syncable_cli/analyzer/hadolint/rules/
dl3028.rs

1//! DL3028: Pin versions in gem install
2//!
3//! Ruby gems should be pinned to specific versions.
4
5use crate::analyzer::hadolint::parser::instruction::Instruction;
6use crate::analyzer::hadolint::rules::{SimpleRule, simple_rule};
7use crate::analyzer::hadolint::shell::ParsedShell;
8use crate::analyzer::hadolint::types::Severity;
9
10pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
11    simple_rule(
12        "DL3028",
13        Severity::Warning,
14        "Pin versions in gem install. Instead of `gem install <gem>` use `gem install <gem>:<version>`.",
15        |instr, shell| {
16            match instr {
17                Instruction::Run(_) => {
18                    if let Some(shell) = shell {
19                        !shell.any_command(|cmd| {
20                            if cmd.name == "gem" && cmd.has_any_arg(&["install"]) {
21                                // Get gems (args after install, excluding flags)
22                                let gems = get_gem_packages(cmd);
23                                // Check if any gem is unpinned
24                                gems.iter().any(|gem| !is_pinned_gem(gem))
25                            } else {
26                                false
27                            }
28                        })
29                    } else {
30                        true
31                    }
32                }
33                _ => true,
34            }
35        },
36    )
37}
38
39/// Extract gem names from gem install command
40fn get_gem_packages(cmd: &crate::analyzer::hadolint::shell::Command) -> Vec<&str> {
41    let mut gems = Vec::new();
42    let mut found_install = false;
43
44    for arg in &cmd.arguments {
45        if arg == "install" {
46            found_install = true;
47            continue;
48        }
49        if found_install && !arg.starts_with('-') {
50            gems.push(arg.as_str());
51        }
52    }
53
54    gems
55}
56
57/// Check if gem is pinned
58fn is_pinned_gem(gem: &str) -> bool {
59    // Skip flags
60    if gem.starts_with('-') {
61        return true;
62    }
63
64    // Check for version specifier
65    // gem install rails:7.0.0
66    // gem install rails -v 7.0.0 (handled separately via flag check)
67    gem.contains(':')
68}
69
70#[cfg(test)]
71mod tests {
72    use super::*;
73    use crate::analyzer::hadolint::config::HadolintConfig;
74    use crate::analyzer::hadolint::lint::{LintResult, lint};
75
76    fn lint_dockerfile(content: &str) -> LintResult {
77        lint(content, &HadolintConfig::default())
78    }
79
80    #[test]
81    fn test_gem_install_unpinned() {
82        let result = lint_dockerfile("FROM ruby:3.2\nRUN gem install rails");
83        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3028"));
84    }
85
86    #[test]
87    fn test_gem_install_pinned() {
88        let result = lint_dockerfile("FROM ruby:3.2\nRUN gem install rails:7.0.0");
89        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3028"));
90    }
91
92    #[test]
93    fn test_gem_install_multiple_unpinned() {
94        let result = lint_dockerfile("FROM ruby:3.2\nRUN gem install bundler rake");
95        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3028"));
96    }
97
98    #[test]
99    fn test_bundle_install() {
100        // bundle install uses Gemfile.lock, not relevant
101        let result = lint_dockerfile("FROM ruby:3.2\nRUN bundle install");
102        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3028"));
103    }
104}
syncable_cli/analyzer/hadolint/rules/dl3028.rs

syncable_cli/analyzer/hadolint/rules/
dl3028.rs
