Repository navigation
Lint several Dockerfiles per run and add a .docker-lint.yaml config - #8
Conversation
Paths may now be files, directories searched recursively for Dockerfiles, or glob patterns with **, expanded by docker-lint so they behave the same on Windows. A directory or pattern that matches nothing is fatal, so CI cannot pass without linting anything; a file that fails to parse is reported while the others are still linted. A single file keeps its JSON object output; several files produce an array, and SARIF a single run covering all of them. .docker-lint.yaml, found up to the repository root, sets ignored rules, per-rule severities (or off), strict, quiet and exclude patterns. Flags win over the file, and unknown keys are errors so typos fail loudly. The GitHub Action takes one path or pattern per line and a config input. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4374e595a2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if err != nil { | ||
| return nil, err |
There was a problem hiding this comment.
When several explicit files are supplied and one is missing, this immediate return discards every path already expanded, so docker-lint valid.Dockerfile missing.Dockerfile never analyzes the valid file. This contradicts the new multi-file behavior that other inputs continue to be linted after a file cannot be read; collect this error while preserving the remaining inputs so the run can emit their reports and still exit fatally.
Useful? React with 👍 / 👎.
| rel := filepath.ToSlash(p) | ||
| if d.IsDir() { | ||
| if p != dir && skipDir(d.Name()) { | ||
| return filepath.SkipDir | ||
| } | ||
| return nil | ||
| } | ||
| if IsDockerfile(d.Name()) && !Excluded(rel, exclude) { |
There was a problem hiding this comment.
When a directory or glob is given as an absolute or parent-relative path, p retains that prefix, so an anchored relative exclusion such as examples/** does not match /repo/examples/Dockerfile or ../examples/Dockerfile. As a result, the same configured exclusion works for docker-lint . but is silently bypassed for equivalent absolute or parent-relative inputs; exclusion matching should use a consistently relative path.
Useful? React with 👍 / 👎.
Stacked on #5 (base
feat/sarif-action); retarget tomainonce #5 merges.What
Several files per run. Every path argument can be:
Dockerfile,Containerfile,Dockerfile.*and*.Dockerfile(skipping.gitandnode_modules;Dockerfile.dockerignoreis not a Dockerfile);**, expanded by docker-lint so it works the same in every shell, including on Windows.A directory or pattern that matches nothing exits 2, so a CI job can't go green without linting anything. A file that fails to parse is reported on stderr and the run exits 2, but the other files are still linted and reported.
Output. A single file (or stdin) keeps today's output exactly, including the JSON object. Several files produce a JSON array of those objects, and SARIF produces a single run covering every file, which is what code scanning expects.
.docker-lint.yaml. Looked up from the current directory to the repository root;--config/-cpicks another file and--no-configdisables it.--strict=falsebeatsstrict: true);--ignoreadds to the file's list.--ignore.Action.
dockerfiletakes one path or pattern per line, and there is a newconfiginput. The action workflow gains a multi-file case that runs on all three OSes.Testing
**, excludes, discovery and its errors (internal/files); parsing, validation and lookup bounded by.git(internal/config); end-to-end CLI tests for directories, globs, the JSON array and object shapes, a single SARIF run, partial parse failure, config discovery, flag precedence and config errors.bash -e -o pipefailwith multi-line input, a glob, a directory, empty input, partial failure and the new workflow case.🤖 Generated with Claude Code