Implemented linters in CI#938
Conversation
markshleifer-coralogix
requested review from
a team,
ShauliSolomovich,
avivgold098,
nicolastakashi and
oded-dd
as code owners
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff2973654f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
markshleifer-coralogix
force-pushed
the
chore/cx-45442
branch
3 times, most recently
from
e15c2db to
42ee58d
Compare
markshleifer-coralogix
changed the title
|
|
||
| detect_pkg_type() { | ||
| if [ -r /etc/os-release ]; then | ||
| # shellcheck disable=SC1091 |
There was a problem hiding this comment.
SC1091 is ignored because /etc/os-release exists on the target Linux host at runtime, but shellcheck cannot follow that system file during static analysis.
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Install gitleaks |
There was a problem hiding this comment.
How about adding some script we can run locally to install these tools in our machines and reuse here?
Or maybe use one of the GitHub Actions for Hadolint or Gitleaks.
There was a problem hiding this comment.
As discussed, will do in a separate PR.
markshleifer-coralogix
force-pushed
the
chore/cx-45442
branch
2 times, most recently
from
e4d7ebd to
81f4051
Compare
markshleifer-coralogix
force-pushed
the
chore/cx-45442
branch
3 times, most recently
from
30bdd34 to
56e880c
Compare
markshleifer-coralogix
force-pushed
the
chore/cx-45442
branch
from
56e880c to
26841b0
Compare
4 participants
Description
Most of the added lines (around 97%) are Helm golden render snapshots.
Add CI coverage for security and hygiene checks:
Some
shellcheck/hadolintignores were added where changing the code would be riskier than documenting the existing baseline. Examples include preserving existing Docker label keys that may be externally consumed, keeping established package-install commands unchanged, and avoiding behavior changes in installer/runtime scripts where lint-only rewrites could affect execution.How Has This Been Tested?
Deliberately added or changed files to force each new CI job to fail:
gitleaksshellcheckhadolintConfirmed the jobs failed for the expected reasons, then reverted the failure fixtures.
Re-ran the checks and verified the scripts/jobs passed again.
Built the changed Linux Dockerfiles with Docker where possible; the buildable images passed. Windows Dockerfiles were not built locally because macOS Docker Desktop cannot build Windows container images.
Checklist: