Martin Vogel
1f50c9d46c
Resolves the two open Pinned-Dependencies code-scanning alerts (and one sibling the scanner had not flagged yet): - ubuntu:noble in Dockerfile and Dockerfile.lint is pinned to its multi-arch manifest-list digest (verified against the registry and the scanner's remediation digest, which match). - mstorsjo/llvm-mingw drops the floating :latest and pins the current digest the same way. - The MSYS2 zlib sysroot package in Dockerfile.mingw is verified against a pinned sha256 before extraction instead of piping the download straight into tar. Dockerfile.alpine was already pinned; both rebuilt images (test, lint) verified building with the new digests. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
35 lines
1.6 KiB
Docker
35 lines
1.6 KiB
Docker
# Lint environment — mirrors CI lint job exactly:
|
|
# - clang-format-20 (from LLVM apt repo)
|
|
# - cppcheck 2.20.0 (built from source, same as CI)
|
|
#
|
|
# Build: docker build -t cbm-lint -f test-infrastructure/Dockerfile.lint test-infrastructure/
|
|
# Run: docker run --rm -v $(pwd):/src cbm-lint
|
|
|
|
# Pinned by digest (supply-chain: no floating tags) — multi-arch manifest-list
|
|
# digest of ubuntu:noble as of 2026-07-23; bump deliberately, never to a tag.
|
|
FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
gcc g++ make cmake \
|
|
libsqlite3-dev zlib1g-dev \
|
|
pkg-config wget gnupg git ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# clang-format-20 (same version as CI)
|
|
RUN wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc \
|
|
&& echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" > /etc/apt/sources.list.d/llvm-20.list \
|
|
&& apt-get update && apt-get install -y --no-install-recommends clang-format-20 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# cppcheck 2.20.0 (same version as CI)
|
|
RUN git clone --depth 1 --branch 2.20.0 https://github.com/danmar/cppcheck.git /tmp/cppcheck \
|
|
&& cmake -S /tmp/cppcheck -B /tmp/cppcheck/build -DCMAKE_BUILD_TYPE=Release -DHAVE_RULES=OFF -DCMAKE_INSTALL_PREFIX=/usr/local \
|
|
&& cmake --build /tmp/cppcheck/build -j$(nproc) \
|
|
&& cmake --install /tmp/cppcheck/build \
|
|
&& rm -rf /tmp/cppcheck
|
|
|
|
WORKDIR /src
|
|
|
|
ENTRYPOINT ["scripts/lint.sh"]
|
|
CMD ["CLANG_FORMAT=clang-format-20"]
|