DEVX-72: ci: add hadolint Dockerfile linter to CI

.hadolint.yaml

@@ -0,0 +1,14 @@
+# Hadolint configuration for devx Dockerfiles
+# https://github.com/hadolint/hadolint#configure
+
+ignored:
+  - DL3008  # Don't require pinning apt package versions
+  - DL3013  # Don't require pinning pip package versions
+  - DL3018  # Don't require pinning apk package versions
+  - DL3007  # Using latest is intentional for tier images (rebuilt on every merge)
+  - SC2102  # False positive: pip extras [release,molecule,deploy] look like shell ranges
+
+trustedRegistries:
+  - git.oblachno.oblachno.fyi
+  - docker.io
+  - gitea/runner-images

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all setup setup-ci setup-quality setup-release setup-image install update lint lint-all test test-unit pytest-cov clean install-tools install-hooks activate-scripts checkmake check-mutable-globals check-dep-docs check-test-speed build-images push-images build-images-dry-run clean-images
+.PHONY: all setup setup-ci setup-quality setup-release setup-image install update lint lint-all lint-dockerfiles test test-unit pytest-cov clean install-tools install-hooks activate-scripts checkmake check-mutable-globals check-dep-docs check-test-speed build-images push-images build-images-dry-run clean-images
 
 PYTHON := python3
 VENV := .venv
@@ -96,9 +96,18 @@ create-pr: devx-create-pr
 push-with-pr: devx-push-with-pr
 git-push: devx-push
 
-lint-all: lint workflow-lint
+lint-all: lint workflow-lint lint-dockerfiles
 	@echo "[lint-all] All linting checks passed."
 
+lint-dockerfiles:
+	@echo "[lint-dockerfiles] Linting Dockerfiles with hadolint..."
+	@if command -v hadolint >/dev/null 2>&1; then \
+		find docker -name 'Dockerfile*' -exec hadolint {} +; \
+		echo "[lint-dockerfiles] All Dockerfiles passed."; \
+	else \
+		echo "[lint-dockerfiles] hadolint not found — skipping (install with: pip install hadolint or download from GitHub)"; \
+	fi
+
 test-unit: devx-test-unit
 
 pytest-cov: devx-pytest-cov

docker/ci-full/Dockerfile

@@ -9,6 +9,8 @@
 
 FROM git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-quality:latest
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 # Install devx[release,molecule,deploy] from local source
 COPY . /tmp/devx
 RUN pip install --no-cache-dir /tmp/devx[release,molecule,deploy] \

docker/ci-quality/Dockerfile

@@ -15,3 +15,8 @@ RUN pip install --no-cache-dir /tmp/devx[lint] \
 # Install CI/CD binary tools
 RUN python3 -m devx.tools.install_tools --tool actionlint \
     && python3 -m devx.tools.install_checkmake
+
+# Install hadolint (Dockerfile linter)
+RUN curl -fsSL "https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64" \
+    -o /usr/local/bin/hadolint \
+    && chmod +x /usr/local/bin/hadolint