hadolint 1.2.6 → 1.3.0
raw patch · 4 files changed
+36/−23 lines, 4 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
+ Hadolint.Rules: copyEndingSlash :: Rule
Files
- README.md +1/−0
- hadolint.cabal +2/−2
- src/Hadolint/Rules.hs +22/−15
- test/Spec.hs +11/−6
README.md view
@@ -121,6 +121,7 @@ | [DL3018](https://github.com/hadolint/hadolint/wiki/DL3018) | Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`. | | [DL3019](https://github.com/hadolint/hadolint/wiki/DL3019) | Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages. | | [DL3020](https://github.com/hadolint/hadolint/wiki/DL3020) | Use `COPY` instead of `ADD` for files and folders. |+| [DL3021](https://github.com/hadolint/hadolint/wiki/DL3021) | `COPY` with more than 2 arguments requires the last argument to end with `/` | | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | MAINTAINER is deprecated. | | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Either use Wget or Curl but not both. | | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Multiple `CMD` instructions found. |
hadolint.cabal view
@@ -2,10 +2,10 @@ -- -- see: https://github.com/sol/hpack ----- hash: b7ec9fd2a32901585b1deea9c996ddfae7761f1993dcb550b22499da35d8706a+-- hash: 36374cf97e8c22f6971eb0142316c4cb1e42f9d83fba7b06c6558bb0ce1ccf24 name: hadolint-version: 1.2.6+version: 1.3.0 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development
src/Hadolint/Rules.hs view
@@ -68,6 +68,7 @@ , shellcheckBash , invalidCmd , copyInsteadAdd+ , copyEndingSlash , noRootUser , noCd , noSudo@@ -346,25 +347,20 @@ hasVersionSymbol package = or [s `isInfixOf` package | s <- versionSymbols] versionFixed :: String -> Bool versionFixed package = hasVersionSymbol package || isVersionedGit package- packages :: [String] -> [String]- packages args = concat [filter noOption cmd | cmd <- bashCommands args, isPipInstall cmd]- where- noOption arg = arg `notElem` options- options =- [ "pip"- , "pip2"- , "pip3"- , "install"- , "--user"- , "--disable-pip-version-check"- , "--no-cache-dir"- ] isPipInstall :: [String] -> Bool isPipInstall cmd = ["pip", "install"] `isInfixOf` cmd || ["pip3", "install"] `isInfixOf` cmd || ["pip2", "install"] `isInfixOf` cmd isRecursiveInstall :: [String] -> Bool isRecursiveInstall cmd = ["-r"] `isInfixOf` cmd+ -- | Returns all the packages after pip install+ packages :: [String] -> [String]+ packages args = concat [filter noOption cmd | cmd <- bashCommands args, isPipInstall cmd]+ where+ noOption arg = arg `notElem` commandName && not (isFlag arg)+ commandName = ["pip", "pip2", "pip3", "install"]+ isFlag ('-':_) = True+ isFlag _ = False {-| Rule for pinning NPM packages to version, tag, or commit@@ -388,8 +384,8 @@ packages :: [String] -> [String] packages args = concat [filter noOption cmd | cmd <- bashCommands args, isNpmInstall cmd] where- noOption arg = arg `notElem` options- options = ["npm", "install", "--global"]+ noOption arg = arg `notElem` options && not ("--" `isPrefixOf` arg)+ options = ["npm", "install", "-g", "-f"] isNpmInstall :: [String] -> Bool isNpmInstall cmd = ["npm", "install"] `isInfixOf` cmd versionFixed :: String -> Bool@@ -467,6 +463,17 @@ check (Add (AddArgs srcs _ _)) = and [isArchive src || isUrl src | SourcePath src <- toList srcs] check _ = True++copyEndingSlash = instructionRule code severity message check+ where+ code = "DL3021"+ severity = ErrorC+ message = "COPY with more than 2 arguments requires the last argument to end with /"+ check (Copy (CopyArgs sources t _ _))+ | length sources > 1 = endsWithSlash t+ | otherwise = True+ check _ = True+ endsWithSlash (TargetPath t) = last t == '/' -- it is safe to use last, as the target is never empty useShell = instructionRule code severity message check where
test/Spec.hs view
@@ -129,6 +129,8 @@ ruleCatches pipVersionPinned "RUN pip install MySQL_python" it "pip version pinned" $ ruleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2"+ it "pip version pinned with flag" $+ ruleCatchesNot pipVersionPinned "RUN pip install --ignore-installed MySQL_python==1.2.2" it "pip install git" $ ruleCatchesNot pipVersionPinned@@ -151,15 +153,11 @@ "RUN pip install MySQL_python==1.2.2 --disable-pip-version-check" it "pip install no cache dir" $ ruleCatchesNot pipVersionPinned "RUN pip install MySQL_python==1.2.2 --no-cache-dir"- it "pip install extra argument with '--'" $- ruleCatches- pipVersionPinned- "RUN pip install MySQL_python==1.2.2 --user --extra-arg"- it "pip install extra argument with '-'" $- ruleCatches pipVersionPinned "RUN pip install MySQL_python==1.2.2 --user -X" -- describe "npm pinning" $ do it "version pinned in package.json" $ ruleCatchesNot npmVersionPinned "RUN npm install"+ it "version pinned in package.json with arguments" $+ ruleCatchesNot npmVersionPinned "RUN npm install --progress=false" it "version pinned" $ ruleCatchesNot npmVersionPinned "RUN npm install express@4.1.1" it "version pinned with scope" $ ruleCatchesNot npmVersionPinned "RUN npm install @myorg/privatepackage@\">=0.1.0\""@@ -167,6 +165,8 @@ ruleCatchesNot npmVersionPinned "RUN npm install express@\"4.1.1\" sax@0.1.1" it "version pinned with --global" $ ruleCatchesNot npmVersionPinned "RUN npm install --global express@\"4.1.1\""+ it "version pinned with -g" $+ ruleCatchesNot npmVersionPinned "RUN npm install -g express@\"4.1.1\"" it "commit pinned for git+ssh" $ ruleCatchesNot npmVersionPinned@@ -261,6 +261,11 @@ it "add for xz" $ ruleCatchesNot copyInsteadAdd "ADD file.xz /usr/src/app/" it "add for tgz" $ ruleCatchesNot copyInsteadAdd "ADD file.tgz /usr/src/app/" it "add for url" $ ruleCatchesNot copyInsteadAdd "ADD http://file.com /usr/src/app/"+ --+ describe "copy last argument" $ do+ it "no warn on 2 args" $ ruleCatchesNot copyEndingSlash "COPY foo bar"+ it "warn on 3 args" $ ruleCatches copyEndingSlash "COPY foo bar baz"+ it "no warn on 3 args" $ ruleCatchesNot copyEndingSlash "COPY foo bar baz/" -- describe "format error" $ it "display error after line pos" $ do