hadolint.yml

name: Hadolint

on:
  workflow_call:
    inputs:
      dockerfile:
        required: true
        type: string

jobs:
  hadolint:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4.2.2

      - name: Validate ${{ inputs.dockerfile }}
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ${{ inputs.dockerfile }}
          no-fail: true
          verbose: true
          format: sarif
          output-file: ${{ inputs.dockerfile }}.sarif

      - name: Upload Hadolint results of ${{ inputs.dockerfile }}
        uses: github/codeql-action/upload-sarif@v3.28.8
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: ${{ inputs.dockerfile }}.sarif
          # Optional category for the results
          # Used to differentiate multiple results for one commit
          category: hadolint-${{ inputs.dockerfile }}-validation