dockerlint

    MoonBit 构建输入与阶段影响分析

    Download zip
    Version
    0.12.0
    License
    MIT AND BSD-3-Clause
    Last updated
    last month
    Downloads
    31

    No dependencies

    #可执行 API 示例

    增加一站式解析检查与规则忽略 API,修复非法 UTF-16 崩溃。这些例子调用公开 API,并随 moon test 执行。

    ///|
    test "explicit code suppression preserves parse errors" {
    let src = "FROM ubuntu\nRUN apt-get install curl\n"
    let ds = @dockerlint.check(src)
    assert_true(!ds.is_empty())
    let ignored = ds.map(d => d.code)
    assert_eq(@dockerlint.check(src, ignore_codes=ignored), [])
    assert_true(
    try {
    ignore(@dockerlint.check("RUN [", ignore_codes=ignored))
    false
    } catch {
    _ => true
    },
    )
    }

    限制:规则数量和 shell 分析远少于 hadolint,未提供完整 Dockerfile 语义。

    ParseError

    pub suberror ParseError {
    Invalid(String)
    StageCycle(Int)
    } derive(
    Debug
    )

    Arguments

    pub struct Arguments {
    flags : Map[String, String]
    values : Array[String]
    json_form : Bool
    } derive(Eq, ToJson,
    Debug
    )

    Arguments::equal

    fn Arguments::equal(Arguments, Arguments) -> Bool

    Arguments::not_equal

    fn Arguments::not_equal(x : Arguments, y : Arguments) -> Bool

    Arguments::to_json

    fn Arguments::to_json(Arguments) -> Json

    BuildComparison

    pub struct BuildComparison {
    before : BuildImpact
    after : BuildImpact
    affected_targets : Array[String]
    conservative : Bool
    reason : String
    } derive(Eq, ToJson,
    Debug
    )

    BuildComparison::equal

    BuildComparison::not_equal

    fn BuildComparison::not_equal(x : BuildComparison, y : BuildComparison) -> Bool

    BuildComparison::to_json

    BuildEdge

    pub struct BuildEdge {
    consumer : Int
    dependency : Int
    line : Int
    kind : String
    } derive(Eq, ToJson,
    Debug
    )

    BuildEdge::equal

    fn BuildEdge::equal(BuildEdge, BuildEdge) -> Bool

    BuildEdge::not_equal

    fn BuildEdge::not_equal(x : BuildEdge, y : BuildEdge) -> Bool

    BuildEdge::to_json

    fn BuildEdge::to_json(BuildEdge) -> Json

    BuildImpact

    pub struct BuildImpact {
    stages : Array[Stage]
    edges : Array[BuildEdge]
    selected : Int
    required : Array[Int]
    changed_stages : Array[Int]
    targets : Array[TargetImpact]
    conservative : Bool
    uncertainties : Array[BuildUncertainty]
    } derive(Eq, ToJson,
    Debug
    )

    BuildImpact::equal

    fn BuildImpact::equal(BuildImpact, BuildImpact) -> Bool

    BuildImpact::not_equal

    fn BuildImpact::not_equal(x : BuildImpact, y : BuildImpact) -> Bool

    BuildImpact::to_json

    fn BuildImpact::to_json(BuildImpact) -> Json

    BuildUncertainty

    pub struct BuildUncertainty {
    line : Int
    reason : String
    } derive(Eq, ToJson,
    Debug
    )

    BuildUncertainty::equal

    BuildUncertainty::not_equal

    fn BuildUncertainty::not_equal(x : BuildUncertainty, y : BuildUncertainty) -> Bool

    BuildUncertainty::to_json

    ContextChange

    pub(all) struct ContextChange {
    path : String
    excluded : Bool
    } derive(Eq, ToJson,
    Debug
    ,
    FromJson
    )

    ContextChange::equal

    ContextChange::not_equal

    fn ContextChange::not_equal(x : ContextChange, y : ContextChange) -> Bool

    ContextChange::to_json

    ContextEntry

    pub(all) struct ContextEntry {
    path : String
    kind : String
    excluded : Bool
    } derive(Eq, ToJson,
    Debug
    ,
    FromJson
    )

    A host-supplied inventory AFTER selecting the correct Docker ignore file. Canonical relative slash paths; kinds: file, directory, symlink.

    ContextEntry::equal

    ContextEntry::not_equal

    fn ContextEntry::not_equal(x : ContextEntry, y : ContextEntry) -> Bool

    ContextEntry::to_json

    ContextFileImpact

    pub struct ContextFileImpact {
    path : String
    excluded : Bool
    source_lines : Array[Int]
    conservative : Bool
    targets : Array[TargetImpact]
    } derive(Eq, ToJson,
    Debug
    )

    ContextFileImpact::equal

    ContextFileImpact::not_equal

    fn ContextFileImpact::not_equal(x : ContextFileImpact, y : ContextFileImpact) -> Bool

    ContextFileImpact::to_json

    ContextInput

    pub struct ContextInput {
    stage : Int
    line : Int
    kind : String
    source : String
    included : Array[Int]
    excluded : Array[Int]
    status : String
    note : String
    } derive(Eq, ToJson,
    Debug
    )

    Indices refer to ContextPlan.entries. Unknown means no completeness assertion.

    ContextInput::equal

    ContextInput::not_equal

    fn ContextInput::not_equal(x : ContextInput, y : ContextInput) -> Bool

    ContextInput::to_json

    ContextPlan

    pub struct ContextPlan {
    graph : BuildImpact
    entries : Array[ContextEntry]
    inputs : Array[ContextInput]
    selected_entries : Array[Int]
    missing_lines : Array[Int]
    uncertainties : Array[BuildUncertainty]
    changes : Array[ContextFileImpact]
    image_metadata : Array[ImageContextMetadataEvidence]
    } derive(Eq, ToJson,
    Debug
    )

    ContextPlan::equal

    fn ContextPlan::equal(ContextPlan, ContextPlan) -> Bool

    ContextPlan::not_equal

    fn ContextPlan::not_equal(x : ContextPlan, y : ContextPlan) -> Bool

    ContextPlan::to_json

    fn ContextPlan::to_json(ContextPlan) -> Json

    Diagnostic

    pub struct Diagnostic {
    line : Int
    code : String
    message : String
    } derive(Eq, ToJson,
    Debug
    )

    Diagnostic::equal

    fn Diagnostic::equal(Diagnostic, Diagnostic) -> Bool

    Diagnostic::not_equal

    fn Diagnostic::not_equal(x : Diagnostic, y : Diagnostic) -> Bool

    Diagnostic::severity

    fn Diagnostic::severity(self : Diagnostic) -> String

    Diagnostic::to_json

    fn Diagnostic::to_json(Diagnostic) -> Json

    Expansion

    pub struct Expansion {
    value : String
    unresolved : Array[String]
    } derive(Eq, ToJson,
    Debug
    )

    Expansion::equal

    fn Expansion::equal(Expansion, Expansion) -> Bool

    Expansion::not_equal

    fn Expansion::not_equal(x : Expansion, y : Expansion) -> Bool

    Expansion::to_json

    fn Expansion::to_json(Expansion) -> Json

    HereDoc

    pub struct HereDoc {
    name : String
    content : String
    strip_tabs : Bool
    expand : Bool
    } derive(Eq, ToJson,
    Debug
    )

    HereDoc::equal

    fn HereDoc::equal(HereDoc, HereDoc) -> Bool

    HereDoc::not_equal

    fn HereDoc::not_equal(x : HereDoc, y : HereDoc) -> Bool

    HereDoc::to_json

    fn HereDoc::to_json(HereDoc) -> Json

    HereDoc::to_repr

    ImageContextMetadata

    pub(all) struct ImageContextMetadata {
    reference : String
    platform : String
    index_digest : String
    manifest_digest : String
    config_digest : String
    onbuild : Array[String]
    } derive(Eq, ToJson,
    Debug
    ,
    FromJson
    )

    Host-verified OCI image configuration metadata for one pinned FROM image. The host must verify the index -> platform manifest -> config byte digests. The core intentionally consumes only identity, platform and ONBUILD data; base-image ENV remains unknown.

    ImageContextMetadata::equal

    ImageContextMetadata::not_equal

    ImageContextMetadata::to_json

    ImageContextMetadataEvidence

    pub(all) struct ImageContextMetadataEvidence {
    stage : Int
    line : Int
    reference : String
    platform : String
    status : String
    reason : String
    index_digest : String
    manifest_digest : String
    config_digest : String
    } derive(Eq, ToJson,
    Debug
    )

    Explains whether a matching image profile suppressed ONBUILD uncertainty.

    ImageContextMetadataEvidence::not_equal

    ImageContextMetadataEvidence::to_json

    Instruction

    pub struct Instruction {
    line : Int
    end_line : Int
    name : String
    arguments : String
    heredocs : Array[HereDoc]
    } derive(Eq, ToJson,
    Debug
    )

    Instruction::equal

    fn Instruction::equal(Instruction, Instruction) -> Bool

    Instruction::not_equal

    fn Instruction::not_equal(x : Instruction, y : Instruction) -> Bool

    Instruction::split_arguments

    fn Instruction::split_arguments(self : Instruction) -> Arguments raise ParseError

    Leading --key=value flags, then JSON strings or quoted shell-form arguments.

    Instruction::to_json

    fn Instruction::to_json(Instruction) -> Json

    ShellToken

    pub struct ShellToken {
    kind : String
    value : String
    raw : String
    line : Int
    quoted : Bool
    dynamic : Bool
    } derive(Eq, ToJson,
    Debug
    )

    ShellToken::equal

    fn ShellToken::equal(ShellToken, ShellToken) -> Bool

    ShellToken::not_equal

    fn ShellToken::not_equal(x : ShellToken, y : ShellToken) -> Bool

    ShellToken::to_json

    fn ShellToken::to_json(ShellToken) -> Json

    SourceComparison

    pub struct SourceComparison {
    before_lines : Array[Int]
    after_lines : Array[Int]
    diff_exact : Bool
    diff_reason : String
    impact : BuildComparison
    } derive(Eq, ToJson,
    Debug
    )

    Automatically selected physical lines and the two-graph impact report. Exact bounded LCS selection keeps separate edits in their own coordinates. Ambiguous or over-budget selection falls back to the full differing span; diff_exact and diff_reason make that loss of precision explicit.

    SourceComparison::equal

    SourceComparison::not_equal

    fn SourceComparison::not_equal(x : SourceComparison, y : SourceComparison) -> Bool

    SourceComparison::to_json

    Stage

    pub struct Stage {
    index : Int
    line : Int
    base : String
    stage_name : String?
    dependencies : Array[Int]
    } derive(Eq, ToJson,
    Debug
    )

    Stage::equal

    fn Stage::equal(Stage, Stage) -> Bool

    Stage::not_equal

    fn Stage::not_equal(x : Stage, y : Stage) -> Bool

    Stage::to_json

    fn Stage::to_json(Stage) -> Json

    Stage::to_repr

    TargetImpact

    pub struct TargetImpact {
    target : Int
    affected : Bool
    path : Array[Int]
    } derive(Eq, ToJson,
    Debug
    )

    TargetImpact::equal

    TargetImpact::not_equal

    fn TargetImpact::not_equal(x : TargetImpact, y : TargetImpact) -> Bool

    TargetImpact::to_json

    VariableScope

    pub struct VariableScope {
    line : Int
    stage : Int
    instruction : String
    expanded : String
    arguments : Map[String, String]
    environment : Map[String, String]
    unresolved : Array[String]
    uncertain_arguments : Array[String]
    uncertain_environment : Array[String]
    unknown_base_environment : Bool
    } derive(Eq, ToJson,
    Debug
    )

    VariableScope::equal

    VariableScope::not_equal

    fn VariableScope::not_equal(x : VariableScope, y : VariableScope) -> Bool

    VariableScope::to_json

    analyze_context

    fn analyze_context(source : String, entries : Array[ContextEntry], target? : String, changes? : Array[ContextChange], build_args? : Map[String, String], control_files? : Array[String], platform? : String, image_metadata? : Array[ImageContextMetadata]) -> ContextPlan raise ParseError

    Explain local build inputs and how explicit file changes flow to targets. This is not a Docker build/cache prediction: image metadata, named contexts, shell execution, COPY --exclude and filesystem links may be unknown.

    analyze_stages

    fn analyze_stages(instructions : Array[Instruction]) -> Array[Stage] raise ParseError

    Resolve stage dependencies without fetching images. Unknown COPY names may be external images.

    analyze_variables

    fn analyze_variables(source : String, build_args? : Map[String, String]) -> Array[VariableScope] raise ParseError

    Snapshot after every instruction. Global ARG is only visible in FROM unless redeclared; child stages inherit declared ARG and ENV from their named parent.

    build_impact

    fn build_impact(source : String, target? : String, changed_lines? : Array[Int]) -> BuildImpact raise ParseError

    Local, literal Dockerfile graph only: excludes image metadata, named-context overrides, build-context file changes and cache state. Never a skip-build proof. Changed lines are 1-based in this file. Global/FROM/unmapped lines and unknown dependencies conservatively mark every target; paths explain concrete edges.

    check

    fn check(source : String, ignore_codes? : Array[String], honor_inline? : Bool, trusted_registries? : Array[String]) -> Array[Diagnostic] raise ParseError

    Caller suppression plus hadolint-compatible instruction/global comments.

    compare_build_impact

    fn compare_build_impact(before_source : String, after_source : String, changed_before? : Array[Int], changed_after? : Array[Int]) -> BuildComparison raise ParseError

    Compare two literal graphs using caller-supplied complete diff line sets. Changes must be expressed in each snapshot's own 1-based coordinates. A removed dependency may still affect a target via the old graph. This is not a diff parser or proof that a build/cache entry may safely be skipped.

    compare_build_sources

    fn compare_build_sources(before_source : String, after_source : String) -> SourceComparison raise ParseError

    Compare complete snapshots without requiring caller-provided diff coordinates. The bounded diff is exact only when its LCS alignment is unique; over-budget or ambiguous cases retain the old full-span conservative behavior. Aligned external-image-only FROM edits seed that stage in both graphs, while stage topology changes and unknown references remain conservative.

    configured_report

    fn configured_report(source : String, config : String, filename? : String) -> String raise ParseError

    Strict JSON configuration: ignored codes, inline directives, trusted registries, and severity overrides. No file or environment is consulted by this API.

    copy_source_matches

    fn copy_source_matches(pattern : String, path : String) -> Bool raise ParseError

    Linux COPY wildcard semantics on a single context-relative name. ** has the same meaning as *, not recursive glob. Malformed patterns always raise.

    expand_variables

    fn expand_variables(source : String, values : Map[String, String]) -> Expansion raise ParseError

    Docker-style parameter expansion without evaluating shell commands. Unknown variables are preserved and listed; base-image environments are not fetched.

    lint

    fn lint(instructions : Array[Instruction]) -> Array[Diagnostic]

    parse

    fn parse(source : String) -> Array[Instruction] raise ParseError

    Source-preserving instruction arguments, physical line ranges, escape directives. RUN/COPY heredoc bodies are captured without interpreting their contents.

    report_json

    fn report_json(source : String, filename? : String, honor_inline? : Bool) -> String raise ParseError

    JSON diagnostics with explicit severity and a source filename supplied by the caller.

    shell_tokens

    fn shell_tokens(source : String) -> Array[ShellToken] raise ParseError

    Quote-aware shell lexical structure. Substitutions remain opaque and are never executed; this is not a complete POSIX/Bash grammar or a ShellCheck replacement.

    variable_report

    fn variable_report(source : String, build_args_json? : String) -> String raise ParseError