fix(ci): install hadolint for docs-only checks

[cv]

Summary

Docs-only pull requests run the system hadolint hook without installing its executable, so their required check fails before reviewing Dockerfiles. Install the same pinned and checksum-verified hadolint release used by static checks before the docs-only hook suite.

Changes

• Install hadolint 2.14.0 in the docs-only job and verify its reviewed SHA-256 digest.
• Extend the workflow contract test to cover the hadolint pin in both jobs and require installation before prek run.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This only corrects dependency setup in an internal GitHub Actions job.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: .github/workflows/pr.yaml and test/pr-workflow-contract.test.ts only change internal CI setup and its contract test; no user command, configuration, output, or supported behavior changes. No writing-rule findings.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run test/pr-workflow-contract.test.ts passed 22 tests; the regression failed before the workflow fix.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: CI / Pull Request run 30175517417 passed static checks, all eight CLI coverage shards, and merged coverage.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved documentation checks by adding verified Dockerfile linting.
  • CI tooling is now pinned to a reviewed version and checksum for more reliable validation.

• Tests

  • Expanded workflow validation to cover Dockerfile linting in documentation checks.
  • Added checks for tool integrity and execution order.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0eae4f08-1e45-4df5-a2f6-b3bab114b3be

📥 Commits

Reviewing files that changed from the base of the PR and between d3162e3 and 7bf5596.

📒 Files selected for processing (2)

• .github/workflows/pr.yaml
• test/pr-workflow-contract.test.ts

---

📝 Walkthrough

Walkthrough

The docs-only CI job now installs hadolint from a pinned release, verifies its SHA-256 checksum, and places it on the system path. Workflow contract tests validate the digest, reject upstream metadata fetching, and check ordering before prek run.

Changes

Hadolint CI integrity

Layer / File(s)	Summary
Verified hadolint installation and contract coverage .github/workflows/pr.yaml, test/pr-workflow-contract.test.ts	The docs-only job downloads and verifies hadolint v2.14.0, installs it as an executable, and tests enforce the reviewed digest, prohibit metadata-derived checksums, and verify ordering before prek run.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: dependencies, github_actions

Suggested reviewers: hoyalim, apurvvkumaria, cjagwani

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/install-hadolint-docs-ci

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 7bf5596 in the codex/install-hadoli... branch remains at 96%, unchanged from commit d3162e3 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 7bf5596 in the codex/install-hadoli... branch remains at 80%, unchanged from commit 66f9383 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 66f9383	codex/install-hadoli... 7bf5596	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/shields/index.ts	72%	71%	-1%
src/lib/sandbox...rce-identity.ts	87%	87%	0%

---

_{Updated July 25, 2026 21:33 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.