diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -107,6 +107,13 @@
In windows, the `%LOCALAPPDATA%` environment variable is used instead of `XDG_CONFIG_HOME`
+Additionally, you can pass a custom configuration file in the command line with
+the `--config` option
+
+```bash
+hadolint --config /path/to/config.yaml Dockerfile
+```
+
## Inline ignores
It is also possible to ignore rules by using a special comment directly above the Dockerfile
@@ -207,6 +214,7 @@
| [SC2086](https://github.com/koalaman/shellcheck/wiki/SC2086) | Double quote to prevent globbing and word splitting. |
| [SC2140](https://github.com/koalaman/shellcheck/wiki/SC2140) | Word is in the form `"A"B"C"` (B indicated). Did you mean `"ABC"` or `"A\"B\"C"`? |
| [SC2154](https://github.com/koalaman/shellcheck/wiki/SC2154) | var is referenced but not assigned. |
+| [SC2155](https://github.com/koalaman/shellcheck/wiki/SC2155) | Declare and assign separately to avoid masking return values. |
| [SC2164](https://github.com/koalaman/shellcheck/wiki/SC2164) | Use cd ... || exit in case `cd` fails. |
## Develop
diff --git a/app/Main.hs b/app/Main.hs
--- a/app/Main.hs
+++ b/app/Main.hs
@@ -46,6 +46,7 @@
data LintOptions = LintOptions
{ showVersion :: Bool
+ , configFile :: Maybe FilePath
, format :: OutputFormat
, ignoreRules :: [IgnoreRule]
, dockerfiles :: [String]
@@ -80,6 +81,7 @@
parseOptions =
LintOptions <$> -- CLI options parser definition
version <*>
+ configFile <*>
outputFormat <*>
ignoreList <*>
files <*>
@@ -87,6 +89,13 @@
where
version = switch (long "version" <> short 'v' <> help "Show version")
--
+ -- | Parse the config filename to use
+ configFile =
+ optional
+ (strOption
+ (long "config" <> short 'c' <> metavar "FILENAME" <>
+ help "Path to the configuration file"))
+ --
-- | Parse the output format option
outputFormat =
option
@@ -102,7 +111,8 @@
ignoreList =
many
(strOption
- (long "ignore" <> help "Ignore rule. If present, config file is ignored" <>
+ (long "ignore" <>
+ help "A rule to ignore. If present, the ignore list in the config file is ignored" <>
metavar "RULECODE"))
--
-- | Parse a list of dockerfile names
@@ -130,7 +140,10 @@
applyConfig o
| not (null (ignoreRules o)) && rulesConfig o /= mempty = return o
| otherwise = do
- theConfig <- findConfig
+ theConfig <-
+ case configFile o of
+ Nothing -> findConfig
+ c -> return c
case theConfig of
Nothing -> return o
Just config -> parseAndApply config
diff --git a/hadolint.cabal b/hadolint.cabal
--- a/hadolint.cabal
+++ b/hadolint.cabal
@@ -2,10 +2,10 @@
--
-- see: https://github.com/sol/hpack
--
--- hash: 75261d1fd2666e4cf51cc373eff3f66cd088bb91c074dbc3224441446747b4eb
+-- hash: a70be00e8bff5c8b285dbd53d25458651c3675620f26bd3419bc6eefad9eb273
name: hadolint
-version: 1.10.4
+version: 1.11.0
synopsis: Dockerfile Linter JavaScript API
description: A smarter Dockerfile linter that helps you build best practice Docker images.
category: Development
diff --git a/src/Hadolint/Rules.hs b/src/Hadolint/Rules.hs
--- a/src/Hadolint/Rules.hs
+++ b/src/Hadolint/Rules.hs
@@ -569,7 +569,7 @@
\==`"
check (Run args) = argumentsRule (Shell.noCommands forgotToPinVersion) args
check _ = True
- forgotToPinVersion cmd = isPipInstall cmd && not (all versionFixed (packages cmd))
+ forgotToPinVersion cmd = isPipInstall cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd))
-- Check if the command is a pip* install command, and that specific pacakges are being listed
isPipInstall cmd =
case Shell.getCommandName cmd of
@@ -580,6 +580,7 @@
relevantInstall cmd =
["install"] `isInfixOf` Shell.getAllArgs cmd &&
not (["-r"] `isInfixOf` Shell.getAllArgs cmd || ["."] `isInfixOf` Shell.getAllArgs cmd)
+ hasBuildConstraint = Shell.hasFlag "constraint"
packages cmd = stripInstallPrefix (Shell.getArgsNoFlags cmd)
versionFixed package = hasVersionSymbol package || isVersionedGit package
isVersionedGit package = "git+http" `isInfixOf` package && "@" `isInfixOf` package
@@ -759,9 +760,12 @@
severity = WarningC
message = "Set the SHELL option -o pipefail before RUN with a pipe in it"
check _ _ From {} = (False, True) -- Reset the state each time we find a new FROM
- check _ _ (Shell args) = (argumentsRule hasPipefailOption args, True)
+ check _ _ (Shell args)
+ | argumentsRule isPowerShell args = (True, True)
+ | otherwise = (argumentsRule hasPipefailOption args, True)
check False _ (Run args) = (False, argumentsRule notHasPipes args)
check st _ _ = (st, True)
+ isPowerShell (Shell.ParsedShell orig _)= "pwsh" `Text.isPrefixOf` orig
notHasPipes script = not (Shell.hasPipes script)
hasPipefailOption script =
not $
diff --git a/src/Hadolint/Shell.hs b/src/Hadolint/Shell.hs
--- a/src/Hadolint/Shell.hs
+++ b/src/Hadolint/Shell.hs
@@ -48,7 +48,10 @@
setShell s (ShellOpts _ v) = ShellOpts s v
shellcheck :: ShellOpts -> ParsedShell -> [Comment]
-shellcheck (ShellOpts sh env) (ParsedShell txt _) = map comment runShellCheck
+shellcheck (ShellOpts sh env) (ParsedShell txt _) =
+ if "pwsh" `Text.isPrefixOf` sh
+ then [] -- Do no run for powershell
+ else map comment runShellCheck
where
runShellCheck = crComments $ runIdentity $ checkScript si spec
comment (PositionedComment _ _ c) = c
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -379,6 +379,9 @@
it "pip install no cache dir" $ do
ruleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2 --no-cache-dir"
onBuildRuleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2 --no-cache-dir"
+ it "pip install constraints file" $ do
+ ruleCatchesNot pipVersionPinned "RUN pip install pykafka --constraint http://foo.bar.baz"
+ onBuildRuleCatchesNot pipVersionPinned "RUN pip install pykafka --constraint http://foo.bar.baz"
--
describe "npm pinning" $ do
it "version pinned in package.json" $ do
@@ -568,6 +571,15 @@
in do
ruleCatchesNot shellcheck dockerFile
onBuildRuleCatchesNot shellcheck dockerFile
+
+ it "Does not complain on powershell" $
+ let dockerFile = Text.unlines
+ [ "SHELL [\"pwsh\", \"-c\"]"
+ , "RUN Get-Variable PSVersionTable | Select-Object -ExpandProperty Value"
+ ]
+ in do
+ ruleCatchesNot shellcheck dockerFile
+ onBuildRuleCatchesNot shellcheck dockerFile
--
--
describe "COPY rules" $ do
@@ -894,6 +906,13 @@
[ "FROM scratch as build"
, "SHELL [\"/bin/zsh\", \"-o\", \"pipefail\", \"-c\"]"
, "RUN wget -O - https://some.site | wc -l file > /number"
+ ]
+ in ruleCatchesNot usePipefail $ Text.unlines dockerFile
+ it "don't warn on powershell" $
+ let dockerFile =
+ [ "FROM scratch as build"
+ , "SHELL [\"pwsh\", \"-c\"]"
+ , "RUN Get-Variable PSVersionTable | Select-Object -ExpandProperty Value"
]
in ruleCatchesNot usePipefail $ Text.unlines dockerFile
it "warns when using plain sh" $