pirlruc/ci-lint repository overview

⁠ci-lint

Short-lived CI toolchain image that run workflow lint and secrets/SAST: actionlint, hadolint, shellcheck, zizmor, yamllint, gitleaks, and semgrep.

⁠Image

⁠Tags

Alpine owns the unsuffixed tags because it currently has the lower OS vulnerability posture on the DHI catalog. Prefer an explicit -alpine / -debian suffix when the libc matters; prefer a digest in production. latest equals latest-alpine (flavor: latest=false). A monthly rebuild may move latest off the SemVer tag — pin the digest, not latest.

docker pull pirlruc/ci-lint:5.1.1
# or
docker pull pirlruc/ci-lint:5.1.1-debian
docker pull pirlruc/ci-lint@sha256:35a82a43839e0969dc7c44d63c36b5c97cdefb20c6d3112255f52c09444042a1

⁠Quick start

docker run --rm -v "$PWD:/workspace:ro" -w /workspace \
  pirlruc/ci-lint:5.1.1 \
  actionlint .github/workflows/*.yml

Hardened local run (read-only workspace mount):

docker run --rm \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --tmpfs /tmp:rw,noexec,nosuid,size=256m \
  -v "$PWD:/workspace:ro" -w /workspace \
  pirlruc/ci-lint:5.1.1 \
  semgrep scan --config auto --error .

⁠What is inside

Not included: syft, grype, trivy, grant, dive (see ci-supply-chain and ci-container).

⁠Vulnerabilities

Donor Go binaries (notably actionlint) embed stdlib CVEs that only clear when upstream publishes a newer digest. shellcheck and gitleaks on the Alpine variant are copied from the Debian DHI donors (no Alpine DHI build exists; both binaries are statically linked).

⁠License

MIT