_text(name: str, input_spec: Any) -> str:
+    parts = [name]
+    if isinstance(input_spec, dict):
+        for key in ("label", "title", "description", "default", "value"):
+            value = input_spec.get(key)
+            if isinstance(value, str):
+                parts.append(value)
+    elif isinstance(input_spec, str):
+        parts.append(input_spec)
+    return "\n".join(parts)
+
+
+def _object_storage_branch_inputs_by_path(context: ScanContext) -> Dict[Path, set[str]]:
+    inputs_by_path: Dict[Path, set[str]] = {}
+    for path in _iter_template_artifact_paths(context):
+        text = context.file_texts.get(path, "")
+        lines = text.splitlines()
+        for index, line in enumerate(lines):
+            match = TEMPLATE_IF_RE.search(line)
+            if match is None:
+                continue
+            input_names = _condition_input_refs(match.group(1))
+            if not input_names:
+                continue
+            branch_end = _find_branch_end(lines, index)
+            branch_text = "\n".join(lines[index: branch_end + 1])
+            if not _branch_uses_object_storage(branch_text):
+                continue
+            inputs_by_path.setdefault(path, set()).update(input_names)
+    return inputs_by_path
+
+
+def _input_declaration_line(doc: YamlDocument, input_name: str) -> int:
+    escaped = re.escape(input_name)
+    inputs_line = doc.line_locator.find(r"^\s*inputs\s*:", default=doc.start_line)
+    list_name_line = doc.line_locator.find(
+        rf"^\s*name\s*:\s*['\"]?{escaped}['\"]?\s*$",
+        default=inputs_line,
+    )
+    return doc.line_locator.find(rf"^\s*{escaped}\s*:", default=list_name_line)
+
+
+def check_license_gated_object_storage_options(context: ScanContext) -> List[Violation]:
+    violations: List[Violation] = []
+    object_storage_branch_inputs = _object_storage_branch_inputs_by_path(context)
+
+    for doc in _iter_template_artifact_documents(context):
+        spec = doc.data.get("spec") if isinstance(doc.data, dict) else None
+        if not isinstance(spec, dict):
+            continue
+        branch_inputs = object_storage_branch_inputs.get(doc.path, set())
+
+        for input_name, input_spec in _iter_template_inputs(spec):
+            input_text = _template_input_text(input_name, input_spec)
+            if LICENSE_GATED_TEXT_RE.search(input_text) is None:
+                continue
+
+            normalized_name = _normalize_template_input_name(input_name)
+            is_object_storage_input = (
+                input_name in branch_inputs
+                or normalized_name in MANAGED_OBJECT_STORAGE_TOGGLE_NAMES
+                or EXTERNAL_OBJECT_STORAGE_INPUT_RE.search(normalized_name) is not None
+                or OBJECT_STORAGE_INPUT_TEXT_RE.search(input_text) is not None
+            )
+            if not is_object_storage_input:
+                continue
+
+            violations.append(
+                Violation(
+                    rule_id="R049",
+                    path=doc.path,
+                    line=_input_declaration_line(doc, input_name),
+                    message=(
+                        "license-gated object storage/S3 features must not be exposed as standard "
+                        "public-template inputs; use the community-supported filesystem/PVC mode "
+                        "or create a dedicated enterprise template only when explicitly requested"
+                    ),
+                )
+            )
+
+    return violations
+
+
 def check_external_object_storage_inputs(context: ScanContext) -> List[Violation]:
     violations: List[Violation] = []
     object_storage_paths = {
@@ -3095,6 +3206,7 @@ def _container_requires_image_pull_secret(container: Dict[str, Any]) -> bool:
     "R044": Rule("R044", check_optional_object_storage_uses_boolean_input),
     "R045": Rule("R045", check_template_input_references_declared),
     "R047": Rule("R047", check_external_object_storage_inputs),
+    "R049": Rule("R049", check_license_gated_object_storage_options),
     "R031": Rule("R031", check_ingress_name_matches_backends),
     "R026": Rule("R026", check_http_ingress_annotations),
     "R048": Rule("R048", check_websocket_ingress_annotations),

skills/docker-to-sealos/scripts/test_check_consistency.py

@@ -3657,6 +3657,129 @@ def test_allows_managed_sealos_objectstorage_toggle_with_object_storage_bucket(s
             )
             self.assertFalse(any(item.rule_id == "R047" for item in violations))
 
+    def test_detects_license_gated_managed_object_storage_toggle(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            skill = root / "SKILL.md"
+            refs_dir = root / "references"
+            refs_file = refs_dir / "sample.md"
+            rules_file = refs_dir / "rules-registry.yaml"
+            artifact_file = root / "template" / "demo" / "index.yaml"
+
+            write_file(skill, "# no yaml snippets\n")
+            write_file(refs_file, "# refs\n")
+            write_registry(rules_file)
+            write_file(
+                artifact_file,
+                """
+                apiVersion: app.sealos.io/v1
+                kind: Template
+                metadata:
+                  name: demo
+                spec:
+                  title: Demo
+                  url: https://example.com
+                  gitRepo: https://github.com/example/demo
+                  author: example
+                  description: demo
+                  icon: https://raw.githubusercontent.com/labring-actions/templates/kb-0.9/template/demo/logo.png
+                  templateType: inline
+                  locale: en
+                  readme: https://raw.githubusercontent.com/labring-actions/templates/kb-0.9/template/demo/README.md
+                  i18n:
+                    zh:
+                      description: demo
+                      readme: https://raw.githubusercontent.com/labring-actions/templates/kb-0.9/template/demo/README_zh.md
+                  categories:
+                    - tool
+                  inputs:
+                    use_sealos_objectstorage:
+                      description: Provision Sealos ObjectStorage for Enterprise S3 binary data storage. Requires a valid license.
+                      type: boolean
+                      default: 'false'
+                ---
+                ${{ if(inputs.use_sealos_objectstorage === 'true') }}
+                apiVersion: objectstorage.sealos.io/v1
+                kind: ObjectStorageBucket
+                metadata:
+                  name: ${{ defaults.app_name }}
+                spec:
+                  policy: private
+                ${{ endif() }}
+                """,
+            )
+
+            violations = CHECKER.run_checks(
+                skill,
+                refs_dir,
+                rules_file,
+                additional_include_paths=["template/demo/index.yaml"],
+            )
+
+        self.assertTrue(any(item.rule_id == "R049" for item in violations))
+        self.assertTrue(any("license-gated" in item.message for item in violations if item.rule_id == "R049"))
+
+    def test_allows_community_managed_object_storage_toggle(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            skill = root / "SKILL.md"
+            refs_dir = root / "references"
+            refs_file = refs_dir / "sample.md"
+            rules_file = refs_dir / "rules-registry.yaml"
+            artifact_file = root / "template" / "demo" / "index.yaml"
+
+            write_file(skill, "# no yaml snippets\n")
+            write_file(refs_file, "# refs\n")
+            write_registry(rules_file)
+            write_file(
+                artifact_file,
+                """
+                apiVersion: app.sealos.io/v1
+                kind: Template
+                metadata:
+                  name: demo
+                spec:
+                  title: Demo
+                  url: https://example.com
+                  gitRepo: https://github.com/example/demo
+                  author: example
+                  description: demo
+                  icon: https://raw.githubusercontent.com/labring-actions/templates/kb-0.9/template/demo/logo.png
+                  templateType: inline
+                  locale: en
+                  readme: https://raw.githubusercontent.com/labring-actions/templates/kb-0.9/template/demo/README.md
+                  i18n:
+                    zh:
+                      description: demo
+                      readme: https://raw.githubusercontent.com/labring-actions/templates/kb-0.9/template/demo/README_zh.md
+                  categories:
+                    - tool
+                  inputs:
+                    use_sealos_objectstorage:
+                      description: Provision Sealos ObjectStorage for S3-compatible file uploads.
+                      type: boolean
+                      default: 'false'
+                ---
+                ${{ if(inputs.use_sealos_objectstorage === 'true') }}
+                apiVersion: objectstorage.sealos.io/v1
+                kind: ObjectStorageBucket
+                metadata:
+                  name: ${{ defaults.app_name }}
+                spec:
+                  policy: private
+                ${{ endif() }}
+                """,
+            )
+
+            violations = CHECKER.run_checks(
+                skill,
+                refs_dir,
+                rules_file,
+                additional_include_paths=["template/demo/index.yaml"],
+            )
+
+        self.assertFalse(any(item.rule_id == "R049" for item in violations))
+
     def test_detects_external_s3_inputs_without_source_annotation(self):
         with tempfile.TemporaryDirectory() as temp_dir:
             root = Path(temp_dir)