timothyswan/eslint repository overview

ESLint⁠ is the canonical JavaScript / TypeScript / JSX linter, with the largest plugin ecosystem in the JS world. This image ships ESLint v10 in flat-config mode with a curated security-focused plugin set baked in: eslint-plugin-security (Node Security WG — eval, regex DoS, unsafe randomness, bidi homoglyph attacks), eslint-plugin-no-unsanitized (Mozilla — XSS prevention via DOM API gates), eslint-plugin-promise (async/await correctness), and eslint-plugin-import (ESM resolution, no-self-import). Plus @microsoft/eslint-formatter-sarif for native SARIF output that flows directly into DefectDojo.

The baked default eslint.config.js activates on any consumer repo that doesn't ship its own — security plugins at error level, promise + import at warning. A consumer config (eslint.config.{js,mjs,cjs,ts}) at the repo root always wins; the entrypoint detects and honours it without flag passthrough.

⁠Usage

# Lint with the baked default config (no consumer config required)
podman run --rm -v "$(pwd):/repo:ro,Z" eslint:<version>-rhhi .

# Lint specific files
podman run --rm -v "$(pwd):/repo:ro,Z" eslint:<version>-rhhi src/

# Generate SARIF for re-import into DefectDojo
podman run --rm -v "$(pwd):/repo:ro,Z" -v /tmp:/out:rw,Z \
  eslint:<version>-rhhi \
  --format @microsoft/eslint-formatter-sarif \
  --output-file /out/eslint.sarif \
  src/

# Override the default config by dropping eslint.config.js into the
# consumer's repo root — the entrypoint detects + honours it automatically

⁠Config file (eslint.config.js at repo root)

// Flat-config example with project-specific tweaks layered on
import js from '@eslint/js';

export default [
  js.configs.recommended,
  {
    languageOptions: { ecmaVersion: 'latest', sourceType: 'module' },
    rules: {
      'no-unused-vars': 'warn',
      'no-console': 'off',
      // Add per-project rules here
    },
  },
];

The bundled plugins are reachable from any consumer config via standard import (NODE_PATH points at the image's node_modules/), so consumer configs can extend our defaults rather than rebuild from scratch.

⁠Supply chain

• Base image: registry.access.redhat.com/hi/nodejs:latest (Red Hat Hardened)
• Builder image (fetch-time only): registry.access.redhat.com/hi/nodejs:24.15-builder
• Built from: upstream npm package + 5 plugin packages, each SHA256-pinned at the published .tgz; transitive deps via npm package-lock.json
• Tier: nodejs (multi-package fetch via containerfiles/_template/fetch-npm-tool.sh)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation

⁠Companion

Pairs with stylelint (CSS) — the two together cover both halves of typical web-asset linting and are bundled in the .scan.web.yml consumer wrapper.