From 7bf5596751825a7deb17940468907d38b02bce27 Mon Sep 17 00:00:00 2001 From: Carlos Villela Date: Sat, 25 Jul 2026 14:00:54 -0700 Subject: [PATCH] fix(ci): install hadolint for docs-only checks Signed-off-by: Carlos Villela --- .github/workflows/pr.yaml | 12 ++++++++++++ test/pr-workflow-contract.test.ts | 13 ++++++------- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index a7ed35fdcf0..ca0ee3bbe35 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -63,6 +63,18 @@ jobs: - name: Install docs-only check dependencies run: npm install --ignore-scripts + - name: Install hadolint + shell: bash + run: | + set -euo pipefail + HADOLINT_VERSION="v2.14.0" + HADOLINT_URL="https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/hadolint-linux-x86_64" + HADOLINT_SHA256="6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47" + curl -fsSL -o /usr/local/bin/hadolint "$HADOLINT_URL" + ACTUAL=$(sha256sum /usr/local/bin/hadolint | awk '{print $1}') + [ "$HADOLINT_SHA256" = "$ACTUAL" ] || { echo "::error::hadolint checksum mismatch"; exit 1; } + chmod +x /usr/local/bin/hadolint + - name: Fetch checked-out merge base for docs-only checks shell: bash run: | diff --git a/test/pr-workflow-contract.test.ts b/test/pr-workflow-contract.test.ts index 7b8484a7b45..d2429487762 100644 --- a/test/pr-workflow-contract.test.ts +++ b/test/pr-workflow-contract.test.ts @@ -1119,13 +1119,12 @@ describe("pull request and main workflow contracts", () => { // source-shape-contract: security -- Downloaded CI tooling must use a committed digest rather than upstream metadata it("pins downloaded CI tooling to reviewed integrity", () => { - const staticRunsJoined = stepRuns(sharedActions.staticChecks).join("\n"); - - expect(staticRunsJoined).toContain( - 'HADOLINT_SHA256="6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47"', - ); - expect(staticRunsJoined).not.toContain('"${HADOLINT_URL}.sha256"'); - expect(staticRunsJoined).not.toContain("EXPECTED=$(curl"); + const docsRuns = stepRuns(prWorkflow.jobs["docs-only-checks"]).join("\n"); + for (const runs of [stepRuns(sharedActions.staticChecks).join("\n"), docsRuns]) { + expect(runs).toContain("6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47"); + expect(runs).not.toMatch(/HADOLINT_URL.*sha256|EXPECTED=\$\(curl/); + } + expect(docsRuns.indexOf("HADOLINT_SHA256")).toBeLessThan(docsRuns.indexOf("prek run")); }); it("validates CLI shard inputs before using them in shell commands", () => {