feat: add hadolint plugin for Containerfile linting#423
Merged
Conversation
ianpittwood
force-pushed
the
feature/hadolint-plugin
branch
from
8de4a40 to
fb6d405
Compare
ianpittwood
force-pushed
the
feature/oras-plugin
branch
2 times, most recently
from
0fddf2d to
1651b3e
Compare
ianpittwood
force-pushed
the
feature/hadolint-plugin
branch
from
74f8934 to
23a046a
Compare
ianpittwood
force-pushed
the
feature/hadolint-plugin
branch
from
23a046a to
4042655
Compare
bschwedler
reviewed
Apr 10, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds BakeryHadolintError (subclass of BakeryToolRuntimeError with parse_error field and formatted stdout output) and HadolintSuite which runs hadolint subprocesses per image target, writes JSON results to results/hadolint/, and returns a (HadolintReportCollection, errors) tuple distinguishing parse failures from lint findings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Implements the HadolintPlugin entry point with full CLI (bakery hadolint run), execute(), and results() methods. Registers the plugin via pyproject.toml entry point. Updates test_variant.py to reflect two default tool options (goss + hadolint). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…d support The execute() method was only checking report.error_count > 0 to determine failure, ignoring the --failure-threshold flag. Now HadolintReport stores the hadolint process exit code, which correctly reflects whether the configured threshold was exceeded. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- CLI --failure-threshold default no longer overrides bakery.yaml config; the "error" default is applied in HadolintCommand.from_image_target() only when no source provides a value - Add errors/warnings properties to HadolintReport - Add issues_by_level(threshold) to HadolintReportCollection - Add tests for new properties and default threshold behavior Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The f-string `f"{self.message}'\n"` produced a trailing single-quote
after the error message in BakeryToolRuntimeError, BakeryDGossError,
and BakeryHadolintError.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Posit images do not pin OS-level package versions, so DL3008, DL3018, DL3033, DL3037, and DL3041 are ignored by default. Users can override with an explicit `ignored` list; setting `ignored: []` clears defaults. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Matrix versions sharing the same Containerfile are now linted only once. The report uses "matrix" as the version label for deduplicated entries. Issues are listed by Containerfile path instead of by image target, and a Containerfile column is added to the summary table. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Passing None explicitly as a keyword argument to HadolintOptions caused Pydantic to mark the field as set in model_fields_set, preventing the default ignored rules from being applied. Only include CLI flags in the constructor when they have non-None values. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Containerfiles with no lint issues are still shown in the summary table but are now omitted from the detailed results section to reduce noise. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add hadolint to PATH for tests
ianpittwood
force-pushed
the
feature/hadolint-plugin
branch
from
470b093 to
8a06751
Compare
Co-authored-by: Benjamin R. J. Schwedler <ben@posit.co>
bschwedler
approved these changes
Apr 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hadolintplugin to posit-bakery that lints Containerfiles for each image targetbakery hadolint runCLI command with filter options and all hadolint configuration propertiesresults/hadolint/{image_name}/{uid}.jsonand displays a Rich summary table with detailed issue listings sectioned by image and UIDHadolintOptionsas aToolOptionssubclass forbakery.yamlconfiguration, surfacing all hadolint YAML config properties exceptformat,verbose, andno-colorerror;--verboseis set when bakery is in debug mode;NO_COLORis inherited from the parent environmentStructure
Test plan
--failure-threshold error(default, warnings pass) and--failure-threshold warning(warnings fail)-v) correctly passes--verboseto hadolintbakery.yamlhadolint options merge correctly with CLI overrides🤖 Generated with Claude Code