ci: upgrade to super-linter 6 (#952)

.github/workflows/docker.yaml

@@ -16,12 +16,15 @@ on:
       - v*.*.*
   workflow_dispatch:
     inputs:
+      #checkov:skip=CKV_GHA_7
       version:
         description: 'FrankenPHP version'
         required: false
         type: string
   schedule:
     - cron:  '0 4 * * *'
+permissions:
+  contents: read
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}
 jobs:

.github/workflows/lint.yaml

@@ -7,17 +7,14 @@ on:
   push:
     branches:
       - main
-
-jobs:
-  build:
-    name: Lint Code Base
-    runs-on: ubuntu-latest
-
 permissions:
   contents: read
   packages: read
   statuses: write  
-
+jobs:
+  build:
+    name: Lint Code Base
+    runs-on: ubuntu-latest
     steps:
       -
         name: Checkout Code
@@ -26,7 +23,7 @@ jobs:
           fetch-depth: 0
       -
         name: Lint Code Base
-        uses: super-linter/super-linter/slim@v5
+        uses: super-linter/super-linter/slim@v6.8.0
         env:
           VALIDATE_ALL_CODEBASE: true
           DEFAULT_BRANCH: main
@@ -36,7 +33,11 @@ jobs:
           VALIDATE_CPP: false
           VALIDATE_JSCPD: false
           VALIDATE_GO: false
+          VALIDATE_GO_MODULES: false
           VALIDATE_PHP_PHPCS: false
           VALIDATE_PHP_PHPSTAN: false
           VALIDATE_PHP_PSALM: false
           VALIDATE_TERRAGRUNT: false
+          # Prettier and StandardJS are incompatible
+          VALIDATE_JAVASCRIPT_PRETTIER: false
+          VALIDATE_TYPESCRIPT_PRETTIER: false

.github/workflows/static.yaml

@@ -16,12 +16,15 @@ on:
       - v*.*.*
   workflow_dispatch:
     inputs:
+      #checkov:skip=CKV_GHA_7
       version:
         description: 'FrankenPHP version'
         required: false
         type: string
   schedule:
     - cron:  '0 0 * * *'
+permissions:
+  contents: write
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}    
 jobs:

.github/workflows/tests.yaml

@@ -11,6 +11,8 @@ on:
       - main
     paths-ignore:
       - 'docs/**'
+permissions:
+  contents: read
 jobs:
   tests:
     runs-on: ubuntu-latest

Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM php-base AS common
 
 WORKDIR /app

alpine.Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM php-base AS common
 
 ARG TARGETARCH

build-static.sh

@@ -198,8 +198,7 @@ if [ "${os}" = "linux" ]; then
 		fi
 
 		# Patch musl library to use mimalloc
-        for libc_path in "/usr/local/musl/lib/libc.a" "/usr/local/musl/$(uname -m)-linux-musl/lib/libc.a" "/usr/lib/libc.a"
+		for libc_path in "/usr/local/musl/lib/libc.a" "/usr/local/musl/$(uname -m)-linux-musl/lib/libc.a" "/usr/lib/libc.a"; do
-        do
 			if [ ! -f "${libc_path}" ] || [ -f "${libc_path}.unpatched" ]; then
 				continue
 			fi

dev-alpine.Dockerfile

@@ -1,4 +1,6 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
 FROM golang:1.22-alpine
 
 ENV CFLAGS="-ggdb3"

dev.Dockerfile

@@ -1,4 +1,6 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
 FROM golang:1.22
 
 ENV CFLAGS="-ggdb3"

static-builder.Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM golang-base
 
 ARG TARGETARCH