feat: ship hadolint and knip natively in the image #4

Merged

gravityfargo merged 2 commits from feat/2-ship-hadolint-knip into main

2026-07-29 23:02:27 +00:00

gravityfargo commented

2026-07-29 22:59:53 +00:00

Owner

Summary

hadolint now comes from COPY --from=hadolint/hadolint:v2.14.0-alpine /bin/hadolint /usr/local/bin/hadolint rather than a curl of a GitHub release in each consumer's checks workflow. Pinning by image tag puts the version under the shared Renovate preset's dockerfile manager (the docker datasource is already exempt from the age gate), and drops the hardcoded Linux-x86_64.
knip added to the existing global npm install, pinned to 6.29.0 alongside prettier@3.8.1.
Docs updated: the OCI description label, README contents (including its now-inaccurate "single-stage" claim), and the AGENTS.md image-design constraints. That section also picks up the make refusal rationale from #1, which was decided there but never actually written into the repo.

Not in this PR

.forgejo/workflows/checks.yml still installs hadolint by curl. It pins general-ci:0.4.0, which has no hadolint, so collapsing the step to hadolint Dockerfile would fail on this very PR. It can only be simplified after this publishes and the pin moves.
The Makefile's HADOLINT variable is a second copy of the version. Renovate reads the Dockerfile line but not the Makefile, so the two can drift; the coupling is noted in AGENTS.md instead of restructuring the local gate.
prettier and knip are pins inside a RUN, which no Renovate manager reads — fixing that needs a customManagers entry in the shared preset, which is a fleet-wide change.

Test plan

make build succeeds
docker run --rm general-ci:local hadolint --version → Haskell Dockerfile Linter 2.14.0
docker run --rm general-ci:local knip --version → 6.29.0
Both resolve as the default non-root appuser (whoami → appuser)
hadolint Dockerfile run from inside the image against a mounted repo exits clean and honours .hadolint.yaml
make pre-commit green — hadolint passes, prettier reports every file unchanged

Closes #2

## Summary - `hadolint` now comes from `COPY --from=hadolint/hadolint:v2.14.0-alpine /bin/hadolint /usr/local/bin/hadolint` rather than a curl of a GitHub release in each consumer's checks workflow. Pinning by image tag puts the version under the shared Renovate preset's dockerfile manager (the docker datasource is already exempt from the age gate), and drops the hardcoded `Linux-x86_64`. - `knip` added to the existing global npm install, pinned to 6.29.0 alongside `prettier@3.8.1`. - Docs updated: the OCI `description` label, README contents (including its now-inaccurate "single-stage" claim), and the `AGENTS.md` image-design constraints. That section also picks up the `make` refusal rationale from #1, which was decided there but never actually written into the repo. ## Not in this PR - **`.forgejo/workflows/checks.yml` still installs hadolint by curl.** It pins `general-ci:0.4.0`, which has no hadolint, so collapsing the step to `hadolint Dockerfile` would fail on this very PR. It can only be simplified after this publishes and the pin moves. - **The Makefile's `HADOLINT` variable is a second copy of the version.** Renovate reads the Dockerfile line but not the Makefile, so the two can drift; the coupling is noted in `AGENTS.md` instead of restructuring the local gate. - `prettier` and `knip` are pins inside a `RUN`, which no Renovate manager reads — fixing that needs a `customManagers` entry in the shared preset, which is a fleet-wide change. ## Test plan - [x] `make build` succeeds - [x] `docker run --rm general-ci:local hadolint --version` → `Haskell Dockerfile Linter 2.14.0` - [x] `docker run --rm general-ci:local knip --version` → `6.29.0` - [x] Both resolve as the default non-root `appuser` (`whoami` → `appuser`) - [x] `hadolint Dockerfile` run from inside the image against a mounted repo exits clean and honours `.hadolint.yaml` - [x] `make pre-commit` green — hadolint passes, prettier reports every file unchanged Closes #2

gravityfargo added 2 commits

2026-07-29 22:59:53 +00:00

ci: add the hadolint gate and tighten the build context aa40d6d65d

feat: ship hadolint and knip natively in the image

Lint & Format / Lint & format (pull_request) Successful in 6s

Details

PR Bump Preview / Preview version bump (pull_request) Successful in 5s

Details

a4c75e039e

forgejo-actions commented

2026-07-29 23:00:03 +00:00

Commitizen bump preview

Merging this PR will produce the following bump:

bump: version 0.4.0 → 0.5.0
tag to create: 0.5.0
increment detected: MINOR

## 0.5.0 (2026-07-29)

### Feat

- ship hadolint and knip natively in the image

## Commitizen bump preview Merging this PR will produce the following bump: ``` bump: version 0.4.0 → 0.5.0 tag to create: 0.5.0 increment detected: MINOR ## 0.5.0 (2026-07-29) ### Feat - ship hadolint and knip natively in the image ```

gravityfargo merged commit 59c9cc9025 into main

2026-07-29 23:02:27 +00:00

gravityfargo deleted branch feat/2-ship-hadolint-knip

2026-07-29 23:02:28 +00:00

gravityfargo referenced this pull request from a commit

2026-07-29 23:02:29 +00:00

feat: ship hadolint and knip natively in the image (#4)