ci: upgrade to super-linter 6 (#952)

.github/workflows/docker.yaml

@@ -16,12 +16,15 @@ on:
       - v*.*.*
   workflow_dispatch:
     inputs:
+      #checkov:skip=CKV_GHA_7
       version:
         description: 'FrankenPHP version'
         required: false
         type: string
   schedule:
     - cron:  '0 4 * * *'
+permissions:
+  contents: read
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}
 jobs:

.github/workflows/lint.yaml

@@ -7,17 +7,14 @@ on:
   push:
     branches:
       - main
-
+permissions:
+  contents: read
+  packages: read
+  statuses: write  
 jobs:
   build:
     name: Lint Code Base
     runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      packages: read
-      statuses: write
-
     steps:
       -
         name: Checkout Code
@@ -26,7 +23,7 @@ jobs:
           fetch-depth: 0
       -
         name: Lint Code Base
-        uses: super-linter/super-linter/slim@v5
+        uses: super-linter/super-linter/slim@v6.8.0
         env:
           VALIDATE_ALL_CODEBASE: true
           DEFAULT_BRANCH: main
@@ -36,7 +33,11 @@ jobs:
           VALIDATE_CPP: false
           VALIDATE_JSCPD: false
           VALIDATE_GO: false
+          VALIDATE_GO_MODULES: false
           VALIDATE_PHP_PHPCS: false
           VALIDATE_PHP_PHPSTAN: false
           VALIDATE_PHP_PSALM: false
           VALIDATE_TERRAGRUNT: false
+          # Prettier and StandardJS are incompatible
+          VALIDATE_JAVASCRIPT_PRETTIER: false
+          VALIDATE_TYPESCRIPT_PRETTIER: false

.github/workflows/static.yaml

@@ -16,12 +16,15 @@ on:
       - v*.*.*
   workflow_dispatch:
     inputs:
+      #checkov:skip=CKV_GHA_7
       version:
         description: 'FrankenPHP version'
         required: false
         type: string
   schedule:
     - cron:  '0 0 * * *'
+permissions:
+  contents: write
 env:
   IMAGE_NAME: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.version) || startsWith(github.ref, 'refs/tags/')) && 'dunglas/frankenphp' || 'dunglas/frankenphp-dev' }}    
 jobs:

.github/workflows/tests.yaml

@@ -11,6 +11,8 @@ on:
       - main
     paths-ignore:
       - 'docs/**'
+permissions:
+  contents: read
 jobs:
   tests:
     runs-on: ubuntu-latest

Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM php-base AS common
 
 WORKDIR /app

alpine.Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM php-base AS common
 
 ARG TARGETARCH

build-static.sh

@@ -3,7 +3,7 @@
 set -o errexit
 set -x
 
-if ! type "git" > /dev/null 2>&1; then
+if ! type "git" >/dev/null 2>&1; then
 	echo "The \"git\" command must be installed."
 	exit 1
 fi
@@ -16,7 +16,7 @@ if [ "${os}" = "darwin" ]; then
 	md5binary="md5 -q"
 fi
 
-if [ "${os}" = "linux" ] && ! type "cmake" > /dev/null 2>&1; then
+if [ "${os}" = "linux" ] && ! type "cmake" >/dev/null 2>&1; then
 	echo "The \"cmake\" command must be installed."
 	exit 1
 fi
@@ -87,14 +87,14 @@ else
 		cd static-php-cli/
 	fi
 
-    if type "brew" > /dev/null 2>&1; then
+	if type "brew" >/dev/null 2>&1; then
-        if ! type "composer" > /dev/null; then
+		if ! type "composer" >/dev/null; then
 			packages="composer"
 		fi
-        if ! type "go" > /dev/null; then
+		if ! type "go" >/dev/null; then
 			packages="${packages} go"
 		fi
-        if [ -n "${RELEASE}" ] && ! type "gh" > /dev/null 2>&1; then
+		if [ -n "${RELEASE}" ] && ! type "gh" >/dev/null 2>&1; then
 			packages="${packages} gh"
 		fi
 
@@ -167,7 +167,7 @@ if [ "${os}" = "linux" ]; then
 			git checkout "$(git describe --tags "$(git rev-list --tags --max-count=1 || true)" || true)"
 
 			curl -f -L --retry 5 https://raw.githubusercontent.com/tweag/rust-alpine-mimalloc/b26002b49d466a295ea8b50828cb7520a71a872a/mimalloc.diff -o mimalloc.diff
-            patch -p1 < mimalloc.diff
+			patch -p1 <mimalloc.diff
 
 			mkdir -p out/
 			cd out/
@@ -198,8 +198,7 @@ if [ "${os}" = "linux" ]; then
 		fi
 
 		# Patch musl library to use mimalloc
-        for libc_path in "/usr/local/musl/lib/libc.a" "/usr/local/musl/$(uname -m)-linux-musl/lib/libc.a" "/usr/lib/libc.a"
+		for libc_path in "/usr/local/musl/lib/libc.a" "/usr/local/musl/$(uname -m)-linux-musl/lib/libc.a" "/usr/lib/libc.a"; do
-        do
 			if [ ! -f "${libc_path}" ] || [ -f "${libc_path}.unpatched" ]; then
 				continue
 			fi
@@ -229,7 +228,7 @@ cd ../
 # Embed PHP app, if any
 if [ -n "${EMBED}" ] && [ -d "${EMBED}" ]; then
 	tar -cf app.tar -C "${EMBED}" .
-    ${md5binary} app.tar | awk '{printf $1}' > app_checksum.txt
+	${md5binary} app.tar | awk '{printf $1}' >app_checksum.txt
 fi
 
 cd caddy/frankenphp/
@@ -242,7 +241,7 @@ if [ -d "${EMBED}" ]; then
 	truncate -s 0 app_checksum.txt
 fi
 
-if type "upx" > /dev/null 2>&1 && [ -z "${DEBUG_SYMBOLS}" ] && [ -z "${NO_COMPRESS}" ]; then
+if type "upx" >/dev/null 2>&1 && [ -z "${DEBUG_SYMBOLS}" ] && [ -z "${NO_COMPRESS}" ]; then
 	upx --best "dist/${bin}"
 fi
 

dev-alpine.Dockerfile

@@ -1,4 +1,6 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
 FROM golang:1.22-alpine
 
 ENV CFLAGS="-ggdb3"

dev.Dockerfile

@@ -1,4 +1,6 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
 FROM golang:1.22
 
 ENV CFLAGS="-ggdb3"

release.sh

@@ -9,12 +9,12 @@ set -o errtrace
 set -o pipefail
 set -o xtrace
 
-if ! type "git" > /dev/null; then
+if ! type "git" >/dev/null; then
 	echo "The \"git\" command must be installed."
 	exit 1
 fi
 
-if ! type "gh" > /dev/null; then
+if ! type "gh" >/dev/null; then
 	echo "The \"gh\" command must be installed."
 	exit 1
 fi
@@ -44,6 +44,6 @@ git tag -s -m "Version $1" "caddy/v$1"
 git push --follow-tags
 
 tags=$(git tag --list --sort=-version:refname 'v*')
-previous_tag=$(awk 'NR==2 {print;exit}' <<< "${tags}")
+previous_tag=$(awk 'NR==2 {print;exit}' <<<"${tags}")
 
 gh release create --draft --generate-notes --latest --notes-start-tag "${previous_tag}" --verify-tag "v$1"

reload_test.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
-for ((i = 0 ; i < 100 ; i++)); do
+for ((i = 0; i < 100; i++)); do
 	curl --no-progress-meter -o /dev/null http://localhost:2019/config/apps/frankenphp -: --no-progress-meter -o /dev/null -H 'Cache-Control: must-revalidate' -H 'Content-Type: application/json' --data-binary '{"workers":[{"file_name":"./index.php"}]}' -X PATCH http://localhost:2019/config/apps/frankenphp
 done

static-builder.Dockerfile

@@ -1,4 +1,7 @@
 # syntax=docker/dockerfile:1
+#checkov:skip=CKV_DOCKER_2
+#checkov:skip=CKV_DOCKER_3
+#checkov:skip=CKV_DOCKER_7
 FROM golang-base
 
 ARG TARGETARCH