DigitalOcean App Platform
Reviews App Platform app specs for the mistakes that cause downtime, leaked
secrets, and broken routing. Ships a stdlib-only validator, do_app_spec_lint.py,
that ingests the spec as JSON (recommended), the block-YAML DO emits, or the
digitalocean_app Terraform resource, and reports findings with a rule id,
severity, and a one-line fix.
When to invoke
- Reviewing or authoring an
app.yaml / .do/app.yaml / digitalocean_app.
- A service has downtime on deploy or flaps with no warning (health check / HA).
- DigitalOcean warns that
routes is deprecated.
- A credential may be sitting in an env
value in plaintext.
- Ingress routing behaves unexpectedly (overlapping prefixes).
Cross-cutting rules
- Prefer JSON input.
doctl apps spec get <app-id> --format json is the
most reliable input; the YAML path is a subset parser and rejects anchors,
flow collections, and folded/literal scalars.
- Never put a literal secret in an env
value. Use type: SECRET and a
${VAR} substitution. Values containing ${...} (GitHub secrets, ${db.X}
bindable refs, ${APP_URL} app-wide vars) are references, not literals.
- The app spec is the source of truth. App Platform reconciles to the spec
on every deploy; fix the spec, not the running app.
Running the validator
# JSON (recommended)
doctl apps spec get <app-id> --format json > spec.json
python3 scripts/do_app_spec_lint.py spec.json
# YAML subset, or Terraform — format auto-detected by extension/content
python3 scripts/do_app_spec_lint.py .do/app.yaml
python3 scripts/do_app_spec_lint.py main.tf
# machine-readable
python3 scripts/do_app_spec_lint.py spec.json --format json
Exit 0 = clean or warnings only; 1 = at least one error-severity finding;
2 = unreadable/unparseable input.
Checks
- Secrets —
secret-not-encrypted (literal secret with type != SECRET),
secret-build-scope (SECRET scoped RUN_AND_BUILD_TIME leaks into the build).
- Reliability —
no-health-check, single-instance (one instance, no
autoscaling), dev-db-as-prod (database with production: false).
- Correctness —
port-mismatch, route-overlap, source-conflict (both
git and image), deprecated-routes.
- Sizing —
unknown-instance-slug, db-region-mismatch.
Proactive triggers
- env
value is a literal API key/token/password (type != SECRET) → flag
secret-not-encrypted; move to type: SECRET + ${VAR}.
- a
service has instance_count: 1 and no autoscaling → warn single point
of failure.
- a
service has no health_check.http_path → warn deploys can't detect
unhealthy instances.
- both a git source and an
image on one component → flag source-conflict.
- component-level
routes present → recommend spec.ingress.rules.
production: false on a database backing real traffic → warn dev database.
1---2name: digitalocean-app-platform3description: Lints DigitalOcean App Platform app specs (app.yaml / doctl apps spec JSON / digitalocean_app Terraform) for security, reliability, correctness, and sizing anti-patterns — plaintext secrets, missing health checks, single-instance services, dev databases in production, port mismatches, overlapping ingress routes, conflicting git/image sources, deprecated routes, unknown instance sizes, and app/database region mismatch. Use when working with DigitalOcean App Platform, app.yaml, .do/app.yaml, doctl apps, the digitalocean_app Terraform resource, or reviewing an App Platform deployment for problems.4---56# DigitalOcean App Platform78Reviews App Platform app specs for the mistakes that cause downtime, leaked9secrets, and broken routing. Ships a stdlib-only validator, `do_app_spec_lint.py`,10that ingests the spec as JSON (recommended), the block-YAML DO emits, or the11`digitalocean_app` Terraform resource, and reports findings with a rule id,12severity, and a one-line fix.1314## When to invoke1516- Reviewing or authoring an `app.yaml` / `.do/app.yaml` / `digitalocean_app`.17- A service has downtime on deploy or flaps with no warning (health check / HA).18- DigitalOcean warns that `routes` is deprecated.19- A credential may be sitting in an env `value` in plaintext.20- Ingress routing behaves unexpectedly (overlapping prefixes).2122## Cross-cutting rules23241. **Prefer JSON input.** `doctl apps spec get <app-id> --format json` is the25 most reliable input; the YAML path is a subset parser and rejects anchors,26 flow collections, and folded/literal scalars.272. **Never put a literal secret in an env `value`.** Use `type: SECRET` and a28 `${VAR}` substitution. Values containing `${...}` (GitHub secrets, `${db.X}`29 bindable refs, `${APP_URL}` app-wide vars) are references, not literals.303. **The app spec is the source of truth.** App Platform reconciles to the spec31 on every deploy; fix the spec, not the running app.3233## Running the validator3435```bash36# JSON (recommended)37doctl apps spec get <app-id> --format json > spec.json38python3 scripts/do_app_spec_lint.py spec.json3940# YAML subset, or Terraform — format auto-detected by extension/content41python3 scripts/do_app_spec_lint.py .do/app.yaml42python3 scripts/do_app_spec_lint.py main.tf4344# machine-readable45python3 scripts/do_app_spec_lint.py spec.json --format json46```4748Exit 0 = clean or warnings only; 1 = at least one error-severity finding;492 = unreadable/unparseable input.5051## Checks5253- **Secrets** — `secret-not-encrypted` (literal secret with type != SECRET),54 `secret-build-scope` (SECRET scoped RUN_AND_BUILD_TIME leaks into the build).55- **Reliability** — `no-health-check`, `single-instance` (one instance, no56 autoscaling), `dev-db-as-prod` (database with production: false).57- **Correctness** — `port-mismatch`, `route-overlap`, `source-conflict` (both58 git and image), `deprecated-routes`.59- **Sizing** — `unknown-instance-slug`, `db-region-mismatch`.6061## Proactive triggers6263- env `value` is a literal API key/token/password (type != SECRET) → flag64 `secret-not-encrypted`; move to `type: SECRET` + `${VAR}`.65- a `service` has `instance_count: 1` and no `autoscaling` → warn single point66 of failure.67- a `service` has no `health_check.http_path` → warn deploys can't detect68 unhealthy instances.69- both a git source and an `image` on one component → flag `source-conflict`.70- component-level `routes` present → recommend `spec.ingress.rules`.71- `production: false` on a database backing real traffic → warn dev database.
Goodsmileduck