timothyswan/markdownlint-cli2 repository overview

markdownlint-cli2⁠ is DavidAnson's canonical CommonMark + GitHub-Flavored-Markdown linter, the same engine VS Code's official Markdown extension runs. ~50 built-in rules covering heading hierarchy, line length, table formatting, code-fence languages, link syntax, image alt text, list indentation, and more.

This image bundles markdownlint-cli2 with its full transitive dependency tree (resolved at fetch time via containerized npm install --global) and lands on Red Hat Hardened hi/nodejs:latest. The published .tgz is SHA256-verified at fetch; per-dep integrity comes from the npm package-lock.json. Built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

Complements Vale (prose linter) — markdownlint-cli2 catches structural Markdown issues; Vale catches prose issues. Both live in the same documentation-quality layer.

⁠Usage

# Lint all .md files in repo, against per-repo .markdownlint-cli2.jsonc
podman run --rm -v "$(pwd):/repo:ro,Z" markdownlint-cli2:<version>-rhhi '**/*.md'

# Specific files
podman run --rm -v "$(pwd):/repo:ro,Z" markdownlint-cli2:<version>-rhhi 'README.md' 'docs/**/*.md'

# Without writing a config file, override rules inline via env var
podman run --rm -v "$(pwd):/repo:ro,Z" \
  -e MARKDOWNLINT_CLI2_CONFIG='{"config":{"MD013":false}}' \
  markdownlint-cli2:<version>-rhhi '**/*.md'

⁠Config file (.markdownlint-cli2.jsonc at repo root)

{
  "config": {
    "default": true,
    "MD013": { "line_length": 120 },
    "MD024": { "siblings_only": true },
    "MD033": false                          // allow inline HTML
  },
  "ignores": ["CHANGELOG.md", "node_modules/**"]
}

⁠Supply chain

• Base image: registry.access.redhat.com/hi/nodejs:latest (Red Hat Hardened)
• Builder image (fetch-time only): registry.access.redhat.com/hi/nodejs:24.15-builder
• Built from: upstream npm package, SHA256-pinned at the published .tgz; transitive deps via npm package-lock.json
• Tier: nodejs (first Node-based tool in this rebase line — fetch-npm-tool.sh lives under containerfiles/_template/)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation