Repository navigation
Pin hadolint Docker image to match the hook rev - #5605
Merged
Merged
Conversation
obenland
added
🟧 priority: high
obenland
added
the
🤖 aspect: dx
openverse-bot
added
the
🏷 status: label work required
The upstream hadolint-docker hook leaves the image tag floating at `latest`, so every lint run pulled the newest hadolint regardless of the pinned `rev`. A new release introduced rule DL3066, which fails the required "Lint files" job on every PR. hadolint v2.12.0 with the repository's existing .hadolint.yaml produces no findings. Split out from #5602 (thanks @ekamran) so the lint fix can land without triggering the test suites that are failing for unrelated reasons. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
obenland
force-pushed
the
pin-hadolint-image
branch
from
August 25, 2026 20:13
3c48940 to
4fa3c8d
Compare
github-project-automation
Bot
moved this from 👀 Needs Review
to 🤝 Merged
in Openverse PRs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The required "Lint files" check has been failing on every PR (and on
main) because the upstreamhadolint-dockerpre-commit hook leaves its Docker image tag floating atlatest— every run pulls the newest hadolint regardless of the pinnedrev: v2.12.0. A newer hadolint release introduced rule DL3066 ("Non-numeric user-id"), which fires onfrontend,api,catalog, andingestion_serverDockerfiles and fails the job.Pinning the image
entryto the same version asrevmakes lint reproducible. Verified locally: hadolint v2.12.0 with the repository's existing.hadolint.yamlproduces zero findings across all seven Dockerfiles (exit 0), so no rule changes or threshold adjustments are needed.This is the lint half of #5602 (credit to @ekamran for identifying the fix), split out deliberately: #5602 also touches
ingestion_server/Dockerfile, which triggers the API/catalog/Nuxt test suites that are currently failing for unrelated reasons and are required checks — so it can't merge until those are fixed. This PR touches only.pre-commit-config.yaml(thelintchange group), so the heavy suites skip and the repo-wide lint blockage can be resolved immediately. Unlike #5602, it omits thefailure-threshold: warningaddition, which local verification shows is unnecessary at v2.12.0.Testing Instructions
should pass, and the "Lint files" job on this PR should be green — the first green lint run on the repo in months.
🤖 Generated with Claude Code