timothyswan/stylelint repository overview

Stylelint⁠ is the canonical CSS linter with the largest rule corpus in the CSS world. This image ships Stylelint v17 with the stylelint-config-standard baseline (~150 rules covering syntax, formatting, best practices) plus three plugins: stylelint-no-unsupported-browser-features (browserslist-driven compat warnings), stylelint-order (property ordering), and stylelint-sarif-formatter for native SARIF output that flows directly into DefectDojo.

The baked default stylelint.config.js activates on any consumer repo that doesn't ship its own — standard config at default severities, browser-features plugin at warning, ordering off-by-default (re-enable in consumer config). A consumer config (.stylelintrc.* or stylelint.config.*) at the repo root always wins; the entrypoint detects and honours it without flag passthrough.

The default browserslist target (last 2 Chrome/Firefox/Edge, Safari ≥ 15) is overridable via a repo-root .browserslistrc or the browserslist key in package.json — Stylelint picks both up automatically.

⁠Usage

# Lint all CSS in repo with the baked default
podman run --rm -v "$(pwd):/repo:ro,Z" stylelint:<version>-rhhi '**/*.css'

# SCSS / LESS via custom syntax (consumer config required for parser)
podman run --rm -v "$(pwd):/repo:ro,Z" stylelint:<version>-rhhi '**/*.scss'

# SARIF output for DefectDojo re-import
podman run --rm -v "$(pwd):/repo:ro,Z" \
  stylelint:<version>-rhhi \
  --custom-formatter=stylelint-sarif-formatter \
  '**/*.css' > /tmp/stylelint.sarif

⁠Config file (.stylelintrc.json or stylelint.config.js at repo root)

// .stylelintrc.json
{
  "extends": ["stylelint-config-standard"],
  "rules": {
    "color-hex-length": "long",
    "selector-class-pattern": null,
    "alpha-value-notation": "number"
  }
}

The bundled plugins/configs are reachable from any consumer config via standard extends: / plugins: (NODE_PATH points at the image's node_modules/), so consumer configs can extend our defaults rather than rebuild from scratch.

⁠Supply chain

• Base image: registry.access.redhat.com/hi/nodejs:latest (Red Hat Hardened)
• Builder image (fetch-time only): registry.access.redhat.com/hi/nodejs:24.15-builder
• Built from: upstream npm package + 4 plugin/config packages, each SHA256-pinned at the published .tgz
• Tier: nodejs (multi-package fetch via containerfiles/_template/fetch-npm-tool.sh)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation

⁠Companion

Pairs with eslint (JavaScript) — the two together cover both halves of typical web-asset linting and are bundled in the .scan.web.yml consumer wrapper.