cisagov / skeleton-generic

A generic skeleton project for quickly getting a new cisagov project started.
Creative Commons Zero v1.0 Universal
13 stars 11 forks source link

Add Dockerfile auditing #173

Open michaelsaki opened 3 months ago

michaelsaki commented 3 months ago

💡 Summary

Add Dockerfile auditing to pre-commit linting.

Motivation and context

Currently there are only checks for docker-compose.yml files in the pre-commit linting. There should also be checks for Dockerfiles. Tools such as Hadolint are good for this, but any similar tools that can be ran as a pre-commit hook would suffice.

Acceptance criteria

michaelsaki commented 3 months ago

I am currently working on a custom Hadolint pre-commit hook that we can integrate seamlessly into the linting. I am trying to leverage the Python library setuptools to package this and enable an auto-install Hadolint, in the pre-commit local environment. Ideally this would make it so users don't have to install Hadolint however I am having issues getting it to work on macOS. https://github.com/michaelsaki/pre-commit-hadolint

michaelsaki commented 3 months ago

Moving this to "on hold" until this PR gets merged. https://github.com/AleksaC/hadolint-py/pull/6. It will provide the simplest solution for the macOS segfault issue when merged into hadolint-py

michaelsaki commented 1 month ago

There is currently a branch for this issue. I have ran the https://github.com/AleksaC/hadolint-py locally and initial tests look good. There will still need to be tests done to have it tested in GitHub Actions. Also prior to integration of the pre-commit hook any downstream repos that have Dockerfiles will need to be ran against hadolint to check for any pre-existing linting errors.