Repository navigation
Fixes from the v0.1.0 review, for v0.1.1 - #11
Conversation
With version defaulting to latest, pinning uses: devblac/docker-lint@v0.1.0 still installed whatever release was newest, so a later breaking release would run under an older action script. Default to the action's own tag, read from github.action_ref or the checkout path, and fall back to the latest release only for branches and commits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ve to the config A Dockerfile.template, .j2 or .bak in a repository made "docker-lint ." exit 2 on a file Docker never builds. Directory searches now skip template, backup and documentation extensions; naming a file still lints it. Exclude patterns matched the path as typed, so running from a subdirectory or with an absolute path ignored them. They are now matched relative to the configuration file's directory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Go's flag package stops at the first non-flag argument, so the common "docker-lint Dockerfile --json" treated --json as a missing file. Parse flags wherever they appear, keep "--" as the end of flags, and read stdin for a lone "-". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pendencies DKL203 only fired when another COPY followed the install, and only knew npm install, yarn install, go mod download and system/pip installs, so the textbook "COPY . ." then "npm ci" (or pip install -r, go mod download) went unreported. Copying the whole context before any dependency install is now always reported, and the install detection covers npm ci, pnpm, bun, yarn, uv, poetry, pipenv, bundle, composer, cargo fetch, dotnet restore, mvn dependency:go-offline and more. On the corpus this adds two findings, both true positives, and no others. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DKL304 reported ADD --checksum, which is how Docker now recommends fetching remote files, and ADD of a Git repository at a ref. DKL305 said COPY would suffice for a git@ repository, which COPY cannot fetch. ADD now records --checksum, and Git sources count as remote. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The corpus guards against false positives but not against a rule that never fires, which is how DKL203 went unnoticed. Each rule now has Dockerfiles it must report, run through the parser and analyzer, and a rule without such a case fails the test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Setting PIP_NO_CACHE_DIR with ENV, or for the command itself, disables pip's cache, yet DKL201 still asked for --no-cache-dir. Any non-empty value counts, matching pip, and an ENV only applies to its own stage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Git for Windows checks files out with CRLF by default. Pin that continuations, inline ignores, ENV pairs and heredocs behave the same, with no stray carriage returns in the parsed values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…puts The feature list still described only flags, inline comments and JSON. List the action's github-token input and its outputs, run go vet in CI, and note in the release steps that go install pins a tag in the module proxy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v0.1.0 was tagged but never published, and the Go module proxy has cached the tag, so the first release is 0.1.1. Record why, and what changed since the v0.1.0 tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ests COPY package*.json ./ is the pattern DKL203 recommends, yet DKL405 reported it. Wildcards matching manifests only no longer count. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06c8a505ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| switch { | ||
| case copiesWholeContext(cp.sources): | ||
| // Any source change invalidates the install layer: the | ||
| // classic "COPY . ." before "npm ci". | ||
| flagged[cp.instr.Line()] = true |
There was a problem hiding this comment.
For a Dockerfile containing COPY . . followed by RUN pip install --no-cache-dir ., this branch now reports DKL203 even though the installation needs the copied source. The existing runReferencesCopy check cannot recognize that dependency because it deliberately ignores .. As confirmed by pip install --help (pip install [options] [-e] <local project path>), this is a local project installation, not merely dependency installation; moving the source copy after it or copying only manifests can break the build or omit the application. Exempt source-consuming installs before issuing the whole-context warning.
Useful? React with 👍 / 👎.
| // pipNoCacheEnvPattern matches PIP_NO_CACHE_DIR set for the command itself | ||
| pipNoCacheEnvPattern = regexp.MustCompile(`\bPIP_NO_CACHE_DIR=\S`) |
There was a problem hiding this comment.
For RUN PIP_NO_CACHE_DIR=1 echo ready && pip install flask, the new regex suppresses DKL201 even though the assignment applies only to echo; pip still runs with caching enabled. It also treats PIP_NO_CACHE_DIR="" pip install flask as disabling caching because the quote satisfies \S, despite the effective value being empty. Match an effective nonempty assignment applying to the pip invocation rather than any textual occurrence anywhere in the RUN command.
Useful? React with 👍 / 👎.
| base := filepath.Base(source) | ||
| for _, wc := range wildcardChars { | ||
| if strings.Contains(base, wc) { | ||
| if strings.Contains(base, wc) && !isPackageFile(source) { |
There was a problem hiding this comment.
For COPY *.json /app/, this new condition suppresses DKL405 because isPackageFile("*.json") returns true: it matches a known manifest and none of the helper's six non-manifest probes. However, that wildcard also copies arbitrary JSON files, such as application data and configuration, so it is not a manifest-only selection. Reusing this heuristic removes the existing warning for broad patterns such as *.json and *.toml; use a conservative manifest-pattern whitelist or otherwise ensure broad extension globs remain reportable.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fixes found by reviewing the v0.1.0 draft before publishing. v0.1.0 stays tagged but unpublished (the Go module proxy cached it), and the first public release will be v0.1.1.
@v0.1.1pins the linter.Dockerfile.template/.j2/.bakand similar;excludeis relative to the config file.-reads stdin.COPY . .beforenpm ci/pip install -r/go mod downloadand knows many more installers. Corpus: +2 findings, both true positives.ADD --checksumor Git sources; DKL201 honorsPIP_NO_CACHE_DIR; DKL405 ignores manifest-only wildcards.go vetin CI, CHANGELOG versioned as 0.1.1.Merge #10 too (release notes fix) before tagging v0.1.1.
🤖 Generated with Claude Code