From 8862ea463905a80562d525eace451ede2f83a60c Mon Sep 17 00:00:00 2001
From: emil <emil.simeonov@tutanota.com>
Date: Sat, 27 Jun 2026 07:19:31 +0000
Subject: [PATCH] DEVX-72: ci: add hadolint Dockerfile linter to CI

---
 .hadolint.yaml               | 14 ++++++++++++++
 Makefile                     | 13 +++++++++++--
 docker/ci-full/Dockerfile    |  2 ++
 docker/ci-quality/Dockerfile |  5 +++++
 4 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 .hadolint.yaml

diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000..0a8c8fc
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,14 @@
+# Hadolint configuration for devx Dockerfiles
+# https://github.com/hadolint/hadolint#configure
+
+ignored:
+  - DL3008  # Don't require pinning apt package versions
+  - DL3013  # Don't require pinning pip package versions
+  - DL3018  # Don't require pinning apk package versions
+  - DL3007  # Using latest is intentional for tier images (rebuilt on every merge)
+  - SC2102  # False positive: pip extras [release,molecule,deploy] look like shell ranges
+
+trustedRegistries:
+  - git.oblachno.oblachno.fyi
+  - docker.io
+  - gitea/runner-images
diff --git a/Makefile b/Makefile
index 0fb7648..4db2e18 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all setup setup-ci setup-quality setup-release setup-image install update lint lint-all test test-unit pytest-cov clean install-tools install-hooks activate-scripts checkmake check-mutable-globals check-dep-docs check-test-speed build-images push-images build-images-dry-run clean-images
+.PHONY: all setup setup-ci setup-quality setup-release setup-image install update lint lint-all lint-dockerfiles test test-unit pytest-cov clean install-tools install-hooks activate-scripts checkmake check-mutable-globals check-dep-docs check-test-speed build-images push-images build-images-dry-run clean-images
 
 PYTHON := python3
 VENV := .venv
@@ -96,9 +96,18 @@ create-pr: devx-create-pr
 push-with-pr: devx-push-with-pr
 git-push: devx-push
 
-lint-all: lint workflow-lint
+lint-all: lint workflow-lint lint-dockerfiles
 	@echo "[lint-all] All linting checks passed."
 
+lint-dockerfiles:
+	@echo "[lint-dockerfiles] Linting Dockerfiles with hadolint..."
+	@if command -v hadolint >/dev/null 2>&1; then \
+		find docker -name 'Dockerfile*' -exec hadolint {} +; \
+		echo "[lint-dockerfiles] All Dockerfiles passed."; \
+	else \
+		echo "[lint-dockerfiles] hadolint not found — skipping (install with: pip install hadolint or download from GitHub)"; \
+	fi
+
 test-unit: devx-test-unit
 
 pytest-cov: devx-pytest-cov
diff --git a/docker/ci-full/Dockerfile b/docker/ci-full/Dockerfile
index 90b4ee3..c2eae0d 100644
--- a/docker/ci-full/Dockerfile
+++ b/docker/ci-full/Dockerfile
@@ -9,6 +9,8 @@
 
 FROM git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-quality:latest
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 # Install devx[release,molecule,deploy] from local source
 COPY . /tmp/devx
 RUN pip install --no-cache-dir /tmp/devx[release,molecule,deploy] \
diff --git a/docker/ci-quality/Dockerfile b/docker/ci-quality/Dockerfile
index 9d97a96..60dfe0c 100644
--- a/docker/ci-quality/Dockerfile
+++ b/docker/ci-quality/Dockerfile
@@ -15,3 +15,8 @@ RUN pip install --no-cache-dir /tmp/devx[lint] \
 # Install CI/CD binary tools
 RUN python3 -m devx.tools.install_tools --tool actionlint \
     && python3 -m devx.tools.install_checkmake
+
+# Install hadolint (Dockerfile linter)
+RUN curl -fsSL "https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64" \
+    -o /usr/local/bin/hadolint \
+    && chmod +x /usr/local/bin/hadolint