DEVX-85: feat: add devx-lint-dockerfiles to devx.mak, alias setup-image

AGENTS.md

@@ -428,6 +428,7 @@ projects.
 | `devx-pre-push` | Run lint + tests before push |
 | `devx-clean` | Remove caches, build artifacts, coverage data |
 | `devx-setup-image` | Link /opt/venv + install project (for pre-built image CI jobs) |
+| `devx-lint-dockerfiles` | Lint Dockerfiles with hadolint (fail-fast, parameterized by `DEVX_DOCKERFILE_PATHS`) |
 | `devx-build-images` | Build Docker images from manifest (no push) |
 | `devx-push-images` | Build and push Docker images to Gitea registry |
 | `devx-build-images-dry-run` | Show what would be built/pushed |
@@ -441,6 +442,7 @@ projects.
 - `DEVX_COV_PKG` — coverage package (default: `src/devx`)
 - `DEVX_TEST_PATHS` — pytest paths (default: `tests/`)
 - `DEVX_PR_BASE` — PR base branch (default: `master`)
+- `DEVX_DOCKERFILE_PATHS` — directory to search for Dockerfiles (default: `docker`)
 - `DEVX_GITEA_REGISTRY` — registry URL (default: `git.oblachno.oblachno.fyi`)
 - `DEVX_IMAGE_MANIFEST` — path to JSON manifest (default: `docker/images.json`)
 - `DEVX_IMAGE_OWNER` — package owner for cleanup (default: `oblachno-oss`)

Makefile

@@ -31,6 +31,9 @@ setup-release: $(VENV)/bin/activate .env
 	$(BIN)/python -m devx.tools.setup --bin "$(BIN)" --extras "ci,lint,release" --no-pre-commit
 
 # Setup for pre-built image jobs (deps already in image, just link venv + install project)
+# Note: Not aliased to devx-setup-image because devx's own CI images may have
+# an older devx.mak that doesn't yet define devx-setup-image. Consumer repos
+# (grm, infra) can safely alias to devx-setup-image since they install devx from PyPI.
 setup-image:
 	@if [ -d /opt/venv ]; then ln -sf /opt/venv .venv; . .venv/bin/activate && pip install -e . --no-deps 2>/dev/null; \
 	else echo "[setup-image] /opt/venv not found — falling back to setup-ci"; $(MAKE) setup-ci; fi
@@ -99,6 +102,8 @@ git-push: devx-push
 lint-all: lint workflow-lint lint-dockerfiles
 	@echo "[lint-all] All linting checks passed."
 
+# Note: Not aliased to devx-lint-dockerfiles for the same reason as setup-image —
+# devx's own CI images may have an older devx.mak. Consumer repos can safely alias.
 lint-dockerfiles:
 	@echo "[lint-dockerfiles] Linting Dockerfiles with hadolint..."
 	@if ! command -v hadolint >/dev/null 2>&1; then \

src/devx/make/devx.mak

@@ -51,6 +51,7 @@ DEVX_GITEA_PYPI_HOST ?= git.oblachno.oblachno.fyi
 DEVX_GITEA_PYPI_ORG ?= oblachno-oss
 DEVX_ACTIONLINT_CFG ?= .gitea/actionlint.yaml
 DEVX_WORKFLOW_DIR ?= .gitea/workflows
+DEVX_DOCKERFILE_PATHS ?= docker
 
 # PIP_INSTALL — helper to run pip with Gitea private PyPI registry configured.
 # Usage: $(DEVX_PIP_INSTALL) install -e '.[ci,lint]'
@@ -69,7 +70,7 @@ DEVX_PIP_INSTALL := if [ -z "$$CI_GITEA_TOKEN" ]; then . ./.env 2>/dev/null; fi;
 .PHONY: devx-clean devx-pre-push
 .PHONY: devx-check-mutable-globals devx-check-dep-docs devx-check-test-coverage devx-check-docs devx-check-test-speed
 .PHONY: devx-test-unit devx-pytest-cov
-.PHONY: devx-setup-image
+.PHONY: devx-setup-image devx-lint-dockerfiles
 
 # ── Vikunja task and PR management ────────────────────────────────────────────
 
@@ -251,6 +252,25 @@ devx-clean:
 	@find . -type f -name "*.pyc" -delete 2>/dev/null || true
 	@rm -rf .coverage htmlcov/ dist/ build/ *.egg-info/ .molecule/ 2>/dev/null || true
 
+# ── Dockerfile linting ────────────────────────────────────────────────────────
+#
+# Lint Dockerfiles with hadolint. Fails fast if hadolint is not installed
+# (no silent skip). Set DEVX_DOCKERFILE_PATHS to the directory containing
+# your Dockerfiles (default: docker).
+#
+# Usage:
+#   make devx-lint-dockerfiles                          (lints docker/ directory)
+#   make devx-lint-dockerfiles DEVX_DOCKERFILE_PATHS=ansible  (lints ansible/)
+
+devx-lint-dockerfiles:
+	@echo "[devx-lint-dockerfiles] Linting Dockerfiles with hadolint..."
+	@if ! command -v hadolint >/dev/null 2>&1; then \
+		echo "[devx-lint-dockerfiles] ERROR: hadolint not found. Install from https://github.com/hadolint/hadolint/releases" >&2; \
+		exit 1; \
+	fi
+	@find $(DEVX_DOCKERFILE_PATHS) -name 'Dockerfile*' -exec hadolint {} +
+	@echo "[devx-lint-dockerfiles] All Dockerfiles passed."
+
 # ── Pre-built image setup ─────────────────────────────────────────────────────
 #
 # When running inside a pre-built Docker runner image (ci-base, ci-quality,