checks/credentialform: a module that provides and keeps a bound state must be read by mesh-provisioner (issue 1952)

checks/credentialform/main.go

@@ -21,6 +21,8 @@ func Problems(root string) ([]string, error) {
 	}
 	sort.Strings(files)
 	var out []string
+	reads := map[string]bool{}
+	var binders []string
 	for _, f := range files {
 		raw, err := os.ReadFile(f)
 		if err != nil {
@@ -31,6 +33,38 @@ func Problems(root string) ([]string, error) {
 			return nil, fmt.Errorf("%s: %w", f, err)
 		}
 		out = append(out, catalogue.CredentialFormProblems(m)...)
+		var kept struct {
+			Reads []string          `json:"reads"`
+			State []json.RawMessage `json:"state"`
+		}
+		_ = json.Unmarshal(raw, &kept) // reads may hold objects in another module; only the provisioner's are read
+		if m.Module == "mesh-provisioner" {
+			for _, r := range kept.Reads {
+				reads[r] = true
+			}
+		}
+		if len(m.Provides) > 0 && keepsBound(kept.State) {
+			binders = append(binders, m.Module)
+		}
+	}
+	for _, module := range binders {
+		if !reads[module+".bound"] {
+			out = append(out, fmt.Sprintf("%s provides and keeps a `bound` state, and mesh-provisioner's manifest does not read %s.bound", module, module))
+		}
 	}
 	return out, nil
 }
+
+// keepsBound says whether a manifest's `state` names `bound`, as a plain name or an object with a name.
+func keepsBound(state []json.RawMessage) bool {
+	for _, s := range state {
+		var name string
+		var obj struct {
+			Name string `json:"name"`
+		}
+		if json.Unmarshal(s, &name) == nil && name == "bound" || json.Unmarshal(s, &obj) == nil && obj.Name == "bound" {
+			return true
+		}
+	}
+	return false
+}