BETAGuardrails are in beta. The library, the configuration format and the CLI command can still change.

iac

11 guardrails, all at version v1.

Guardrail	Default severity	What it checks
`iac/dockerfile-base-pinned`	`error`	Every image a Dockerfile builds from is pinned to a digest, so a rebuild of the same commit starts from the same bytes.
`iac/dockerfile-healthcheck`	`warning`	Every Dockerfile declares a `HEALTHCHECK`, so the orchestrator can tell a container that is running from one that is working.
`iac/dockerfile-lint-clean`	`warning`	Every finding the Dockerfile linter reported sits below the severity the team gates on.
`iac/dockerfile-no-build-secrets`	`error`	No `ARG` or `ENV` a Dockerfile declares is named like a credential.
`iac/dockerfile-nonroot-user`	`error`	Every Dockerfile ends on a `USER` that is not root, so the container runs its process unprivileged.
`iac/terraform-modules-pinned`	`error`	Every module a Terraform root takes from a registry or a git URL names the version it takes, so the same commit resolves to the same module twice.
`iac/terraform-no-plaintext-secrets`	`error`	Every Terraform variable named like a credential declares `sensitive = true`.
`iac/terraform-providers-pinned`	`error`	Every provider a live Terraform root requires is pinned to one exact version, and the lock file that resolves them is committed.
`iac/terraform-remote-state`	`error`	Every live Terraform root stores its state in a remote backend, and no state file is left in the checkout.
`iac/terraform-state-encrypted`	`error`	Every live Terraform root declares its backend encrypted, so the state it writes is not readable from the bucket it sits in.
`iac/terraform-state-locking`	`error`	Every live Terraform root declares state locking, so two applies cannot write the same state at once.

Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.