[OPIK-6673] [CI] feat: add hadolint Dockerfile linting to CI#7352
[OPIK-6673] [CI] feat: add hadolint Dockerfile linting to CI#7352JetoPistola wants to merge 3 commits into
Conversation
Add hadolint to the unified Code Quality pipeline so every Dockerfile is linted on each PR (changed-files-only) via the existing pre-commit-driven matrix in code_quality.yml. New violations on changed Dockerfiles fail the check with inline annotations. - .pre-commit-config.yaml: hadolint-docker hook (Docker image, no local binary), explicit files: regex so the CI matrix detector routes changed Dockerfiles to it. - .hadolint.yaml: default rule set, failure-threshold info, no global ignores; the four version-pinning rules that would rot against rolling-channel base-image repos are suppressed per-line with a reason. - Fix all pre-existing violations across the 4 non-clean Dockerfiles: merge consecutive RUNs (DL3059), add pipefail SHELL (DL4006; /bin/ash for the alpine python-backend), find -print0 | xargs -0 (SC2038). - CONTRIBUTING.md: how to run hadolint locally. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
documentation
⏱️ pre-commit per-hook timing
⏭️ 38 skipped (no matching files changed)
|
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
…f ignoring DL3013 - scripts/precommit-hook-descriptions.tsv: add hadolint → "Lint Dockerfiles" so the Code Quality timing/skipped tables render a description for it. - guardrails Dockerfile: replace the DL3013 ignore with a real fix — float pip from a >=24 floor (Ubuntu 22.04 ships pip ~22, too old for the pinned torch/transformers/hf_xet wheels). A lower bound doesn't rot, and it satisfies DL3013 honestly. Remaining suppressions are only the rolling-channel OS-package pin rules (DL3008/DL3018/DL3033). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🔄 Test environment deployment process has started Phase 1: Deploying base version You can monitor the progress here. |
|
✅ Test environment is now available! To configure additional Environment variables for your environment, run [Deploy Opik AdHoc Environment workflow] (https://github.com/comet-ml/comet-deployment/actions/workflows/deploy_opik_adhoc_env.yaml) Access Information
The deployment has completed successfully and the version has been verified. |
…verrides The config only restated hadolint's default failure-threshold (info) and held no global ignores (the deliberate exceptions are inline `# hadolint ignore=` comments in the Dockerfiles). With nothing repo-specific to configure, the file was pure overhead. Removing it keeps identical behavior — hadolint falls back to its info default — and drops a file reviewers would otherwise have to reason about. Docs updated to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🌙 Nightly cleanup: The test environment for this PR ( |
|
🔄 Test environment deployment process has started Phase 1: Deploying base version You can monitor the progress here. |
|
✅ Test environment is now available! To configure additional Environment variables for your environment, run [Deploy Opik AdHoc Environment workflow] (https://github.com/comet-ml/comet-deployment/actions/workflows/deploy_opik_adhoc_env.yaml) Access Information
The deployment has completed successfully and the version has been verified. |
|
🌙 Nightly cleanup: The test environment for this PR ( |
|
🔄 Test environment deployment process has started Phase 1: Deploying base version You can monitor the progress here. |
|
✅ Test environment is now available! To configure additional Environment variables for your environment, run [Deploy Opik AdHoc Environment workflow] (https://github.com/comet-ml/comet-deployment/actions/workflows/deploy_opik_adhoc_env.yaml) Access Information
The deployment has completed successfully and the version has been verified. |
|
🌙 Nightly cleanup: The test environment for this PR ( |
2 participants
Details
Adds hadolint Dockerfile linting to the unified
🐙 Code Qualitypipeline, so every Dockerfile is linted on each PR (changed-files-only) and new violations fail the check with inline annotations.Rather than a standalone workflow (as the ticket's original HOW note suggested — written before the CI consolidation in #7165), hadolint is added as a hook in the root
.pre-commit-config.yaml, the single source of truth. It flows automatically intocode_quality.ymlvia the existing per-linter matrix detector, and is also runnable locally viamake precommit..pre-commit-config.yaml—hadolint-dockerhook (pinnedv2.14.0, runs via the hadolint Docker image so no local binary is needed, matching CI runners). Uses an explicitfiles:regex instead of the upstreamtypes: [dockerfile]soscripts/precommit-detect-hooks.py(which matches on paths) routes changed Dockerfiles to it.No
.hadolint.yaml— hadolint's default rule set (failure thresholdinfo) is used as-is. No repo-level config file: there are no global ignores (the deliberate exceptions are inline in the Dockerfiles) and no custom overrides, so a config file would only restate the default. (Minor divergence from the ticket's AC, which listed "a.hadolint.yamlexists": that AC assumed exceptions would be baselined in the config. We fixed the violations and put the few exceptions inline instead, so an empty config would add nothing — it can be re-added the moment an override or threshold change is actually needed.)All pre-existing violations fixed across the 4 non-clean Dockerfiles. The only suppressions left are the three OS-package pinning rules that would rot against rolling-channel base-image repos (DL3033 yum / DL3008 apt / DL3018 apk), each ignored per-line with a reason, not globally — so the rules still fire on any new Dockerfile. Everything else is a genuine fix: consecutive-RUN merges (DL3059), pipefail SHELL (DL4006;
/bin/ashfor the alpine python-backend),find -print0 | xargs -0(SC2038), and pip floated from a>=24floor rather than ignoring DL3013.On OS-package pinning specifically: exact-pinning distro packages (
apt-get install curl=7.88.1-10) is a known anti-pattern — distro mirrors are rolling and drop old versions on the next security update, so a pinned build breaks on a later rebuild. The robust reproducibility lever is base-image digest pinning (FROM ubuntu:22.04@sha256:…) plus scheduled rebuilds + the existing vulnerability scan — a separate concern worth its own change. Hence the per-line ignores here.Change checklist
Issues
Resolves OPIK-6673
Testing
hadolintexits 0 on all 5 Dockerfiles (backend, frontend, guardrails, python-backend, sandbox-executor).pre-commit run hadolint-docker— passes on the clean files, and fails with inline annotations on a fresh violation (verified with a throwawayFROM ubuntu:latest+ unpinnedapt-get install).scripts/precommit-detect-hooks.pyverified both ways: a changed Dockerfile emits a hadolint leg; a non-Dockerfile change does not.opik-frontendbuilder stage locally after the DL3059 RUN-merge and confirmeddist/version.jsonis still produced correctly.guardrails_e2e_tests.ymlandpython_backend_e2e_tests.yml(both path-triggered on the dirs this PR touches).Documentation
Added a "Dockerfiles" section to
CONTRIBUTING.mdexplaining the hadolint gate and how to run it locally.🤖 Generated with Claude Code