hadolint.yml

---
name: Hadolint

permissions: read-all

on:
  workflow_call:
    inputs:
      output_prefix:
        description: 'Prefix to add to output artifacts'
        required: false
        default: ''
        type: string

jobs:
  scan:
    runs-on: [self-hosted, linux, docker]
    steps:
      - name: Cleanup workspace
        run: sudo rm -rf ..?* .[!.]* *

      - name: Checkout PR branch
        uses: actions/checkout@v4
        with:
          path: source

      - name: Pull docker image
        run: docker pull hadolint/hadolint

      - name: Lint
        run: |
          mkdir artifact
          echo "Hadolint Report" \
          > artifact/hadolint.txt
          walk_dir () {
            shopt -s nullglob dotglob

            for pathname in "$1"/*; do
              retVal=0
              if [ -d "$pathname" ]; then
                walk_dir "$pathname" || retVal=$?
                if [ $retVal -ne 0 ]; then
                  RC=$retVal
                fi
              else
                case "$pathname" in
                  *Dockerfile*|*dockerfile*)
                    echo "Checking $pathname"
                    echo "" >> artifact/hadolint.txt
                    echo "  $pathname" \
                    >> artifact/hadolint.txt
                    echo "----------" \
                    >> artifact/hadolint.txt
                    docker run --rm \
                      -i --attach stderr --attach stdout \
                      -v $(pwd)/source:/source \
                      -w /source \
                      hadolint/hadolint \
                      < $pathname 2>&1 \
                      >> artifact/hadolint.txt \
                      || retVal=$?
                    if [ $retVal -ne 0 ]; then
                      RC=$retVal
                    fi
                esac
              fi
            done
            return $RC
          }
          walk_dir "$(pwd)/source"

      - name: Summarize
        if: (failure())
        run: |
          echo '```' >> $GITHUB_STEP_SUMMARY
          cat artifact/hadolint.txt \
          >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY

      - name: Report
        if: (success() || failure())
        run: |
          cat artifact/hadolint.txt

      - name: Record Artifacts
        uses: actions/upload-artifact@v4
        if: (success() || failure())
        with:
          name: ${{ inputs.output_prefix }}hadolint
          path: artifact/*

      - name: Cleanup workspace
        run: sudo rm -rf ..?* .[!.]* *