syncable_cli/analyzer/hadolint/rules/
dl3005.rs

1//! DL3005: Do not use apt-get upgrade or dist-upgrade
2//!
3//! Using apt-get upgrade or dist-upgrade in a Dockerfile is not recommended
4//! as it can lead to unpredictable builds.
5
6use crate::analyzer::hadolint::parser::instruction::Instruction;
7use crate::analyzer::hadolint::rules::{SimpleRule, simple_rule};
8use crate::analyzer::hadolint::shell::ParsedShell;
9use crate::analyzer::hadolint::types::Severity;
10
11pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
12    simple_rule(
13        "DL3005",
14        Severity::Warning,
15        "Do not use `apt-get upgrade` or `dist-upgrade`.",
16        |instr, shell| match instr {
17            Instruction::Run(_) => {
18                if let Some(shell) = shell {
19                    !shell.any_command(|cmd| {
20                        cmd.name == "apt-get" && cmd.has_any_arg(&["upgrade", "dist-upgrade"])
21                    })
22                } else {
23                    true
24                }
25            }
26            _ => true,
27        },
28    )
29}
30
31#[cfg(test)]
32mod tests {
33    use super::*;
34    use crate::analyzer::hadolint::config::HadolintConfig;
35    use crate::analyzer::hadolint::lint::{LintResult, lint};
36
37    fn lint_dockerfile(content: &str) -> LintResult {
38        lint(content, &HadolintConfig::default())
39    }
40
41    #[test]
42    fn test_apt_get_upgrade() {
43        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get update && apt-get upgrade");
44        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3005"));
45    }
46
47    #[test]
48    fn test_apt_get_dist_upgrade() {
49        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get dist-upgrade");
50        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3005"));
51    }
52
53    #[test]
54    fn test_apt_get_update() {
55        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get update");
56        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3005"));
57    }
58
59    #[test]
60    fn test_apt_get_install() {
61        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get install -y nginx");
62        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3005"));
63    }
64}
syncable_cli/analyzer/hadolint/rules/dl3005.rs

syncable_cli/analyzer/hadolint/rules/
dl3005.rs
