timothyswan/yamllint repository overview

yamllint⁠ checks YAML files for syntax errors, key duplication, line length, trailing spaces, indentation, and other style and correctness issues. It is widely used as the YAML validation layer in Ansible, Kubernetes, and CI pipeline toolchains.

This image installs yamllint and its dependencies (pathspec, PyYAML) offline from a hash-pinned wheelhouse using Red Hat Hardened Image Python 3.13 layers. The built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

Note: yamllint's OpenSSF Scorecard is 4.9/10 (threshold is 5.0). The low score reflects a single-maintainer project without fuzzing or signed releases — not abandonment. It is widely deployed and actively maintained. Exception documented in build.yml.

⁠Usage

# Lint a YAML file
podman run --rm -v "$(pwd):/work:ro,Z" yamllint:<version>-rhhi /work/file.yml

# Parsable output for machine consumption
podman run --rm -v "$(pwd):/work:ro,Z" yamllint:<version>-rhhi -f parsable /work/file.yml

# Use relaxed config
podman run --rm -v "$(pwd):/work:ro,Z" yamllint:<version>-rhhi -d relaxed /work/file.yml

⁠Supply chain

• Base images: registry.access.redhat.com/hi/python:3.13-builder (build) and hi/python:3.13 (runtime) — Red Hat Hardened
• Dependencies: 3 packages (yamllint, pathspec, PyYAML), hash-pinned
• Tier: 3 (Python from PyPI)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation