drep/languages/definitions/
docker.rs

1//! Docker: hadolint over `Dockerfile` and `Containerfile`.
2
3use crate::languages::spec::{
4    DEFAULT_TOOL_TIMEOUT_SECS, DiagnosticsStream, LanguageSupport, OutputFormat, ToolSpec,
5};
6
7/// Docker deterministic checker.
8///
9/// hadolint's SARIF `uri` is repo-relative, verified against the real binary.
10pub static HADOLINT: ToolSpec = ToolSpec {
11    name: "hadolint",
12    command: &["hadolint", "--format", "sarif"],
13    local_paths: &[],
14    config_files: &[".hadolint.yaml", ".hadolint.yml"],
15    config_flag: None,
16    output_format: OutputFormat::Sarif,
17    diagnostics_stream: DiagnosticsStream::Stdout,
18    timeout_secs: DEFAULT_TOOL_TIMEOUT_SECS,
19    timeout_context: None,
20    establishes_compilation: false,
21    serial_in_repository: false,
22    accepts_files: true,
23};
24
25/// Docker language entry.
26///
27/// Dockerfiles carry no extension, so `filenames` claims both conventional
28/// spellings; `.dockerfile` is also claimed for the projects that do use it
29/// as one. The stems claim the per-environment variants - `Dockerfile.dev`,
30/// `Dockerfile.prod`, `Containerfile.web` - which multi-image layouts
31/// produce in an unbounded family and hadolint lints the same way.
32pub static DOCKER: LanguageSupport = LanguageSupport {
33    name: "docker",
34    display_name: "Docker",
35    extensions: &[".dockerfile"],
36    filenames: &["Dockerfile", "Containerfile"],
37    filename_prefixes: &["Dockerfile", "Containerfile"],
38    tools: &[&HADOLINT],
39    conventions: &[
40        "Unpinned base image tags and package versions",
41        "Secrets baked into layers via ENV or COPY",
42        "Processes running as root",
43        "ADD where COPY was meant",
44        "Entrypoints that ignore SIGTERM",
45    ],
46    vendored_dirs: &[],
47};
48
49/// The family's entries in registration order. See `ALL_LANGUAGES`.
50pub(crate) static FAMILY: &[&LanguageSupport] = &[&DOCKER];
drep/languages/definitions/docker.rs

drep/languages/definitions/
docker.rs
