[#2868] Pinned Hadolint to v2.15.0 and replaced its global ignores with justified per-line ones.

.circleci/config.yml

@@ -136,7 +136,7 @@ jobs:
           name: Lint Dockerfiles with Hadolint
           command: |
             for file in $(find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \)); do
-              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
+              echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:v2.15.0 || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
       #;> TOOL_HADOLINT
 

.claude/skills/prepare-vortex-release/SKILL.md

@@ -62,6 +62,17 @@ Work through each checklist item from the release process doc:
 
 1. **Dependencies** - Skip Renovate (user must run manually). Note as unchecked.
 2. **Container images** - Check current versions in CI configs, verify if latest.
+   - **CI tool images** - `hadolint`, `dclint`, `gitleaks` and `actionlint` are
+     invoked as `docker run <image>:<tag>` inside `.github/workflows/**` and
+     `.circleci/config.yml`. The `customManagers` regex in `renovate.json`
+     tracks them, so this is a verification step, not a manual bump: confirm
+     no open Renovate PR is bumping them and that both CI providers carry the
+     same tag for the same tool. Bump by hand only when Renovate has not
+     picked a release up, and in that case pin the identical tag in
+     `.vortex/tests/lint.dockerfiles.sh` so a local run matches CI.
+   - An untagged image reference is a release blocker regardless of Renovate:
+     it resolves to `latest` and lets an upstream release break a default
+     branch on a commit that changed nothing.
 3. **PHP version** - Run `docker compose run --rm cli php -r "echo PHP_VERSION;"` and
    `docker compose run --rm cli php -r "echo PHP_VERSION_ID;"` to get the container
    PHP version. Update `composer.json` (`config.platform.php`), `phpstan.neon`

.docker/clamav.dockerfile

@@ -5,8 +5,6 @@
 # Allow running ClamAV in rootless mode.
 # @see https://github.com/Cisco-Talos/clamav/issues/478
 #
-# hadolint global ignore=DL3008,DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/commons/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
 
@@ -17,6 +15,7 @@ FROM clamav/clamav-debian:1.5.3
 COPY --from=commons /lagoon /lagoon
 COPY --from=commons /bin/fix-permissions /bin/ep /bin/docker-sleep /bin/wait-for /bin/
 
+# hadolint ignore=DL3008 # the package set tracks the pinned base image
 RUN apt-get update -qq && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
@@ -30,10 +29,12 @@ RUN cat /tmp/clamav.conf >> /etc/clamav/clamd.conf && \
     sed -i "s/^UpdateLogFile /# UpdateLogFile /g" /etc/clamav/freshclam.conf && \
     sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/freshclam.conf
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 RUN fix-permissions /var/lib/clamav
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER clamav
 
 ENTRYPOINT [ "/init-unprivileged" ]

.docker/cli.dockerfile

@@ -3,11 +3,7 @@
 #
 # All CLI operations performed in this container.
 #
-# The `PACKAGE_TOKEN` argument below is flagged by name by the
-# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
-# secret and never written to an image layer, so that check is skipped.
-#
-# hadolint global ignore=DL3018,SC2174
+# The check skipped above is BuildKit's twin of DL3064, ignored inline below.
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
@@ -26,12 +22,15 @@ ENV WEBROOT=${WEBROOT}
 
 # Token is used to access private repositories. Not exposed as an environment
 # variable within an image to avoid baking it into the image.
+# hadolint ignore=DL3064 # empty here, the value comes from a build secret
 ARG PACKAGE_TOKEN=""
 
 ARG DRUPAL_PUBLIC_FILES="sites/default/files"
 ENV DRUPAL_PUBLIC_FILES=${DRUPAL_PUBLIC_FILES}
 
+# hadolint ignore=DL3064 # a path, not a secret
 ARG DRUPAL_PRIVATE_FILES="sites/default/files/private"
+# hadolint ignore=DL3064 # a path, not a secret
 ENV DRUPAL_PRIVATE_FILES=${DRUPAL_PRIVATE_FILES}
 
 ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
@@ -61,6 +60,7 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # earlier in the build process (near the top of this file).
 
 # Add more tools.
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
     pecl install pcov && \
     docker-php-ext-enable pcov && \
@@ -89,7 +89,6 @@ COPY .vortex/tooling /app/.vortex/tooling
 
 # Install PHP dependencies without development packages to avoid exposing
 # potential security vulnerabilities in the production environment.
-# hadolint ignore=SC2155
 RUN --mount=type=secret,id=package_token \
     token=$(if [ -s /run/secrets/package_token ]; then cat /run/secrets/package_token; else echo "${PACKAGE_TOKEN}"; fi) && \
     if [ -n "${token}" ]; then export COMPOSER_AUTH="{\"github-oauth\": {\"github.com\": \"${token}\"}}"; fi && \
@@ -100,6 +99,7 @@ RUN --mount=type=secret,id=package_token \
 COPY . /app
 
 # Create file directories and set correct permissions.
+# hadolint ignore=SC2174 # only the leaf directory needs the mode
 RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 
 #;< DRUPAL_THEME

.docker/database.dockerfile

@@ -6,15 +6,17 @@
 # The ARG value will be updated with a value passed from docker-compose.yml
 
 ARG IMAGE=uselagoon/mysql-8.4:26.8.0
-# hadolint ignore=DL3006
 FROM ${IMAGE}
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 COPY ./.docker/config/database/my.cnf /etc/my.cnf.d/server.cnf
 RUN fix-permissions /etc/my.cnf.d/
 
+# hadolint ignore=DL3064 # local development credentials only
 ENV MYSQL_DATABASE=drupal \
     MYSQL_USER=drupal \
     MYSQL_PASSWORD=drupal
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER mysql

.docker/nginx-drupal.dockerfile

@@ -2,13 +2,10 @@
 #
 # All web requests are sent to this container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/nginx-drupal
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/nginx-drupal:26.7.0
@@ -17,6 +14,7 @@ FROM uselagoon/nginx-drupal:26.7.0
 ARG WEBROOT=web
 ENV WEBROOT=${WEBROOT}
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY ./.docker/config/nginx/redirects-map.conf /etc/nginx/redirects-map.conf

.docker/php.dockerfile

@@ -3,17 +3,15 @@
 # All web requests are sent from Nginx to this container.
 # This container would be scaled up/down in production.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/php-8.4-fpm/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-fpm
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/php-8.4-fpm:26.7.0
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY --from=cli /app /app

.docker/solr.dockerfile

@@ -1,7 +1,5 @@
 # Solr container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/solr-9-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr-drupal/9.Dockerfile
 
@@ -16,13 +14,15 @@ FROM uselagoon/solr-9-drupal:26.8.0
 # whenever this image tag is bumped.
 COPY .docker/config/solr/config-set /solr-conf/conf/
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 # Apply custom modifications for Lagoon environment compatibility.
 RUN sed -i -e "s#<dataDir>\${solr.data.dir:}#<dataDir>/var/solr/\${solr.core.name}#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.lock.type:native#solr.lock.type:none#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.autoSoftCommit.MaxTime=5000#solr.autoSoftCommit.MaxTime=-1#g" /solr-conf/conf/solrcore.properties
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER solr
 
 # solr-precreate is provided by the base Solr container image.

.github/workflows/build-test-deploy.yml

@@ -130,7 +130,7 @@ jobs:
       - name: Lint Dockerfiles with Hadolint
         run: |
           find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:v2.15.0
           done
         continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}
       #;> TOOL_HADOLINT

.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/clamav.dockerfile

@@ -5,8 +5,6 @@
 # Allow running ClamAV in rootless mode.
 # @see https://github.com/Cisco-Talos/clamav/issues/478
 #
-# hadolint global ignore=DL3008,DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/commons/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
 
@@ -17,6 +15,7 @@ FROM clamav/clamav-debian:__VERSION__
 COPY --from=commons /lagoon /lagoon
 COPY --from=commons /bin/fix-permissions /bin/ep /bin/docker-sleep /bin/wait-for /bin/
 
+# hadolint ignore=DL3008 # the package set tracks the pinned base image
 RUN apt-get update -qq && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata && \
     apt-get clean && rm -rf /var/lib/apt/lists/*
@@ -30,10 +29,12 @@ RUN cat /tmp/clamav.conf >> /etc/clamav/clamd.conf && \
     sed -i "s/^UpdateLogFile /# UpdateLogFile /g" /etc/clamav/freshclam.conf && \
     sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/freshclam.conf
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 RUN fix-permissions /var/lib/clamav
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER clamav
 
 ENTRYPOINT [ "/init-unprivileged" ]

.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile

@@ -3,11 +3,7 @@
 #
 # All CLI operations performed in this container.
 #
-# The `PACKAGE_TOKEN` argument below is flagged by name by the
-# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
-# secret and never written to an image layer, so that check is skipped.
-#
-# hadolint global ignore=DL3018,SC2174
+# The check skipped above is BuildKit's twin of DL3064, ignored inline below.
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
@@ -26,12 +22,15 @@ ENV WEBROOT=${WEBROOT}
 
 # Token is used to access private repositories. Not exposed as an environment
 # variable within an image to avoid baking it into the image.
+# hadolint ignore=DL3064 # empty here, the value comes from a build secret
 ARG PACKAGE_TOKEN=""
 
 ARG DRUPAL_PUBLIC_FILES="sites/default/files"
 ENV DRUPAL_PUBLIC_FILES=${DRUPAL_PUBLIC_FILES}
 
+# hadolint ignore=DL3064 # a path, not a secret
 ARG DRUPAL_PRIVATE_FILES="sites/default/files/private"
+# hadolint ignore=DL3064 # a path, not a secret
 ENV DRUPAL_PRIVATE_FILES=${DRUPAL_PRIVATE_FILES}
 
 ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
@@ -61,6 +60,7 @@ ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 # earlier in the build process (near the top of this file).
 
 # Add more tools.
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache ncurses pv tzdata autoconf g++ make && \
     pecl install pcov && \
     docker-php-ext-enable pcov && \
@@ -82,7 +82,6 @@ COPY composer.json composer.* patches.lock.* .env* auth* /app/
 
 # Install PHP dependencies without development packages to avoid exposing
 # potential security vulnerabilities in the production environment.
-# hadolint ignore=SC2155
 RUN --mount=type=secret,id=package_token \
     token=$(if [ -s /run/secrets/package_token ]; then cat /run/secrets/package_token; else echo "${PACKAGE_TOKEN}"; fi) && \
     if [ -n "${token}" ]; then export COMPOSER_AUTH="{\"github-oauth\": {\"github.com\": \"${token}\"}}"; fi && \
@@ -93,6 +92,7 @@ RUN --mount=type=secret,id=package_token \
 COPY . /app
 
 # Create file directories and set correct permissions.
+# hadolint ignore=SC2174 # only the leaf directory needs the mode
 RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
 
 RUN if [ "${VORTEX_FRONTEND_BUILD_SKIP}" != "1" ]; then \

.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile

@@ -6,15 +6,17 @@
 # The ARG value will be updated with a value passed from docker-compose.yml
 
 ARG IMAGE=uselagoon/mysql-8.4:__VERSION__
-# hadolint ignore=DL3006
 FROM ${IMAGE}
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 COPY ./.docker/config/database/my.cnf /etc/my.cnf.d/server.cnf
 RUN fix-permissions /etc/my.cnf.d/
 
+# hadolint ignore=DL3064 # local development credentials only
 ENV MYSQL_DATABASE=drupal \
     MYSQL_USER=drupal \
     MYSQL_PASSWORD=drupal
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER mysql

.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/nginx-drupal.dockerfile

@@ -2,13 +2,10 @@
 #
 # All web requests are sent to this container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/nginx-drupal
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/nginx-drupal:__VERSION__
@@ -17,6 +14,7 @@ FROM uselagoon/nginx-drupal:__VERSION__
 ARG WEBROOT=web
 ENV WEBROOT=${WEBROOT}
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY ./.docker/config/nginx/redirects-map.conf /etc/nginx/redirects-map.conf

.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/php.dockerfile

@@ -3,17 +3,15 @@
 # All web requests are sent from Nginx to this container.
 # This container would be scaled up/down in production.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/php-8.4-fpm/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-fpm
 
 ARG CLI_IMAGE
-# hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} AS cli
 
 FROM uselagoon/php-8.4-fpm:__VERSION__
 
+# hadolint ignore=DL3018 # the package set tracks the pinned base image
 RUN apk add --no-cache tzdata
 
 COPY --from=cli /app /app

.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/solr.dockerfile

@@ -1,7 +1,5 @@
 # Solr container.
 #
-# hadolint global ignore=DL3018
-#
 # @see https://hub.docker.com/r/uselagoon/solr-9-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr-drupal/9.Dockerfile
 
@@ -16,13 +14,15 @@ FROM uselagoon/solr-9-drupal:__VERSION__
 # whenever this image tag is bumped.
 COPY .docker/config/solr/config-set /solr-conf/conf/
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER root
 
 # Apply custom modifications for Lagoon environment compatibility.
 RUN sed -i -e "s#<dataDir>\${solr.data.dir:}#<dataDir>/var/solr/\${solr.core.name}#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.lock.type:native#solr.lock.type:none#g" /solr-conf/conf/solrconfig.xml && \
     sed -i -e "s#solr.autoSoftCommit.MaxTime=5000#solr.autoSoftCommit.MaxTime=-1#g" /solr-conf/conf/solrcore.properties
 
+# hadolint ignore=DL3066 # named account provided by the base image
 USER solr
 
 # solr-precreate is provided by the base Solr container image.

.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml

@@ -116,7 +116,7 @@ jobs:
       - name: Lint Dockerfiles with Hadolint
         run: |
           find .docker \( -name 'Dockerfile' -o -name '*.dockerfile' \) | while read -r file; do
-            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint
+            echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__
           done
         continue-on-error: ${{ vars.VORTEX_CI_HADOLINT_IGNORE_FAILURE == '1' }}