Merge pull request #66 from javoweb/hadolint-2.11

Upgrade hadolint to 2.12

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-20.04
     container: pipelinecomponents/hadolint:0.10.1
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Run hadolint
         run: hadolint Dockerfile
 
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     needs: ["lint"]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: Build Docker image
         run: docker build -t $TEST_IMAGE_NAME .
 
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-20.04
     needs: build-test
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Run integration test 1
         uses: ./
@@ -50,7 +50,8 @@ jobs:
         uses: ./
         with:
           dockerfile: testdata/warning.Dockerfile
-          ignore: DL3014 DL3008 DL3015
+          ignore: 'DL3014,DL3008'
+          no-fail: true
 
       - name: Run integration test 3 - set failure threshold
         # This step will print out an info level rule violation, but not fail
@@ -68,13 +69,26 @@ jobs:
           failure-threshold: error
           format: json
 
-      - name: Run integration test 4 - output format
+      - name: Run integration test 5 - output format
         # This step will never fail, but will print out rule violations.
+        id: hadolint5
         uses: ./
         with:
           dockerfile: testdata/warning.Dockerfile
           config: testdata/hadolint.yaml
 
+      - name: Run integration test 6 - verify results output parameter
+        # This step will never fail, but will print out the results from step5
+        run: echo "${{ steps.hadolint5.outputs.results }}"
+
+      #- name: Run integration test 6 - output to file
+      #  # This step will never fail, but will print out rule violations.
+      #  uses: ./
+      #  with:
+      #    dockerfile: testdata/warning.Dockerfile
+      #    format: sarif
+      #    output-file: report.sarif
+
   release:
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
     name: Release

Dockerfile

@@ -1,4 +1,4 @@
-FROM hadolint/hadolint:v2.7.0-debian
+FROM ghcr.io/hadolint/hadolint:v2.12.0-debian
 
 COPY LICENSE README.md problem-matcher.json /
 COPY hadolint.sh /usr/local/bin/hadolint.sh

Makefile

@@ -1,7 +1,7 @@
 
 IMAGE_NAME:=hadolint-action
 
-lint-dockerfile: ## Runs hadoint against application dockerfile
+lint-dockerfile: ## Runs hadolint against application dockerfile
 	@docker run --rm -v "$(PWD):/data" -w "/data" hadolint/hadolint hadolint Dockerfile
 
 lint-yaml: ## Lints yaml configurations
@@ -12,8 +12,8 @@ build: ## Builds the docker image
 
 test: build ## Runs a test in the image
 	@docker run -i --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v ${PWD}:/test zemanlx/container-structure-test:v1.8.0-alpine \
+    -v /var/run/docker.sock:/var/run/docker.sock \
+    -v ${PWD}:/test zemanlx/container-structure-test:v1.8.0-alpine \
     test \
     --image $(IMAGE_NAME) \
     --config test/structure-tests.yaml

README.md

@@ -6,7 +6,6 @@
 [![License](https://img.shields.io/badge/License-MIT-yellow.svg?style=for-the-badge)](LICENSE)
 [![Commitizen friendly](https://img.shields.io/badge/commitizen-friendly-brightgreen.svg?style=for-the-badge)](http://commitizen.github.io/cz-cli/)
 [![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg?style=for-the-badge)](https://github.com/semantic-release/semantic-release?style=for-the-badge)
-
 [![GitHub Workflow Status](https://img.shields.io/github/workflow/status/hadolint/hadolint-action/CI?style=for-the-badge)](https://github.com/hadolint/hadolint-action/action)
 
 ## Usage
@@ -16,27 +15,57 @@ Add the following step to your workflow configuration:
 ```yml
 steps:
   - uses: actions/checkout@v2 
-  - uses: hadolint/hadolint-action@v1.5.0
+  - uses: hadolint/hadolint-action@v2.1.0
     with:
       dockerfile: Dockerfile
 ```
 
 ## Inputs
 
-| Name              | Description                               | Default          |
-|------------------ |------------------------------------------ |----------------- |
-| dockerfile        | The path to the Dockerfile to be tested   | ./Dockerfile     |
-| recursive         | Search for specified dockerfile           | false            | 
-|                   | recursively, from the project root        |                  |
-| format            | The output format. One of [tty \| json \| | tty              |
-|                   | checkstyle \| codeclimate \|              |                  |
-|                   | gitlab_codeclimate]                       |                  |
-| ignore            | Space separated list of Hadolint rules to | <none>           |
-|                   | ignore.                                   |                  |
-| config            | Custom path to a Hadolint config file     | ./.hadolint.yaml |
-| failure-threshold | Rule severity threshold for pipeline      | info             |
-|                   | failure. One of [error \| warning \|      |                  |
-|                   | info \| style \| ignore]                  |                  |
+| Name                 | Description                                                                                                                             | Default            |
+|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------|--------------------|
+| `dockerfile`         | The path to the Dockerfile to be tested                                                                                                 | `./Dockerfile`     |
+| `recursive`          | Search for specified dockerfile </br> recursively, from the project root                                                                | `false`            |
+| `config`             | Custom path to a Hadolint config file                                                                                                   | `./.hadolint.yaml` |
+| `output-file`        | A sub-path where to save the </br> output as a file to                                                                                  |                    |
+| `no-color`           | Don't create colored output (`true`/`false`)                                                                                            |                    |
+| `no-fail`            | Never fail the action (`true`/`false`)                                                                                                  |                    |
+| `verbose`            | Output more information (`true`/`false`)                                                                                                |                    |
+| `format`             | The output format. One of [`tty` \| `json` \| </br> `checkstyle` \| `codeclimate` \| </br> `gitlab_codeclimate` \| `codacy` \| `sarif`] | `tty`              |
+| `failure-threshold`  | Rule severity threshold for pipeline </br> failure. One of [`error` \| `warning` \| </br>  `info` \| `style` \| `ignore`]               | `info`             |
+| `override-error`     | Comma separated list of rules to treat with `error` severity                                                                            |                    |
+| `override-warning`   | Comma separated list of rules to treat with `warning` severity                                                                          |                    |
+| `override-info`      | Comma separated list of rules to treat with `info` severity                                                                             |                    |
+| `override-style`     | Comma separated list of rules to treat with `style` severity                                                                            |                    |
+| `ignore`             | Comma separated list of Hadolint rules to ignore.                                                                                       | <none>             |
+| `trusted-registries` | Comma separated list of urls of trusted registries                                                                                      |                    |
+
+## Output
+
+The Action will store results in an environment variable that can be used in other steps in a workflow.
+
+Example to create a comment in a PR:
+
+```
+- name: Update Pull Request
+  uses: actions/github-script@v6
+  if: github.event_name == 'pull_request'
+  with:
+    script: |
+      const output = `
+      #### Hadolint: \`${{ steps.hadolint.outcome }}\`
+      \`\`\`
+      ${process.env.HADOLINT_RESULTS}
+      \`\`\`
+      `;
+
+      github.rest.issues.createComment({
+        issue_number: context.issue.number,
+        owner: context.repo.owner,
+        repo: context.repo.repo,
+        body: output
+      })
+```
 
 ## Hadolint Configuration
 
@@ -51,6 +80,7 @@ Contributions are what make the open source community such an amazing place to b
 3. Commit your Changes (`git commit -m 'Add some AmazingFeature'`)
 4. Push to the Branch (`git push origin feature/AmazingFeature`)
 5. Open a Pull Request
+
 ## 💛 Support the project
 
 If this project was useful to you in some form, We would be glad to have your support. It will help keeping the project alive.

action.yml

@@ -6,15 +6,38 @@ inputs:
     required: false
     description: 'The path to the Dockerfile to lint'
     default: 'Dockerfile'
+  config:
+    required: false
+    description: 'Path to a config file'
+    default:
   recursive:
     required: false
-    description: 'Search for specified dockerfile recursively, from the project root'
+    description:
+      'Search for specified dockerfile recursively, from the project root'
+    default: 'false'
+  output-file:
+    required: false
+    description: 'The path where to save the linting results to'
+    default:
+
+  # standart hadolint options:
+  no-color:
+    required: false
+    description: Don't create colored output.
+    default: 'false'
+  no-fail:
+    required: false
+    description: Never exit with a failure status code
+    default: 'false'
+  verbose:
+    required: false
+    description: Print more information about the running config
     default: 'false'
   format:
     required: false
     description: |
       The output format, one of [tty (default) | json | checkstyle |
-      codeclimate | gitlab_codeclimate ]
+      codeclimate | gitlab_codeclimate | codacy | sarif]
     default: 'tty'
   failure-threshold:
     required: false
@@ -22,28 +45,56 @@ inputs:
       Fail the pipeline only if rules with severity above this threshold are
       violated. One of [error | warning | info (default) | style | ignore]
     default: 'info'
+  override-error:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `error`'
+    default:
+  override-warning:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `warning`'
+    default:
+  override-info:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `info`'
+    default:
+  override-style:
+    required: false
+    description:
+      'A comma separated list of rules whose severity will be `style`'
+    default:
   ignore:
     required: false
-    description: 'A space separated string of rules to ignore'
+    description: 'A comma separated string of rules to ignore'
     default:
-  config:
+  trusted-registries:
     required: false
-    description: 'Path to a config file'
+    description: 'A comma separated list of trusted registry urls'
     default:
 
 runs:
   using: 'docker'
   image: 'Dockerfile'
   args:
-    - -f
-    - ${{ inputs.format }}
-    - -t
-    - ${{ inputs.failure-threshold }}
     - ${{ inputs.dockerfile }}
   env:
-    HADOLINT_CONFIG: ${{ inputs.config }}
+    NO_COLOR: ${{ inputs.no-color }}
+    HADOLINT_NOFAIL: ${{ inputs.no-fail }}
+    HADOLINT_VERBOSE: ${{ inputs.verbose }}
+    HADOLINT_FORMAT: ${{ inputs.format }}
+    HADOLINT_FAILURE_THRESHOLD: ${{ inputs.failure-threshold }}
+    HADOLINT_OVERRIDE_ERROR: ${{ inputs.override-error }}
+    HADOLINT_OVERRIDE_WARNING: ${{ inputs.override-warning }}
+    HADOLINT_OVERRIDE_INFO: ${{ inputs.override-info }}
+    HADOLINT_OVERRIDE_STYLE: ${{ inputs.override-style }}
     HADOLINT_IGNORE: ${{ inputs.ignore }}
+    HADOLINT_TRUSTED_REGISTRIES: ${{ inputs.trusted-registries }}
+
+    HADOLINT_CONFIG: ${{ inputs.config }}
     HADOLINT_RECURSIVE: ${{ inputs.recursive }}
+    HADOLINT_OUTPUT: ${{ inputs.output-file }}
 branding:
   icon: 'layers'
   color: 'purple'

hadolint.sh

@@ -1,31 +1,27 @@
 #!/bin/bash
 
 # The problem-matcher definition must be present in the repository
-# checkout (outside the Docker container running hadolint). We create
-# a temporary folder and copy problem-matcher.json to it and make it
-# readable.
-TMP_FOLDER=$(mktemp -d -p .)
-cp /problem-matcher.json "${TMP_FOLDER}"
-chmod -R a+rX "${TMP_FOLDER}"
+# checkout (outside the Docker container running hadolint). We copy
+# problem-matcher.json to the home folder.
+cp /problem-matcher.json "$HOME/"
 
 # After the run has finished we remove the problem-matcher.json from
 # the repository so we don't leave the checkout dirty. We also remove
 # the matcher so it won't take effect in later steps.
 cleanup() {
     echo "::remove-matcher owner=brpaz/hadolint-action::"
-    rm -rf "${TMP_FOLDER}"
 }
 trap cleanup EXIT
 
-echo "::add-matcher::${TMP_FOLDER}/problem-matcher.json"
+echo "::add-matcher::$HOME/problem-matcher.json"
 
 if [ -n "$HADOLINT_CONFIG" ]; then
   HADOLINT_CONFIG="-c ${HADOLINT_CONFIG}"
 fi
 
-for i in $HADOLINT_IGNORE; do
-  HADOLINT_IGNORE_CMDLINE="${HADOLINT_IGNORE_CMDLINE} --ignore=${i}"
-done
+if [ -z "$HADOLINT_TRUSTED_REGISTRIES" ]; then
+  unset HADOLINT_TRUSTED_REGISTRIES;
+fi
 
 if [ "$HADOLINT_RECURSIVE" = "true" ]; then
   shopt -s globstar
@@ -33,8 +29,28 @@ if [ "$HADOLINT_RECURSIVE" = "true" ]; then
   filename="${!#}"
   flags="${@:1:$#-1}"
 
-  hadolint $HADOLINT_IGNORE_CMDLINE $HADOLINT_CONFIG $flags **/$filename
+  RESULTS=$(hadolint $HADOLINT_CONFIG $flags **/$filename)
 else
   # shellcheck disable=SC2086
-  hadolint $HADOLINT_IGNORE_CMDLINE $HADOLINT_CONFIG "$@"
+  RESULTS=$(hadolint $HADOLINT_CONFIG "$@")
 fi
+FAILED=$?
+
+if [ -n "$HADOLINT_OUTPUT" ]; then
+  if [ -f "$HADOLINT_OUTPUT" ]; then
+    HADOLINT_OUTPUT="$TMP_FOLDER/$HADOLINT_OUTPUT"
+  fi
+  echo "$RESULTS" > $HADOLINT_OUTPUT
+fi
+
+RESULTS="${RESULTS//$'\\n'/''}"
+
+echo "results<<EOF" >> $GITHUB_OUTPUT
+echo "${RESULTS}" >> $GITHUB_OUTPUT
+echo "EOF" >> $GITHUB_OUTPUT
+
+{ echo "HADOLINT_RESULTS<<EOF"; echo "$RESULTS"; echo "EOF"; } >> $GITHUB_ENV
+
+[ -z "$HADOLINT_OUTPUT" ] || echo "Hadolint output saved to: $HADOLINT_OUTPUT"
+
+exit $FAILED