upgrade to 2.9.2

features: config options, saving to file, SARIF

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "daily"
+- package-ecosystem: "docker"
+  directory: "/"
+  schedule:
+    interval: "daily"

.github/workflows/ci.yml

@@ -10,74 +10,90 @@ env:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
-    container: pipelinecomponents/hadolint:latest
+    name: Lint
+    runs-on: ubuntu-20.04
+    container: pipelinecomponents/hadolint:0.10.1
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
       - name: Run hadolint
         run: hadolint Dockerfile
 
-  build:
-    runs-on: ubuntu-latest
-    needs: ['lint']
+  build-test:
+    name: Build and Test
+    runs-on: ubuntu-20.04
+    needs: ["lint"]
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
       - name: Build Docker image
         run: docker build -t $TEST_IMAGE_NAME .
 
-      - name: Save Docker image artifact
-        run: docker save -o action.tar $TEST_IMAGE_NAME
-
-      - name: Upload image artifact
-        uses: actions/upload-artifact@master
-        with:
-          name: action-image
-          path: action.tar
-
-  test:
-    name: Unit Tests
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - uses: actions/checkout@v1
-
-      - name: Pull Image artifact
-        uses: actions/download-artifact@master
-        with:
-          name: action-image
-
-      - name: Load image into docker context
-        run: docker load -i action-image/action.tar
-
-      - name: Get Image Name
-        id: image_name
-        run: echo "##[set-output name=image;]$(echo $TEST_IMAGE_NAME)"
-
       - name: Run Structure tests
-        uses: brpaz/structure-tests-action@master
+        uses: brpaz/structure-tests-action@v1.1.2
         with:
-          image: ${{ steps.image_name.outputs.image }}
+          image: ${{ env.TEST_IMAGE_NAME }}
 
-  integration:
+  integration-tests:
     name: Integration Tests
-    runs-on: ubuntu-latest
-    needs: test
+    runs-on: ubuntu-20.04
+    needs: build-test
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
 
-      - name: Run integration test
+      - name: Run integration test 1
         uses: ./
         with:
           dockerfile: testdata/Dockerfile
 
+      - name: Run integration test 2 - ignore a rule
+        # This step is supposed to print out an info level rule violation
+        # but completely ignore the two rules listed below
+        uses: ./
+        with:
+          dockerfile: testdata/warning.Dockerfile
+          ignore: 'DL3014,DL3008'
+          no-fail: true
+
+      - name: Run integration test 3 - set failure threshold
+        # This step will print out an info level rule violation, but not fail
+        # because of the high failure threshold.
+        uses: ./
+        with:
+          dockerfile: testdata/info.Dockerfile
+          failure-threshold: warning
+
+      - name: Run integration test 4 - output format
+        # This step will never fail, but will print out rule violations as json.
+        uses: ./
+        with:
+          dockerfile: testdata/warning.Dockerfile
+          failure-threshold: error
+          format: json
+
+      - name: Run integration test 5 - output format
+        # This step will never fail, but will print out rule violations.
+        uses: ./
+        with:
+          dockerfile: testdata/warning.Dockerfile
+          config: testdata/hadolint.yaml
+
+      - name: Run integration test 6 - output to file
+        # This step will never fail, but will print out rule violations.
+        uses: ./
+        with:
+          dockerfile: testdata/warning.Dockerfile
+          format: sarif
+          output-file: /report.sarif
+
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     name: Release
-    runs-on: ubuntu-latest
-    needs: integration
+    runs-on: ubuntu-20.04
+    needs: integration-tests
     steps:
-      - uses: actions/checkout@v1
-      - name: Semantic Release
-        uses: brpaz/action-semantic-release@master
+      - uses: actions/checkout@v2
+      - uses: cycjimmy/semantic-release-action@v2
+        with:
+          extra_plugins: |
+            @semantic-release/git
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

Dockerfile

@@ -1,6 +1,6 @@
-FROM hadolint/hadolint:v1.17.2
+FROM hadolint/hadolint:v2.9.2-debian
 
-COPY LICENSE README.md /
-
-ENTRYPOINT [ "hadolint" ]
+COPY LICENSE README.md problem-matcher.json /
+COPY hadolint.sh /usr/local/bin/hadolint.sh
 
+ENTRYPOINT [ "/usr/local/bin/hadolint.sh" ]

README.md

@@ -1,26 +1,60 @@
-# hadolint-action Action
+# Hadolint Action
 
-> Action that runs [Hadolint](https://github.com/hadolint/hadolint) Dockerfile linting tool.
+> GitHub Action that runs [Hadolint](https://github.com/hadolint/hadolint) Dockerfile linting tool.
 
 [![GitHub Action](https://img.shields.io/badge/GitHub-Action-blue?style=for-the-badge)](https://github.com/features/actions)
 [![License](https://img.shields.io/badge/License-MIT-yellow.svg?style=for-the-badge)](LICENSE)
 [![Commitizen friendly](https://img.shields.io/badge/commitizen-friendly-brightgreen.svg?style=for-the-badge)](http://commitizen.github.io/cz-cli/)
 [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg?style=for-the-badge)](https://github.com/semantic-release/semantic-release?style=for-the-badge)
 
-[![GitHub Actions](https://github.com/brpaz/hadolint-action/workflows/CI/badge.svg?style=for-the-badge)](https://github.com/brpaz/hadolint-action/actions)
+[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/hadolint/hadolint-action/CI?style=for-the-badge)](https://github.com/hadolint/hadolint-action/action)
 
 ## Usage
 
+Add the following step to your workflow configuration:
+
 ```yml
 steps:
-    uses: brpaz/hadolint-action@master
+  - uses: actions/checkout@v2 
+  - uses: hadolint/hadolint-action@v1.6.0
+    with:
+      dockerfile: Dockerfile
 ```
 
 ## Inputs
 
-**`dockerfile`**
+| Name               | Description                               | Default          |
+|------------------- |------------------------------------------ |----------------- |
+| dockerfile         | The path to the Dockerfile to be tested   | ./Dockerfile     |
+| recursive          | Search for specified dockerfile           | false            |
+|                    | recursively, from the project root        |                  |
+| config             | Custom path to a Hadolint config file     | ./.hadolint.yaml |
+| output-file        | A sub-path where to save the              |                  |
+|                    | output as a file to                       |                  |
+| no-color           | Don't create colored output               |                  |
+| no-fail            | Never fail the action                     |                  |
+| verbose            | Output more information                   |                  |
+| format             | The output format. One of [tty \| json \| | tty              |
+|                    | checkstyle \| codeclimate \|              |                  |
+|                    | gitlab_codeclimate \| codacy \| sarif]    |                  |
+| failure-threshold  | Rule severity threshold for pipeline      | info             |
+|                    | failure. One of [error \| warning \|      |                  |
+|                    | info \| style \| ignore]                  |                  |
+| override-error     | List of rules to treat with 'error'       |                  |
+|                    | severity                                  |                  |
+| override-warning   | List of rules to treat with 'warning'     |                  |
+|                    | severity                                  |                  |
+| override-info      | List of rules to treat with 'info'        |                  |
+|                    | severity                                  |                  |
+| override-style     | List of rules to treat with 'style'       |                  |
+|                    | severity                                  |                  |
+| ignore             | Space separated list of Hadolint rules to | <none>           |
+|                    | ignore.                                   |                  |
+| trusted-resgitries | List of urls of trusted registries        |                  |
 
-The path to the Dockerfile to be tested. By default it will look for a Dockerfile in the current directory.
+## Hadolint Configuration
+
+To configure Hadolint (for example ignore rules), you can create an `.hadolint.yaml` file in the root of your repository. Please check the Hadolint [documentation](https://github.com/hadolint/hadolint#configure).
 
 ## 🤝 Contributing
 
@@ -31,11 +65,13 @@ Contributions are what make the open source community such an amazing place to b
 3. Commit your Changes (`git commit -m 'Add some AmazingFeature'`)
 4. Push to the Branch (`git push origin feature/AmazingFeature`)
 5. Open a Pull Request
+## 💛 Support the project
 
-## Useful Resources
+If this project was useful to you in some form, We would be glad to have your support. It will help keeping the project alive.
 
-* [Building actions - GitHub Help](https://help.github.com/en/articles/building-actions)
-* [actions/toolkit: The GitHub ToolKit for developing GitHub Actions.](https://github.com/actions/toolkit)
+The sinplest form of support is to give a ⭐️ to this repo.
+
+This project was originally created by [Bruno Paz](https://github.com/sponsors/brpaz) and incorporated into the Hadolint organization. If you appreciate the work done on this action, Bruno would be happy with your [sponsorship](https://github.com/sponsors/brpaz).
 
 ## Author
 
@@ -46,6 +82,4 @@ Contributions are what make the open source community such an amazing place to b
 
 ## 📝 License
 
-Copyright © 2019 [Bruno Paz](https://github.com/brpaz).
-
-This project is [MIT](LICENSE) licensed.
+[MIT](LICENSE)

action.yml

@@ -3,13 +3,98 @@ description: 'Action that runs Hadolint Dockerfile linting tool'
 author: 'Bruno Paz'
 inputs:
   dockerfile:
+    required: false
     description: 'The path to the Dockerfile to lint'
     default: 'Dockerfile'
+  config:
+    required: false
+    description: 'Path to a config file'
+    default:
+  recursive:
+    required: false
+    description:
+      'Search for specified dockerfile recursively, from the project root'
+    default: 'false'
+  output-file:
+    required: false
+    description: 'The path where to save the linting results to'
+    default:
+
+  # standart hadolint options:
+  no-color:
+    required: false
+    description: Don't create colored output.
+    default: 'false'
+  no-fail:
+    required: false
+    description: Never exit with a failure status code
+    default: 'false'
+  verbose:
+    required: false
+    description: Print more information about the running config
+    default: 'false'
+  format:
+    required: false
+    description: |
+      The output format, one of [tty (default) | json | checkstyle |
+      codeclimate | gitlab_codeclimate | codacy | sarif]
+    default: 'tty'
+  failure-threshold:
+    required: false
+    description: |
+      Fail the pipeline only if rules with severity above this threshold are
+      violated. One of [error | warning | info (default) | style | ignore]
+    default: 'info'
+  override-error:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `error`'
+    default:
+  override-warning:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `warning`'
+    default:
+  override-info:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `info`'
+    default:
+  override-style:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `style`'
+    default:
+  ignore:
+    required: false
+    description: 'A comma separated string of rules to ignore'
+    default:
+  trusted-registries:
+    required: false
+    description: 'A comma separated list of trusted registry urls'
+    default:
+
 runs:
   using: 'docker'
   image: 'Dockerfile'
   args:
     - ${{ inputs.dockerfile }}
+  env:
+    NO_COLOR: ${{ inputs.no-color }}
+    HADOLINT_NOFAIL: ${{ inputs.no-fail }}
+    HADOLINT_VERBOSE: ${{ inputs.verbose }}
+    HADOLINT_FORMAT: ${{ inputs.format }}
+    HADOLINT_FAILURE_THRESHOLD: ${{ inputs.failure-threshold }}
+    HADOLINT_OVERRIDE_ERROR: ${{ inputs.override-error }}
+    HADOLINT_OVERRIDE_WARNING: ${{ inputs.override-warning }}
+    HADOLINT_OVERRIDE_INFO: ${{ inputs.override-info }}
+    HADOLINT_OVERRIDE_STYLE: ${{ inputs.override-style }}
+    HADOLINT_IGNORE: ${{ inputs.ignore }}
+    HADOLINT_TRUSTED_REGISTRIES: ${{ inputs.trusted-registries }}
+
+    HADOLINT_CONFIG: ${{ inputs.config }}
+    HADOLINT_RECURSIVE: ${{ inputs.recursive }}
+    HADOLINT_OUTPUT: ${{ inputs.output-file }}
 branding:
   icon: 'layers'
   color: 'purple'

hadolint.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# The problem-matcher definition must be present in the repository
+# checkout (outside the Docker container running hadolint). We copy
+# problem-matcher.json to the home folder.
+cp /problem-matcher.json "$HOME/"
+
+# After the run has finished we remove the problem-matcher.json from
+# the repository so we don't leave the checkout dirty. We also remove
+# the matcher so it won't take effect in later steps.
+cleanup() {
+    echo "::remove-matcher owner=brpaz/hadolint-action::"
+}
+trap cleanup EXIT
+
+echo "::add-matcher::$HOME/problem-matcher.json"
+
+if [ -n "$HADOLINT_CONFIG" ]; then
+  HADOLINT_CONFIG="-c ${HADOLINT_CONFIG}"
+fi
+
+OUTPUT=
+if [ -n "$HADOLINT_OUTPUT" ]; then
+  if [ -f "$HADOLINT_OUTPUT" ]; then
+    HADOLINT_OUTPUT="$TMP_FOLDER/$HADOLINT_OUTPUT"
+  fi
+  OUTPUT=" | tee $HADOLINT_OUTPUT"
+fi
+
+if [ "$HADOLINT_RECURSIVE" = "true" ]; then
+  shopt -s globstar
+
+  filename="${!#}"
+  flags="${@:1:$#-1}"
+
+  hadolint $HADOLINT_CONFIG $flags **/$filename $OUTPUT
+else
+  # shellcheck disable=SC2086
+  hadolint $HADOLINT_CONFIG "$@" $OUTPUT
+fi
+
+[ -z "$HADOLINT_OUTPUT" ] || echo "Hadolint output saved to: $HADOLINT_OUTPUT"

problem-matcher.json

@@ -0,0 +1,15 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "brpaz/hadolint-action",
+      "pattern": [
+        {
+          "regexp": "(.*)\\:(\\d+)\\s(.*)",
+          "file": 1,
+          "line": 2,
+          "message": 3
+        }
+      ]
+    }
+  ]
+}

testdata/hadolint.yaml

@@ -0,0 +1 @@
+failure-threshold: error

testdata/info.Dockerfile

@@ -0,0 +1,5 @@
+FROM debian:buster
+
+# info level warning expected here:
+RUN echo "Hello"
+RUN echo "World"

testdata/warning.Dockerfile

@@ -0,0 +1,4 @@
+FROM debian:buster
+
+# emits an info and a warning level violation.
+RUN apt-get install foo