hadolint 1.10.4 → 1.11.0
raw patch · 6 files changed
+54/−7 lines, 6 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- README.md +8/−0
- app/Main.hs +15/−2
- hadolint.cabal +2/−2
- src/Hadolint/Rules.hs +6/−2
- src/Hadolint/Shell.hs +4/−1
- test/Spec.hs +19/−0
README.md view
@@ -107,6 +107,13 @@ In windows, the `%LOCALAPPDATA%` environment variable is used instead of `XDG_CONFIG_HOME` +Additionally, you can pass a custom configuration file in the command line with+the `--config` option++```bash+hadolint --config /path/to/config.yaml Dockerfile+```+ ## Inline ignores It is also possible to ignore rules by using a special comment directly above the Dockerfile@@ -207,6 +214,7 @@ | [SC2086](https://github.com/koalaman/shellcheck/wiki/SC2086) | Double quote to prevent globbing and word splitting. | | [SC2140](https://github.com/koalaman/shellcheck/wiki/SC2140) | Word is in the form `"A"B"C"` (B indicated). Did you mean `"ABC"` or `"A\"B\"C"`? | | [SC2154](https://github.com/koalaman/shellcheck/wiki/SC2154) | var is referenced but not assigned. |+| [SC2155](https://github.com/koalaman/shellcheck/wiki/SC2155) | Declare and assign separately to avoid masking return values. | | [SC2164](https://github.com/koalaman/shellcheck/wiki/SC2164) | Use <code>cd ... || exit</code> in case `cd` fails. | ## Develop
app/Main.hs view
@@ -46,6 +46,7 @@ data LintOptions = LintOptions { showVersion :: Bool+ , configFile :: Maybe FilePath , format :: OutputFormat , ignoreRules :: [IgnoreRule] , dockerfiles :: [String]@@ -80,6 +81,7 @@ parseOptions = LintOptions <$> -- CLI options parser definition version <*>+ configFile <*> outputFormat <*> ignoreList <*> files <*>@@ -87,6 +89,13 @@ where version = switch (long "version" <> short 'v' <> help "Show version") --+ -- | Parse the config filename to use+ configFile =+ optional+ (strOption+ (long "config" <> short 'c' <> metavar "FILENAME" <>+ help "Path to the configuration file"))+ -- -- | Parse the output format option outputFormat = option@@ -102,7 +111,8 @@ ignoreList = many (strOption- (long "ignore" <> help "Ignore rule. If present, config file is ignored" <>+ (long "ignore" <>+ help "A rule to ignore. If present, the ignore list in the config file is ignored" <> metavar "RULECODE")) -- -- | Parse a list of dockerfile names@@ -130,7 +140,10 @@ applyConfig o | not (null (ignoreRules o)) && rulesConfig o /= mempty = return o | otherwise = do- theConfig <- findConfig+ theConfig <-+ case configFile o of+ Nothing -> findConfig+ c -> return c case theConfig of Nothing -> return o Just config -> parseAndApply config
hadolint.cabal view
@@ -2,10 +2,10 @@ -- -- see: https://github.com/sol/hpack ----- hash: 75261d1fd2666e4cf51cc373eff3f66cd088bb91c074dbc3224441446747b4eb+-- hash: a70be00e8bff5c8b285dbd53d25458651c3675620f26bd3419bc6eefad9eb273 name: hadolint-version: 1.10.4+version: 1.11.0 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development
src/Hadolint/Rules.hs view
@@ -569,7 +569,7 @@ \<package>==<version>`" check (Run args) = argumentsRule (Shell.noCommands forgotToPinVersion) args check _ = True- forgotToPinVersion cmd = isPipInstall cmd && not (all versionFixed (packages cmd))+ forgotToPinVersion cmd = isPipInstall cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd)) -- Check if the command is a pip* install command, and that specific pacakges are being listed isPipInstall cmd = case Shell.getCommandName cmd of@@ -580,6 +580,7 @@ relevantInstall cmd = ["install"] `isInfixOf` Shell.getAllArgs cmd && not (["-r"] `isInfixOf` Shell.getAllArgs cmd || ["."] `isInfixOf` Shell.getAllArgs cmd)+ hasBuildConstraint = Shell.hasFlag "constraint" packages cmd = stripInstallPrefix (Shell.getArgsNoFlags cmd) versionFixed package = hasVersionSymbol package || isVersionedGit package isVersionedGit package = "git+http" `isInfixOf` package && "@" `isInfixOf` package@@ -759,9 +760,12 @@ severity = WarningC message = "Set the SHELL option -o pipefail before RUN with a pipe in it" check _ _ From {} = (False, True) -- Reset the state each time we find a new FROM- check _ _ (Shell args) = (argumentsRule hasPipefailOption args, True)+ check _ _ (Shell args)+ | argumentsRule isPowerShell args = (True, True)+ | otherwise = (argumentsRule hasPipefailOption args, True) check False _ (Run args) = (False, argumentsRule notHasPipes args) check st _ _ = (st, True)+ isPowerShell (Shell.ParsedShell orig _)= "pwsh" `Text.isPrefixOf` orig notHasPipes script = not (Shell.hasPipes script) hasPipefailOption script = not $
src/Hadolint/Shell.hs view
@@ -48,7 +48,10 @@ setShell s (ShellOpts _ v) = ShellOpts s v shellcheck :: ShellOpts -> ParsedShell -> [Comment]-shellcheck (ShellOpts sh env) (ParsedShell txt _) = map comment runShellCheck+shellcheck (ShellOpts sh env) (ParsedShell txt _) =+ if "pwsh" `Text.isPrefixOf` sh+ then [] -- Do no run for powershell+ else map comment runShellCheck where runShellCheck = crComments $ runIdentity $ checkScript si spec comment (PositionedComment _ _ c) = c
test/Spec.hs view
@@ -379,6 +379,9 @@ it "pip install no cache dir" $ do ruleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2 --no-cache-dir" onBuildRuleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2 --no-cache-dir"+ it "pip install constraints file" $ do+ ruleCatchesNot pipVersionPinned "RUN pip install pykafka --constraint http://foo.bar.baz"+ onBuildRuleCatchesNot pipVersionPinned "RUN pip install pykafka --constraint http://foo.bar.baz" -- describe "npm pinning" $ do it "version pinned in package.json" $ do@@ -568,6 +571,15 @@ in do ruleCatchesNot shellcheck dockerFile onBuildRuleCatchesNot shellcheck dockerFile++ it "Does not complain on powershell" $+ let dockerFile = Text.unlines+ [ "SHELL [\"pwsh\", \"-c\"]"+ , "RUN Get-Variable PSVersionTable | Select-Object -ExpandProperty Value"+ ]+ in do+ ruleCatchesNot shellcheck dockerFile+ onBuildRuleCatchesNot shellcheck dockerFile -- -- describe "COPY rules" $ do@@ -894,6 +906,13 @@ [ "FROM scratch as build" , "SHELL [\"/bin/zsh\", \"-o\", \"pipefail\", \"-c\"]" , "RUN wget -O - https://some.site | wc -l file > /number"+ ]+ in ruleCatchesNot usePipefail $ Text.unlines dockerFile+ it "don't warn on powershell" $+ let dockerFile =+ [ "FROM scratch as build"+ , "SHELL [\"pwsh\", \"-c\"]"+ , "RUN Get-Variable PSVersionTable | Select-Object -ExpandProperty Value" ] in ruleCatchesNot usePipefail $ Text.unlines dockerFile it "warns when using plain sh" $