Test lint annotations

.github/workflows/ci.yml

@@ -1346,3 +1346,27 @@ jobs:
         name: Check docker
         run: |
           docker image inspect localhost:5000/name/app:latest
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v4
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          # TODO: use v0.14.0 when GA
+          version: v0.14.0-rc1
+          # TODO: use buildx-stable-1 image when v0.14 promoted
+          driver-opts: |
+            network=host
+            image=moby/buildkit:master@sha256:baee1d09b849fa6dbbcf7ae407f50eff5c0de47b52f11d78543817d3395441bb
+          buildkitd-flags: --debug
+      -
+        name: Build
+        uses: ./
+        with:
+          context: ./test
+          file: ./test/lint.Dockerfile

src/main.ts

@@ -81,6 +81,8 @@ actionsToolkit.run(
     core.debug(`buildCmd.command: ${buildCmd.command}`);
     core.debug(`buildCmd.args: ${JSON.stringify(buildCmd.args)}`);
 
+    await runLint(buildCmd.command, buildCmd.args, inputs, toolkit);
+
     await Exec.getExecOutput(buildCmd.command, buildCmd.args, {
       ignoreReturnCode: true
     }).then(res => {
@@ -121,3 +123,37 @@ actionsToolkit.run(
     }
   }
 );
+
+async function runLint(cmd: string, args: Array<string>, inputs: context.Inputs, toolkit: Toolkit): Promise<void> {
+  if (!(await toolkit.buildx.versionSatisfies('>=0.14.0'))) {
+    return;
+  }
+  await core.group(`Dockerfile lint`, async () => {
+    await Exec.getExecOutput(cmd, [...args, '--print=lint,format=json'], {
+      ignoreReturnCode: true,
+      env: Object.assign({}, process.env, {
+        BUILDX_EXPERIMENTAL: '1'
+      }) as {
+        [key: string]: string;
+      }
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(`buildx failed with: ${res.stderr.match(/(.*)\s*$/)?.[0]?.trim() ?? 'unknown error'}`);
+      }
+      const out = JSON.parse(res.stdout);
+      if (out['warnings'] && out['warnings'].length > 0) {
+        // const sourceData = Buffer.from(out['sources'][0].data, 'base64').toString('utf8');
+        // core.info(`sourceData: ${sourceData}`);
+        out['warnings'].forEach(lint => {
+          core.warning(lint.description, {
+            title: lint.detail,
+            file: inputs.file || 'Dockerfile',
+            startLine: lint.location.ranges[0].start.line
+          });
+        });
+      } else {
+        core.info('No lint issues found');
+      }
+    });
+  });
+}

test/lint.Dockerfile

@@ -0,0 +1,8 @@
+# syntax=docker/dockerfile-upstream:master
+frOM busybox as base
+cOpy lint.Dockerfile .
+
+from scratch
+COPy --from=base \
+  /lint.Dockerfile \
+  /