Update hadolint to v2.15.1

[agners]

What this PR changes

• Bumps the CI hadolint from v1.17.2 (2019) to v2.15.1 (current).
• Extends .hadolint.yaml with the style-level rules the new version reports across existing Dockerfiles: DL3025 (shell-form HEALTHCHECK/CMD — required for the piped nc | grep health probes), DL3029 (--platform in FROM — intentional in silabs-multiprotocol's multi-stage build), DL3059/DL3066 (info-level), SC3010.

Why

v1.17.2 predates Docker Engine 25's HEALTHCHECK --start-interval flag and fails with a parse error (invalid flag: --start-interval); hadolint supports it since v2.14.0 (hadolint/hadolint#978). #4800 and #4801 use --start-interval to leave the "Starting" state faster and need this to pass lint.

Verified locally: all 26 Dockerfiles in the repo lint clean with v2.15.1 and the updated config, including the two PR branches using --start-interval.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the Dockerfile linting tool to a newer version.
  • Adjusted linting rules to accommodate additional accepted Dockerfile patterns.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ac58609e-34a4-47a9-b675-e61dd64c743b

📥 Commits

Reviewing files that changed from the base of the PR and between 2f1ab01 and 250c520.

📒 Files selected for processing (2)

• .github/workflows/lint.yml
• .hadolint.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The lint workflow now uses Hadolint v2.15.1. The Hadolint configuration ignores five additional rules: DL3025, DL3029, DL3059, DL3066, and SC3010.

Changes

Hadolint lint policy

Layer / File(s)	Summary
Update Hadolint execution and rules .github/workflows/lint.yml, .hadolint.yaml	The lint workflow uses Hadolint v2.15.1. The configuration adds five ignored rules.

Estimated code review effort: 2 (Simple) | ~5 minutes

Merge Risk: 🔵 Low · up to 250c5

The lint configuration now applies these rule exceptions to all current and future Dockerfiles, which could unintentionally suppress findings in newly added files. The PR is mergeable with explicit owner awareness of this repository-wide scope.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: updating Hadolint to version 2.15.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sairon]

Seems that the official hadolint/hadolint-action supports glob patterns and the output looks good: hadolint/hadolint-action#3 (comment)

Maybe we could do that instead of spinning up a Docker container for each Dockerfile? The adedd benefit is that Dependabot would keep hadolint up to date then.

[agners]

Good idea — implemented in #4804, which uses hadolint/hadolint-action with recursive: true instead of the per-file Docker loop (and so gets Dependabot updates, real file paths, and inline annotations). This PR is superseded by it.

[sairon]

Okay, let's close this in favor of #4804.