hadolint 1.19.0 → 1.20.0
raw patch · 5 files changed
+74/−24 lines, 5 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
+ Hadolint.Rules: isPipInstall :: Command -> Bool
+ Hadolint.Rules: pipNoCacheDir :: Rule
Files
- README.md +18/−11
- hadolint.cabal +2/−2
- src/Hadolint/Formatter/TTY.hs +1/−1
- src/Hadolint/Rules.hs +28/−10
- test/Spec.hs +25/−0
README.md view
@@ -1,5 +1,4 @@-[![Linux/OSX Build Status][travis-img]][travis]-[![Windows Build status][appveyor-img]][appveyor]+[![Build Status][github-actions-img]][github-actions] [![GPL-3 licensed][license-img]][license] [![GitHub release][release-img]][release] [![Github downloads][downloads-img]]()@@ -32,7 +31,9 @@ Just pipe your `Dockerfile` to `docker run`: ```bash-docker run --rm -i hadolint/hadolint < Dockerfile+$ docker run --rm -i hadolint/hadolint < Dockerfile+# or+$ docker run --rm -i ghcr.io/hadolint/hadolint < Dockerfile ``` ## Install@@ -56,15 +57,20 @@ As shown before, `hadolint` is available as a Docker container: ```bash-docker pull hadolint/hadolint+$ docker pull hadolint/hadolint+# or+$ docker pull ghcr.io/hadolint/hadolint ``` If you need a Docker container with shell access, use the Debian or Alpine variants of the Docker image: ```bash-docker pull hadolint/hadolint:latest-debian-docker pull hadolint/hadolint:latest-alpine+$ docker pull hadolint/hadolint:latest-debian+$ docker pull hadolint/hadolint:latest-alpine+# or+$ docker pull ghcr.io/hadolint/hadolint:latest-debian+$ docker pull ghcr.io/hadolint/hadolint:latest-alpine ``` You can also build `hadolint` locally. You need [Haskell][] and the [stack][]@@ -125,7 +131,9 @@ use the following command: ```bash-docker run --rm -i -v ./your/path/to/hadolint.yaml:/root/.config/hadolint.yaml hadolint/hadolint < Dockerfile+$ docker run --rm -i -v ./your/path/to/hadolint.yaml:/root/.config/hadolint.yaml hadolint/hadolint < Dockerfile+# or+$ docker run --rm -i -v ./your/path/to/hadolint.yaml:/root/.config/hadolint.yaml ghcr.io/hadolint/hadolint < Dockerfile ``` ## Inline ignores@@ -211,6 +219,7 @@ | [DL3039](https://github.com/hadolint/hadolint/wiki/DL3039) | Do not use `dnf update` | | [DL3040](https://github.com/hadolint/hadolint/wiki/DL3040) | `dnf clean all` missing after dnf command. | | [DL3041](https://github.com/hadolint/hadolint/wiki/DL3041) | Specify version with `dnf install -y <package>-<version>` |+| [DL3042](https://github.com/hadolint/hadolint/wiki/DL3042) | Avoid cache directory with `pip install --no-cache-dir <package>`. | | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | MAINTAINER is deprecated. | | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Either use Wget or Curl but not both. | | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Multiple `CMD` instructions found. |@@ -310,10 +319,8 @@ - projectatomic/[dockerfile_lint](https://github.com/projectatomic/dockerfile_lint/) <!-- References -->-[travis-img]: https://travis-ci.org/hadolint/hadolint.svg?branch=master-[travis]: https://travis-ci.org/hadolint/hadolint-[appveyor-img]: https://ci.appveyor.com/api/projects/status//github/hadolint/hadolint?svg=true&branch=master-[appveyor]: https://ci.appveyor.com/project/hadolint/hadolint/branch/master+[github-actions-img]: https://github.com/hadolint/hadolint/workflows/Haskell%20Tests/badge.svg?branch=master+[github-actions]: https://travis-ci.org/hadolint/hadolint/actions [license-img]: https://img.shields.io/badge/license-GPL--3-blue.svg [license]: https://tldrlegal.com/l/gpl-3.0 [release-img]: https://img.shields.io/github/release/hadolint/hadolint.svg
hadolint.cabal view
@@ -4,10 +4,10 @@ -- -- see: https://github.com/sol/hpack ----- hash: afee9524ce1aad80f4f3a651eef3a68c327005e1f97e965b5a82d3cd36afa09e+-- hash: 196183dccc95114462aa7b27a5c15b007a0aa09fdddf2c00d154df003854e6ad name: hadolint-version: 1.19.0+version: 1.20.0 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development
src/Hadolint/Formatter/TTY.hs view
@@ -27,7 +27,7 @@ formatChecks = fmap formatCheck where formatCheck (RuleCheck meta source line _) =- formatPos source line <> code meta <> " " <> message meta+ formatPos source line <> code meta <> " " <> Text.pack (severityText (severity meta)) <> ": " <> message meta formatPos :: Filename -> Linenumber -> Text.Text formatPos source line = source <> ":" <> Text.pack (show line) <> " "
src/Hadolint/Rules.hs view
@@ -7,7 +7,6 @@ import Data.List (foldl', isInfixOf, isPrefixOf, mapAccumL, nub) import Data.List.NonEmpty (toList) import qualified Data.Map as Map-import Data.Semigroup (Semigroup, (<>)) import qualified Data.Set as Set import qualified Data.Text as Text import Data.Void (Void)@@ -218,7 +217,8 @@ dnfYes, noDnfUpdate, dnfCleanup,- dnfVersionPinned+ dnfVersionPinned,+ pipNoCacheDir ] optionalRules :: RulesConfig -> [Rule]@@ -428,7 +428,7 @@ severity = ErrorC message = "Do not use apt-get upgrade or dist-upgrade" check (Run (RunArgs args _)) =- argumentsRule (Shell.noCommands (Shell.cmdHasArgs "apt-get" ["upgrade"])) args+ argumentsRule (Shell.noCommands (Shell.cmdHasArgs "apt-get" ["upgrade", "dist-upgrade"])) args check _ = True noUntagged :: Rule@@ -599,17 +599,14 @@ severity = WarningC message = "Pin versions in pip. Instead of `pip install <package>` use `pip install \- \<package>==<version>`"+ \<package>==<version>` or `pip install --requirement <requirements file>`" check (Run (RunArgs args _)) = argumentsRule (Shell.noCommands forgotToPinVersion) args check _ = True forgotToPinVersion cmd =- isPipInstall cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd))+ isPipInstall' cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd)) -- Check if the command is a pip* install command, and that specific packages are being listed- isPipInstall cmd = (isStdPipInstall cmd || isPythonPipInstall cmd) && not (requirementInstall cmd)- isStdPipInstall cmd@(Shell.Command name _ _) = "pip" `Text.isPrefixOf` name && ["install"] `isInfixOf` Shell.getArgs cmd- isPythonPipInstall cmd@(Shell.Command name _ _) =- "python" `Text.isPrefixOf` name- && ["-m", "pip", "install"] `isInfixOf` Shell.getArgs cmd+ isPipInstall' cmd =+ (isPipInstall cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd))) && not (requirementInstall cmd) -- If the user is installing requirements from a file or just the local module, then we are not interested -- in running this rule requirementInstall cmd =@@ -1040,6 +1037,7 @@ || "<" `Text.isInfixOf` package || ".rpm" `Text.isSuffixOf` package + zypperPackages :: Shell.ParsedShell -> [Text.Text] zypperPackages args = [ arg | cmd <- Shell.presentCommands args, Shell.cmdHasArgs "zypper" ["install", "in"] cmd, arg <- Shell.getArgsNoFlags cmd, arg /= "install", arg /= "in"@@ -1107,6 +1105,26 @@ dnfPackages args = [ arg | cmd <- Shell.presentCommands args, Shell.cmdHasArgs "dnf" ["install"] cmd, arg <- Shell.getArgsNoFlags cmd, arg /= "install" ]++pipNoCacheDir :: Rule+pipNoCacheDir = instructionRule code severity message check+ where+ code = "DL3042"+ severity = WarningC+ message =+ "Avoid use of cache directory with pip. Use `pip install --no-cache-dir <package>`"+ check (Run (RunArgs args _)) = argumentsRule (Shell.noCommands forgotNoCacheDir) args+ check _ = True+ forgotNoCacheDir cmd =+ isPipInstall cmd && not(usesNoCacheDir cmd)+ usesNoCacheDir cmd = "--no-cache-dir" `elem` Shell.getArgs cmd++isPipInstall :: Shell.Command -> Bool+isPipInstall cmd@(Shell.Command name _ _) = isStdPipInstall || isPythonPipInstall+ where+ isStdPipInstall = "pip" `Text.isPrefixOf` name && ["install"] `isInfixOf` Shell.getArgs cmd+ isPythonPipInstall = "python" `Text.isPrefixOf` name+ && ["-m", "pip", "install"] `isInfixOf` Shell.getArgs cmd gems :: Shell.ParsedShell -> [Text.Text] gems shell =
test/Spec.hs view
@@ -323,6 +323,9 @@ it "apt-get upgrade" $ do ruleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade" onBuildRuleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade"+ it "apt-get dist-upgrade" $ do+ ruleCatches noAptGetUpgrade "RUN apt-get update && apt-get dist-upgrade"+ onBuildRuleCatches noAptGetUpgrade "RUN apt-get update && apt-get dist-upgrade" it "apt-get version pinning" $ do ruleCatches aptGetVersionPinned "RUN apt-get update && apt-get install python" onBuildRuleCatches aptGetVersionPinned "RUN apt-get update && apt-get install python"@@ -638,6 +641,28 @@ onBuildRuleCatchesNot pipVersionPinned "RUN pip install --index-url https://user:pass@eg.com/foo --extra-index-url https://user:pass@ex-eg.io/foo foobar==1.0.0"++ --+ describe "pip cache dir" $ do+ it "pip2 --no-cache-dir not used" $ do+ ruleCatches pipNoCacheDir "RUN pip2 install MySQL_python"+ onBuildRuleCatches pipNoCacheDir "RUN pip2 install MySQL_python"+ it "pip3 --no-cache-dir not used" $ do+ ruleCatches pipNoCacheDir "RUN pip3 install MySQL_python"+ onBuildRuleCatches pipNoCacheDir "RUN pip3 install MySQL_python"+ it "pip --no-cache-dir not used" $ do+ ruleCatches pipNoCacheDir "RUN pip install MySQL_python"+ onBuildRuleCatches pipNoCacheDir "RUN pip install MySQL_python"+ it "pip2 --no-cache-dir used" $ do+ ruleCatchesNot pipNoCacheDir "RUN pip2 install MySQL_python --no-cache-dir"+ onBuildRuleCatchesNot pipNoCacheDir "RUN pip2 install MySQL_python --no-cache-dir"+ it "pip3 --no-cache-dir used" $ do+ ruleCatchesNot pipNoCacheDir "RUN pip3 install --no-cache-dir MySQL_python"+ onBuildRuleCatchesNot pipNoCacheDir "RUN pip3 install --no-cache-dir MySQL_python"+ it "pip --no-cache-dir used" $ do+ ruleCatchesNot pipNoCacheDir "RUN pip install MySQL_python --no-cache-dir"+ onBuildRuleCatchesNot pipNoCacheDir "RUN pip install MySQL_python --no-cache-dir"+ -- describe "npm pinning" $ do it "version pinned in package.json" $ do