-
[OPIK-6673] [CI] feat: add hadolint Dockerfile linting to CI (#7352)
frostbyte_neo 发布于
2026-07-08 11:46:22 +00:00 - [OPIK-6673] [CI] feat: add hadolint Dockerfile linting to CI
Add hadolint to the unified Code Quality pipeline so every Dockerfile is
linted on each PR (changed-files-only) via the existing pre-commit-driven
matrix in code_quality.yml. New violations on changed Dockerfiles fail the
check with inline annotations.- .pre-commit-config.yaml: hadolint-docker hook (Docker image, no local
binary), explicit files: regex so the CI matrix detector routes changed
Dockerfiles to it. - .hadolint.yaml: default rule set, failure-threshold info, no global
ignores; the four version-pinning rules that would rot against
rolling-channel base-image repos are suppressed per-line with a reason. - Fix all pre-existing violations across the 4 non-clean Dockerfiles:
merge consecutive RUNs (DL3059), add pipefail SHELL (DL4006; /bin/ash
for the alpine python-backend), find -print0 | xargs -0 (SC2038). - CONTRIBUTING.md: how to run hadolint locally.
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- fix(ci): add hadolint CI summary description; pin pip floor instead of ignoring DL3013
- scripts/precommit-hook-descriptions.tsv: add hadolint → "Lint Dockerfiles"
so the Code Quality timing/skipped tables render a description for it. - guardrails Dockerfile: replace the DL3013 ignore with a real fix — float pip
from a >=24 floor (Ubuntu 22.04 ships pip ~22, too old for the pinned
torch/transformers/hf_xet wheels). A lower bound doesn't rot, and it satisfies
DL3013 honestly. Remaining suppressions are only the rolling-channel OS-package
pin rules (DL3008/DL3018/DL3033).
Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
- chore(ci): drop .hadolint.yaml — default threshold already info, no overrides
The config only restated hadolint's default failure-threshold (info) and held
no global ignores (the deliberate exceptions are inline# hadolint ignore=
comments in the Dockerfiles). With nothing repo-specific to configure, the file
was pure overhead. Removing it keeps identical behavior — hadolint falls back to
its info default — and drops a file reviewers would otherwise have to reason about.
Docs updated to match.Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
Co-authored-by: Claude Opus 4.8 (1M context) noreply@anthropic.com
下载附件