From 2a8cdc90b9ac7c4e76525ef14b3aba0dede6949b Mon Sep 17 00:00:00 2001 From: Bret Fisher Date: Mon, 13 Apr 2026 22:34:23 -0400 Subject: [PATCH] fixing lints (#97) --- .github/linters/.checkov.yaml | 3 ++ .github/linters/.hadolint.yaml | 2 +- .github/linters/.yaml-lint.yml | 2 +- .github/super-linter.env | 15 ++++++++ .github/workflows/call-docker-build.yaml | 29 +++++++------- .github/workflows/call-super-linter.yaml | 1 - README.md | 48 ++++++------------------ docker-compose.yml | 2 +- docker-entrypoint.sh | 20 +++++----- 9 files changed, 56 insertions(+), 66 deletions(-) create mode 100644 .github/linters/.checkov.yaml create mode 100644 .github/super-linter.env diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml new file mode 100644 index 0000000..26dc84c --- /dev/null +++ b/.github/linters/.checkov.yaml @@ -0,0 +1,3 @@ +skip-check: + - CKV_DOCKER_2 + - CKV_DOCKER_3 diff --git a/.github/linters/.hadolint.yaml b/.github/linters/.hadolint.yaml index 3304399..5dbce0a 100644 --- a/.github/linters/.hadolint.yaml +++ b/.github/linters/.hadolint.yaml @@ -40,4 +40,4 @@ ignored: # style: [string] # list of rules # strict-labels: boolean # true | false # disable-ignore-pragma: boolean # true | false -# trustedRegistries: string | [string] # registry or list of registries \ No newline at end of file +# trustedRegistries: string | [string] # registry or list of registries diff --git a/.github/linters/.yaml-lint.yml b/.github/linters/.yaml-lint.yml index 030c37f..76a6b4e 100644 --- a/.github/linters/.yaml-lint.yml +++ b/.github/linters/.yaml-lint.yml @@ -50,4 +50,4 @@ rules: new-line-at-end-of-file: disable new-lines: type: unix - trailing-spaces: disable \ No newline at end of file + trailing-spaces: disable diff --git a/.github/super-linter.env b/.github/super-linter.env new file mode 100644 index 0000000..58044df --- /dev/null +++ b/.github/super-linter.env @@ -0,0 +1,15 @@ +VALIDATE_BIOME_FORMAT=true +VALIDATE_BIOME_LINT=true +VALIDATE_CHECKOV=true +VALIDATE_GITHUB_ACTIONS=true +VALIDATE_GITHUB_ACTIONS_ZIZMOR=true +VALIDATE_GITLEAKS=true +VALIDATE_GIT_MERGE_CONFLICT_MARKERS=true +VALIDATE_MARKDOWN=true +VALIDATE_MARKDOWN_PRETTIER=true +VALIDATE_NATURAL_LANGUAGE=true +VALIDATE_PRE_COMMIT=true +VALIDATE_SPELL_CODESPELL=true +VALIDATE_YAML=true +VALIDATE_YAML_PRETTIER=true + diff --git a/.github/workflows/call-docker-build.yaml b/.github/workflows/call-docker-build.yaml index 0859020..5a9bc22 100644 --- a/.github/workflows/call-docker-build.yaml +++ b/.github/workflows/call-docker-build.yaml @@ -4,16 +4,16 @@ name: Docker Build on: push: branches: - - 'main' + - "main" paths: - - 'Dockerfile' - - '.github/workflows/call-docker-build.yaml' - - 'docker-entrypoint.sh' + - "Dockerfile" + - ".github/workflows/call-docker-build.yaml" + - "docker-entrypoint.sh" pull_request: paths: - - 'Dockerfile' - - '.github/workflows/call-docker-build.yaml' - - 'docker-entrypoint.sh' + - "Dockerfile" + - ".github/workflows/call-docker-build.yaml" + - "docker-entrypoint.sh" # cancel any previously-started, yet still active runs of this workflow on the same branch concurrency: @@ -25,14 +25,13 @@ concurrency: permissions: {} jobs: - build-jekyll-image: - # use Reusable Workflows # https://docs.github.com/en/actions/learn-github-actions/reusing-workflows name: Call Docker Build Jekyll - uses: bretfisher/docker-build-workflow/.github/workflows/reusable-docker-build.yaml@main + # NOTE: zizmor scanner rule ignore added because we control sha pins via reusable workflow, not calling workflow + uses: bretfisher/docker-build-workflow/.github/workflows/reusable-docker-build.yaml@main # zizmor: ignore[unpinned-uses] # set permissions here to be equal or greater than what's required in the Reusable Workflow # Permissions set here for the GITHUB_TOKEN are then passed to the Reusable Workflow @@ -42,9 +41,8 @@ jobs: contents: read packages: write # needed to push docker image to ghcr.io pull-requests: write # needed to create and update comments in PRs - - secrets: + secrets: dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }} @@ -58,12 +56,12 @@ jobs: target: jekyll build-jekyll-serve-image: - # use Reusable Workflows # https://docs.github.com/en/actions/learn-github-actions/reusing-workflows name: Call Docker Build Jekyll-Serve - uses: bretfisher/docker-build-workflow/.github/workflows/reusable-docker-build.yaml@main + # NOTE: zizmor scanner rule ignore added because we control sha pins via reusable workflow, not calling workflow + uses: bretfisher/docker-build-workflow/.github/workflows/reusable-docker-build.yaml@main # zizmor: ignore[unpinned-uses] needs: build-jekyll-image @@ -73,9 +71,8 @@ jobs: contents: read packages: write # needed to push docker image to ghcr.io pull-requests: write # needed to create and update comments in PRs - - secrets: + secrets: dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }} dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/call-super-linter.yaml b/.github/workflows/call-super-linter.yaml index c349411..7ae08c3 100644 --- a/.github/workflows/call-super-linter.yaml +++ b/.github/workflows/call-super-linter.yaml @@ -32,7 +32,6 @@ jobs: ### https://docs.github.com/en/actions/learn-github-actions/reusing-workflows ### you can also call workflows from inside the same repository via file path - # FIXME: customize uri to point to your own reusable linter repository # NOTE: zizmor scanner rule ignore added because we control sha pins via reusable workflow, not calling workflow uses: bretfisher/super-linter-workflow/.github/workflows/reusable-super-linter.yaml@main # zizmor: ignore[unpinned-uses] diff --git a/README.md b/README.md index b7ee930..ca6f56b 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ > But this has been done. Why not `docker run jekyll/jekyll`? - I wanted two images, one for easy CLI (`bretfisher/jekyll`) and one for -easy local server for dev with sane defaults (`bretfisher/jekyll-serve`), which I use 90% of the time + easy local server for dev with sane defaults (`bretfisher/jekyll-serve`), which I use 90% of the time - So you can start any Jekyll server with `docker-compose up` - I wanted to dev on a local Jekyll site without having Jekyll installed on my host OS - I wanted it to be as easy as possible to start @@ -20,16 +20,16 @@ Note [I have courses on Docker (including a Lecture on Jekyll in Docker)](https: :warning: WARNING: :warning: This isn't meant to be a production image that you run a web server with. I don't do that with the Jekyll CLI that comes with this image. Jekyll CLI generates -a static site that you can run with GitHub Pages, Netlify, or your own NGINX setup. Furthermore, I don't version +a static site that you can run with GitHub Pages, Netlify, or your own NGINX setup. Furthermore, I don't version anything so these images will not run guaranteed versions of Ruby, Jekyll, etc. (which, if you're running a server, should pin all versions usually.) ## Docker Images -| Image | Purpose | Example | -| ----- | ------- | ------- | -| [bretfisher/jekyll](https://hub.docker.com/r/bretfisher/jekyll/) | Runs Jekyll by default with no options, good for general CLI commands | `docker run -v $(pwd):/site bretfisher/jekyll new .` | -| [bretfisher/jekyll-serve](https://hub.docker.com/r/bretfisher/jekyll-serve/) | Runs Jekyll serve with sane defaults, good for local Jekyll site dev | `docker run -p 4000:4000 -v $(pwd):/site bretfisher/jekyll-serve` | +| Image | Purpose | Example | +| ---------------------------------------------------------------------------- | --------------------------------------------------------------------- | ----------------------------------------------------------------- | +| [bretfisher/jekyll](https://hub.docker.com/r/bretfisher/jekyll/) | Runs Jekyll by default with no options, good for general CLI commands | `docker run -v $(pwd):/site bretfisher/jekyll new .` | +| [bretfisher/jekyll-serve](https://hub.docker.com/r/bretfisher/jekyll-serve/) | Runs Jekyll serve with sane defaults, good for local Jekyll site dev | `docker run -p 4000:4000 -v $(pwd):/site bretfisher/jekyll-serve` | ## Getting Started @@ -64,13 +64,13 @@ docker-compose up ## Known issues 1. `arm/v7` version (aka `armhf`) doesn't exist in this repository. - - Yes, `arm/v7` has become too difficult to support. + - Yes, `arm/v7` has become too difficult to support. 2. `alpine` version doesn't exist in this repository. - - Yes, not all Jekyll dependencies are built with `musl` support, so `glibc`-based images are now the only option (Debian, Ubuntu, etc). + - Yes, not all Jekyll dependencies are built with `musl` support, so `glibc`-based images are now the only option (Debian, Ubuntu, etc). 3. RESOLVED as of Jekyll 4.3 - ~~`webrick` errors during startup.~~ - - ~~As of April 2021, Ruby 3.0 is out, and Jekyll is still on 4.2 (released 12/2020). Jekyll 4.2 doesn't have `webrick` listed as a dependency, so we'll have to manually add it to Gemfile for now if you want to use Ruby 3.0.~~ - ~~Ruby 3.0 removed this bundled gems so you'll need to add them manually if you use them: `sdbm`, `webrick`, `net-telnet`, `xmlrpc`. Hopefully Jekyll 4.3 will have `webrick` listed as a Jekyll dependency (it is fixed in Jekyll master branch) so manually updating Gemfiles won't be needed.~~ + ~~`webrick` errors during startup.~~ + - ~~As of April 2021, Ruby 3.0 is out, and Jekyll is still on 4.2 (released 12/2020). Jekyll 4.2 doesn't have `webrick` listed as a dependency, so we'll have to manually add it to Gemfile for now if you want to use Ruby 3.0.~~ + ~~Ruby 3.0 removed this bundled gems so you'll need to add them manually if you use them: `sdbm`, `webrick`, `net-telnet`, `xmlrpc`. Hopefully Jekyll 4.3 will have `webrick` listed as a Jekyll dependency (it is fixed in Jekyll master branch) so manually updating Gemfiles won't be needed.~~ ## Q&A @@ -99,28 +99,4 @@ bundle exec jekyll build Then your bind-mounted `_site` will be there on your host, built by Jekyll using your Gemfile Jekyll dependencies that were installed in that container. -If this is something you do often, you'll want to build your *own* image that already has your Ruby dependencies installed. Then when you run the `jekyll build` command, it'll have all the Gemfile dependencies it needs. - -## License - -MIT License - -Copyright (c) [Bret Fisher bret@bretfisher.com] - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. +If this is something you do often, you'll want to build your _own_ image that already has your Ruby dependencies installed. Then when you run the `jekyll build` command, it'll have all the Gemfile dependencies it needs. diff --git a/docker-compose.yml b/docker-compose.yml index f508386..97aafbf 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -6,4 +6,4 @@ services: volumes: - .:/site ports: - - '4000:4000' + - "4000:4000" diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh index 604a5e2..9303fc3 100755 --- a/docker-entrypoint.sh +++ b/docker-entrypoint.sh @@ -2,16 +2,16 @@ set -e if [ ! -f Gemfile ]; then - echo "NOTE: hmm, I don't see a Gemfile so I don't think there's a jekyll site here" - echo "Either you didn't mount a volume, or you mounted it incorrectly." - echo "Be sure you're in your jekyll site root and use something like this to launch" - echo "" - echo "docker run -p 4000:4000 -v \$(pwd):/site bretfisher/jekyll-serve" - echo "" - echo "NOTE: To create a new site, you can use the sister image bretfisher/jekyll like:" - echo "" - echo "docker run -v \$(pwd):/site bretfisher/jekyll new ." - exit 1 + echo "NOTE: hmm, I don't see a Gemfile so I don't think there's a jekyll site here" + echo "Either you didn't mount a volume, or you mounted it incorrectly." + echo "Be sure you're in your jekyll site root and use something like this to launch" + echo "" + echo "docker run -p 4000:4000 -v \$(pwd):/site bretfisher/jekyll-serve" + echo "" + echo "NOTE: To create a new site, you can use the sister image bretfisher/jekyll like:" + echo "" + echo "docker run -v \$(pwd):/site bretfisher/jekyll new ." + exit 1 fi bundle install --retry 5 --jobs 20