[#2868] Pinned Hadolint to v2.15.0 and replaced its global ignores with justified per-line ones. - #2867
Merged
Merged
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 23 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (46)
📒 Files selected for processing (12)
Comment |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
2 similar comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
📖 Documentation preview for this pull request has been deployed to Netlify: https://6a6bf723d6dfedf1c2b366fa--vortex-docs.netlify.app This preview is rebuilt on every commit and is not the production documentation site. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2867 +/- ##
==========================================
- Coverage 86.81% 86.38% -0.43%
==========================================
Files 100 93 -7
Lines 4846 4687 -159
Branches 47 3 -44
==========================================
- Hits 4207 4049 -158
+ Misses 639 638 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
AlexSkrypnyk
changed the title
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
2 similar comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
AlexSkrypnyk
changed the title
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
2 similar comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
Code coverage (threshold: 90%) Per-class coverage |
This comment has been minimized.
This comment has been minimized.
Member
Author
|
Code coverage (threshold: 90%) Per-class coverage |
1 similar comment
Member
Author
|
Code coverage (threshold: 90%) Per-class coverage |
AlexSkrypnyk
added
the
Needs review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2868
Summary
Hadolint was invoked as the untagged
hadolint/hadolint, which resolves tolateston every run, while every sibling CI tool image is pinned (zavoloklom/dclint:3.1.0,ghcr.io/gitleaks/gitleaks:v8.30.1). Hadolintv2.15.0shipped on 2026-07-30 with two new rules, so the lint job started failing without a single line of this repository changing.This pins the image, resolves the findings the new rules raise, replaces every file-level suppression with a justified per-line one, adds a Renovate manager so the pin cannot rot, and records the check in the release skill.
Verified against both releases:
v2.14.0reports zero findings on all six Dockerfiles,v2.15.0reported eight before this change and zero after.Changes
Pinned the image
hadolint/hadolintbecomeshadolint/hadolint:v2.15.0in.github/workflows/build-test-deploy.yml,.circleci/config.yml, and.vortex/tests/lint.dockerfiles.sh, so both CI providers and a local run all execute the same linter.Replaced every global ignore with a per-line one
# hadolint global ignore=suppresses a rule for a whole file, including for code added later, so a suppression added for one known line silently blesses every future violation in that file.DL3064is a security rule - globally ignored incli.dockerfile, a futureARG AWS_SECRET_ACCESS_KEYwould pass unnoticed. All five global pragmas are gone; every remaining suppression sits on the line it applies to and carries a short reason, using hadolint's supported# hadolint ignore=RULE # reasonform so each costs one line:cli.dockerfileDL3064x3PACKAGE_TOKEN,ARG/ENV DRUPAL_PRIVATE_FILEScli.dockerfileDL3018apk addcli.dockerfileSC2174mkdir -p -mclamav.dockerfileDL3008apt-get installclamav.dockerfileDL3066x2USER root,USER clamavdatabase.dockerfileDL3064MYSQL_*blockdatabase.dockerfileDL3066x2USER root,USER mysqlnginx-drupal.dockerfileDL3018apk addphp.dockerfileDL3018apk addsolr.dockerfileDL3066x2USER root,USER solrNone of the findings is a real defect.
PACKAGE_TOKENdefaults to empty and is supplied at build time via--mount=type=secret.DRUPAL_PRIVATE_FILESis a directory path matched on the substringprivate. TheMYSQL_*values are the fixed throwaway credentials theuselagoon/mysql-8.4image contract expects for local and CI databases, with deployed environments injecting their own. TheDL3066hits are the base images' own service accounts, referenced by name because the base images' own tooling refers to them by name.DL3018andDL3008cover package sets that track the pinned base image.Removed six suppressions that suppress nothing
Linting each file with every pragma stripped shows which rules actually fire. Six did not fire at all under
v2.15.0and were deleted rather than carried forward with an invented justification:SC2155incli.dockerfile- fires onexport/local/readonly foo=$(...); thatRUNuses a plaintoken=$(...)assignment.DL3018inclamav.dockerfile- a Debian base image with noapk.DL3018insolr.dockerfile- no package installation in the file.DL3006indatabase.dockerfile,nginx-drupal.dockerfileandphp.dockerfile- no longer raised for anARG-substitutedFROM.A suppression that suppresses nothing is the same blind spot as a global one: it reads as a reviewed exception when nothing is being excepted.
Tracked the pins with Renovate
Added a
customManagersregex torenovate.jsoncovering image references insidedocker runcommands in.circleci/config.ymland.github/workflows/*.yml. Renovate's built-ingithub-actionsmanager only parsesuses:,container:andservices:, and the existing custom manager is scoped todocker-compose.ymlIMAGE:lines, so none of these pins was watched. Validated offline against the real files: the regex matches exactly the seven image references (hadolint, dclint and gitleaks in both providers, plusrhysd/actionlintin the test harness) and nothing else - notably not the"${PWD}":/appvolume arguments or the${VORTEX_CI_*_IGNORE_FAILURE:-0}defaults on the same lines. The CI paths were also added to the existingContainer images - Allpackage rule so these bumps group with the.docker/**ones.Recorded the check in the release skill
.claude/skills/prepare-vortex-release/SKILL.mdgains a CI tool image item under Container images. It is a verification step rather than a manual bump, since Renovate now tracks these, and it states that an untagged reference is a release blocker regardless.Updated a test assertion
ToolsHandlerProcessTestasserted that# hadolint global ignore=survives deselecting hadolint. The intent - Dockerfile directives are inert comments that stay useful when the tool is run by hand - is unchanged; the assertion now matches the per-line form.Regenerated fixtures
ahoy update-snapshotsreports 149/149 datasets passing with no fixture drift. Fixtures store the image tag ashadolint/hadolint:__VERSION__, so future version bumps produce no fixture churn.Screenshots
N/A
Before / After