Use the official hadolint action for linting

[agners]

Supersedes #4802, implementing @sairon's suggestion there.

What this PR changes

• Replaces the hand-rolled loop (which pipes each Dockerfile into a hadolint/hadolint container over stdin) with hadolint/hadolint-action in recursive: true mode, which lints **/Dockerfile in a single run.
• Drops the hand-maintained HADOLINT_VERSION env var — the hadolint version now comes bundled with the action.
• Extends .hadolint.yaml with the style-level rules the much newer bundled hadolint reports on existing Dockerfiles.

Why

The pinned hadolint was v1.17.2 (2019), which rejects HEALTHCHECK --start-interval (needed by #4800 / #4801) with a parse error. Beyond just bumping the version, using the official action brings three things the loop cannot:

• Dependabot keeps it current. The repo already watches github-actions, so the action — and therefore hadolint — gets update PRs automatically instead of the version silently aging six years.
• Real file paths. The stdin loop makes hadolint report /dev/stdin:60:71; the action reports whisper/Dockerfile:60.
• Inline PR annotations via the action's problem matcher.

The action is pinned by SHA with a version comment, matching the other actions in this workflow.

Ignore-list additions

Bundled hadolint is v2.15.1 vs the previous v1.17.2, so it knows many more rules. All additions are style/info level:

Rule	Why ignored
DL3025	Shell-form HEALTHCHECK CMD — required for the piped nc | grep health probes
DL3029	--platform in FROM — intentional in silabs-multiprotocol's cross-build
DL3059	Consecutive RUN instructions (info)
DL3066	Non-numeric user id (info)
SC3010	[[ ]] in a script hadolint treats as POSIX sh

Testing

Ran the action's actual entrypoint and bundled image locally against this branch:

• Clean run: exit 0, no findings across all 24 Dockerfiles.
• Coverage check (with an emptied ignore list): findings reported for 24 of 24 Dockerfiles, confirming the recursive glob matches the same set as the old loop — not silently linting nothing.
• Failure check: a deliberately violating Dockerfile produced exit 1 with findings identical to running hadolint directly, and with proper path/Dockerfile:line prefixes.
• yamllint clean on the modified workflow.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated automated Dockerfile linting to use a pinned Hadolint action with recursive scanning.
  • Added project-specific linting rules to reduce warnings for supported Dockerfile patterns.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 18d0620e-27c5-4a05-bae1-28fb5e2e2739

📥 Commits

Reviewing files that changed from the base of the PR and between 2f1ab01 and 47e143b.

📒 Files selected for processing (2)

• .github/workflows/lint.yml
• .hadolint.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The lint workflow removes the manual Hadolint Docker loop and uses the pinned Hadolint action for recursive scanning. The Hadolint configuration adds five ignored rules.

Changes

Hadolint linting

Layer / File(s)	Summary
Adopt the Hadolint action and rules .github/workflows/lint.yml, .hadolint.yaml	The workflow uses the pinned Hadolint action with recursive scanning and .hadolint.yaml. The configuration ignores DL3025, DL3029, DL3059, DL3066, and SC3010.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 47e14

The PR replaces the Dockerfile linting loop with the pinned official action and updates lint rules; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing the hand-rolled Hadolint workflow with the official Hadolint action.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sairon]

Nice, LGTM!