syncable_cli/analyzer/hadolint/rules/
dl3014.rs

1//! DL3014: Use the -y switch to avoid manual input
2//!
3//! apt-get install should use -y to avoid prompts during build.
4
5use crate::analyzer::hadolint::parser::instruction::Instruction;
6use crate::analyzer::hadolint::rules::{SimpleRule, simple_rule};
7use crate::analyzer::hadolint::shell::ParsedShell;
8use crate::analyzer::hadolint::types::Severity;
9
10pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
11    simple_rule(
12        "DL3014",
13        Severity::Warning,
14        "Use the `-y` switch to avoid manual input `apt-get -y install <package>`.",
15        |instr, shell| {
16            match instr {
17                Instruction::Run(_) => {
18                    if let Some(shell) = shell {
19                        // Check all apt-get install commands
20                        !shell.any_command(|cmd| {
21                            if cmd.name == "apt-get" && cmd.has_any_arg(&["install"]) {
22                                // Must have -y, --yes, or --assume-yes
23                                !cmd.has_any_flag(&["y", "yes", "assume-yes"])
24                            } else {
25                                false
26                            }
27                        })
28                    } else {
29                        true
30                    }
31                }
32                _ => true,
33            }
34        },
35    )
36}
37
38#[cfg(test)]
39mod tests {
40    use super::*;
41    use crate::analyzer::hadolint::config::HadolintConfig;
42    use crate::analyzer::hadolint::lint::{LintResult, lint};
43
44    fn lint_dockerfile(content: &str) -> LintResult {
45        lint(content, &HadolintConfig::default())
46    }
47
48    #[test]
49    fn test_apt_get_without_y() {
50        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get install nginx");
51        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3014"));
52    }
53
54    #[test]
55    fn test_apt_get_with_y() {
56        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get install -y nginx");
57        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3014"));
58    }
59
60    #[test]
61    fn test_apt_get_with_yes() {
62        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get install --yes nginx");
63        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3014"));
64    }
65
66    #[test]
67    fn test_apt_get_with_assume_yes() {
68        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get install --assume-yes nginx");
69        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3014"));
70    }
71
72    #[test]
73    fn test_apt_get_update_no_y() {
74        // apt-get update doesn't need -y
75        let result = lint_dockerfile("FROM ubuntu:20.04\nRUN apt-get update");
76        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3014"));
77    }
78}
syncable_cli/analyzer/hadolint/rules/dl3014.rs

syncable_cli/analyzer/hadolint/rules/
dl3014.rs
