tally-cli 0.7.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/README.md +32 -31
- package/bin/cli.js +29 -29
- package/package.json +11 -11
package/LICENSE
CHANGED
|
@@ -186,7 +186,7 @@
|
|
|
186
186
|
same "printed page" as the copyright notice for easier
|
|
187
187
|
identification within third-party archives.
|
|
188
188
|
|
|
189
|
-
Copyright
|
|
189
|
+
Copyright 2026 Konstantin Vyatkin
|
|
190
190
|
|
|
191
191
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
192
192
|
you may not use this file except in compliance with the License.
|
package/README.md
CHANGED
|
@@ -1,17 +1,17 @@
|
|
|
1
1
|
# tally
|
|
2
2
|
|
|
3
|
-
[](https://codecov.io/gh/wharflab/tally)
|
|
4
4
|
|
|
5
5
|
tally keeps Dockerfiles and Containerfiles clean, modern, and consistent — using BuildKit's own parser and checks (the same foundation behind
|
|
6
6
|
`docker buildx`) plus safe auto-fixes. It runs fast, doesn't require Docker Desktop or a daemon, and fits neatly into CI. If that sounds like your
|
|
7
|
-
workflow, try `tally
|
|
7
|
+
workflow, try `tally lint .`.
|
|
8
8
|
|
|
9
9
|
```bash
|
|
10
10
|
# Lint everything in the repo (recursive)
|
|
11
|
-
tally
|
|
11
|
+
tally lint .
|
|
12
12
|
|
|
13
13
|
# Apply all safe fixes automatically
|
|
14
|
-
tally
|
|
14
|
+
tally lint --fix Dockerfile
|
|
15
15
|
```
|
|
16
16
|
|
|
17
17
|
## Why tally?
|
|
@@ -41,9 +41,9 @@ tally integrates rules from multiple sources:
|
|
|
41
41
|
<!-- BEGIN RULES_TABLE -->
|
|
42
42
|
| Source | Rules | Description |
|
|
43
43
|
|--------|-------|-------------|
|
|
44
|
-
| **[BuildKit](https://docs.docker.com/reference/build-checks/)** |
|
|
45
|
-
| **tally** |
|
|
46
|
-
| **[Hadolint](https://github.com/hadolint/hadolint)** |
|
|
44
|
+
| **[BuildKit](https://docs.docker.com/reference/build-checks/)** | 22/22 rules | Docker's official Dockerfile checks (captured + reimplemented) |
|
|
45
|
+
| **tally** | 9 rules | Custom rules including secret detection with [gitleaks](https://github.com/gitleaks/gitleaks) |
|
|
46
|
+
| **[Hadolint](https://github.com/hadolint/hadolint)** | 37 rules | Hadolint-compatible Dockerfile rules (expanding) |
|
|
47
47
|
<!-- END RULES_TABLE -->
|
|
48
48
|
|
|
49
49
|
**See [RULES.md](RULES.md) for the complete rules reference.**
|
|
@@ -53,7 +53,7 @@ tally integrates rules from multiple sources:
|
|
|
53
53
|
### Homebrew (macOS/Linux)
|
|
54
54
|
|
|
55
55
|
```bash
|
|
56
|
-
brew install
|
|
56
|
+
brew install wharflab/tap/tally
|
|
57
57
|
```
|
|
58
58
|
|
|
59
59
|
### NPM
|
|
@@ -77,13 +77,13 @@ gem install tally-cli
|
|
|
77
77
|
### Go
|
|
78
78
|
|
|
79
79
|
```bash
|
|
80
|
-
go install github.com/
|
|
80
|
+
go install github.com/wharflab/tally@latest
|
|
81
81
|
```
|
|
82
82
|
|
|
83
83
|
### From Source
|
|
84
84
|
|
|
85
85
|
```bash
|
|
86
|
-
git clone https://github.com/
|
|
86
|
+
git clone https://github.com/wharflab/tally.git
|
|
87
87
|
cd tally
|
|
88
88
|
go build .
|
|
89
89
|
```
|
|
@@ -92,28 +92,28 @@ go build .
|
|
|
92
92
|
|
|
93
93
|
```bash
|
|
94
94
|
# Check a Dockerfile
|
|
95
|
-
tally
|
|
95
|
+
tally lint Dockerfile
|
|
96
96
|
|
|
97
97
|
# Check all Dockerfiles in current directory (recursive)
|
|
98
|
-
tally
|
|
98
|
+
tally lint .
|
|
99
99
|
|
|
100
100
|
# Check with glob patterns
|
|
101
|
-
tally
|
|
101
|
+
tally lint "**/*.Dockerfile"
|
|
102
102
|
|
|
103
103
|
# Exclude patterns
|
|
104
|
-
tally
|
|
104
|
+
tally lint --exclude "vendor/*" --exclude "test/*" .
|
|
105
105
|
|
|
106
106
|
# Check with max lines limit
|
|
107
|
-
tally
|
|
107
|
+
tally lint --max-lines 100 Dockerfile
|
|
108
108
|
|
|
109
109
|
# Output as JSON
|
|
110
|
-
tally
|
|
110
|
+
tally lint --format json Dockerfile
|
|
111
111
|
|
|
112
112
|
# Check multiple files
|
|
113
|
-
tally
|
|
113
|
+
tally lint Dockerfile.dev Dockerfile.prod
|
|
114
114
|
|
|
115
115
|
# Enable context-aware rules (e.g., copy-ignored-file)
|
|
116
|
-
tally
|
|
116
|
+
tally lint --context . Dockerfile
|
|
117
117
|
```
|
|
118
118
|
|
|
119
119
|
### File Discovery
|
|
@@ -131,10 +131,10 @@ Use `--exclude` to filter out unwanted files:
|
|
|
131
131
|
|
|
132
132
|
```bash
|
|
133
133
|
# Exclude vendor and test directories
|
|
134
|
-
tally
|
|
134
|
+
tally lint --exclude "vendor/*" --exclude "test/*" .
|
|
135
135
|
|
|
136
136
|
# Exclude all .bak files
|
|
137
|
-
tally
|
|
137
|
+
tally lint --exclude "*.bak" .
|
|
138
138
|
```
|
|
139
139
|
|
|
140
140
|
## Rules Overview
|
|
@@ -147,7 +147,7 @@ Some rules require build context awareness. Enable them with the `--context` fla
|
|
|
147
147
|
|
|
148
148
|
```bash
|
|
149
149
|
# Enable context-aware rules
|
|
150
|
-
tally
|
|
150
|
+
tally lint --context . Dockerfile
|
|
151
151
|
```
|
|
152
152
|
|
|
153
153
|
**copy-ignored-file**: Detects when `COPY` or `ADD` commands reference files that would be excluded by `.dockerignore`. This helps catch mistakes
|
|
@@ -211,7 +211,7 @@ tally supports multiple output formats for different use cases.
|
|
|
211
211
|
Human-readable output with colors and source code snippets:
|
|
212
212
|
|
|
213
213
|
```bash
|
|
214
|
-
tally
|
|
214
|
+
tally lint Dockerfile
|
|
215
215
|
```
|
|
216
216
|
|
|
217
217
|
```text
|
|
@@ -231,7 +231,7 @@ Dockerfile:2
|
|
|
231
231
|
Machine-readable format with summary statistics and scan metadata:
|
|
232
232
|
|
|
233
233
|
```bash
|
|
234
|
-
tally
|
|
234
|
+
tally lint --format json Dockerfile
|
|
235
235
|
```
|
|
236
236
|
|
|
237
237
|
The JSON output includes:
|
|
@@ -269,16 +269,17 @@ The JSON output includes:
|
|
|
269
269
|
"files": 1
|
|
270
270
|
},
|
|
271
271
|
"files_scanned": 1,
|
|
272
|
-
"rules_enabled":
|
|
272
|
+
"rules_enabled": 41
|
|
273
273
|
}
|
|
274
274
|
```
|
|
275
275
|
|
|
276
276
|
### SARIF
|
|
277
277
|
|
|
278
|
-
[Static Analysis Results Interchange Format](https://docs.oasis-open.org/sarif/sarif/v2.1.0/) for CI/CD integration with GitHub Code Scanning, Azure
|
|
278
|
+
[Static Analysis Results Interchange Format](https://docs.oasis-open.org/sarif/sarif/v2.1.0/) for CI/CD integration with GitHub Code Scanning, Azure
|
|
279
|
+
DevOps, and other tools:
|
|
279
280
|
|
|
280
281
|
```bash
|
|
281
|
-
tally
|
|
282
|
+
tally lint --format sarif Dockerfile > results.sarif
|
|
282
283
|
```
|
|
283
284
|
|
|
284
285
|
### GitHub Actions
|
|
@@ -286,7 +287,7 @@ tally check --format sarif Dockerfile > results.sarif
|
|
|
286
287
|
Native GitHub Actions workflow command format for inline annotations:
|
|
287
288
|
|
|
288
289
|
```bash
|
|
289
|
-
tally
|
|
290
|
+
tally lint --format github-actions Dockerfile
|
|
290
291
|
```
|
|
291
292
|
|
|
292
293
|
```text
|
|
@@ -298,7 +299,7 @@ tally check --format github-actions Dockerfile
|
|
|
298
299
|
Concise Markdown tables optimized for AI agents and token efficiency:
|
|
299
300
|
|
|
300
301
|
```bash
|
|
301
|
-
tally
|
|
302
|
+
tally lint --format markdown Dockerfile
|
|
302
303
|
```
|
|
303
304
|
|
|
304
305
|
```markdown
|
|
@@ -342,13 +343,13 @@ Control which severity levels cause a non-zero exit code:
|
|
|
342
343
|
|
|
343
344
|
```bash
|
|
344
345
|
# Fail only on errors (ignore warnings)
|
|
345
|
-
tally
|
|
346
|
+
tally lint --fail-level error Dockerfile
|
|
346
347
|
|
|
347
348
|
# Never fail (useful for CI reporting without blocking)
|
|
348
|
-
tally
|
|
349
|
+
tally lint --fail-level none --format sarif Dockerfile > results.sarif
|
|
349
350
|
|
|
350
351
|
# Fail on any violation including style issues (default behavior)
|
|
351
|
-
tally
|
|
352
|
+
tally lint --fail-level style Dockerfile
|
|
352
353
|
```
|
|
353
354
|
|
|
354
355
|
Available levels (from most to least severe): `error`, `warning`, `info`, `style` (default), `none`
|
package/bin/cli.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
|
|
3
|
-
const { execFileSync } = require('child_process');
|
|
4
|
-
const { existsSync } = require('fs');
|
|
3
|
+
const { execFileSync } = require('node:child_process');
|
|
4
|
+
const { existsSync } = require('node:fs');
|
|
5
5
|
|
|
6
6
|
/**
|
|
7
7
|
* Get the platform-specific package name for the current system
|
|
@@ -49,7 +49,7 @@ function getPlatformPackageName() {
|
|
|
49
49
|
throw new Error(`FreeBSD only supports x64 architecture, not ${arch}`);
|
|
50
50
|
}
|
|
51
51
|
|
|
52
|
-
return `@
|
|
52
|
+
return `@wharflab/tally-${pkgPlatform}-${pkgArch}`;
|
|
53
53
|
}
|
|
54
54
|
|
|
55
55
|
/**
|
|
@@ -66,35 +66,35 @@ function main() {
|
|
|
66
66
|
let binPath;
|
|
67
67
|
try {
|
|
68
68
|
binPath = require.resolve(`${pkgName}/bin/${binName}`);
|
|
69
|
-
} catch
|
|
69
|
+
} catch {
|
|
70
70
|
// Platform package not found or binary missing
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
71
|
+
|
|
72
|
+
|
|
73
|
+
|
|
74
|
+
|
|
75
|
+
|
|
76
|
+
|
|
77
|
+
|
|
78
|
+
|
|
79
|
+
|
|
80
|
+
|
|
81
|
+
|
|
82
|
+
|
|
83
|
+
|
|
84
|
+
|
|
85
|
+
|
|
86
|
+
|
|
87
|
+
|
|
88
|
+
|
|
89
|
+
|
|
90
90
|
process.exit(1);
|
|
91
91
|
}
|
|
92
92
|
|
|
93
93
|
// Verify the binary exists and is executable
|
|
94
94
|
if (!existsSync(binPath)) {
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
95
|
+
|
|
96
|
+
|
|
97
|
+
|
|
98
98
|
process.exit(1);
|
|
99
99
|
}
|
|
100
100
|
|
|
@@ -113,12 +113,12 @@ function main() {
|
|
|
113
113
|
process.exit(execError.status);
|
|
114
114
|
}
|
|
115
115
|
// If there was an execution error (e.g., binary corrupted), report it
|
|
116
|
-
|
|
116
|
+
|
|
117
117
|
process.exit(1);
|
|
118
118
|
}
|
|
119
119
|
|
|
120
|
-
} catch
|
|
121
|
-
|
|
120
|
+
} catch {
|
|
121
|
+
|
|
122
122
|
process.exit(1);
|
|
123
123
|
}
|
|
124
124
|
}
|
package/package.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "tally-cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.9.0",
|
|
4
4
|
"description": "A fast, configurable linter for Dockerfiles and Containerfiles",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
7
|
-
"url": "git+https://github.com/
|
|
7
|
+
"url": "git+https://github.com/wharflab/tally.git"
|
|
8
8
|
},
|
|
9
9
|
"bin": {
|
|
10
10
|
"tally": "./bin/cli.js"
|
|
@@ -24,20 +24,20 @@
|
|
|
24
24
|
"author": "tinovyatkin",
|
|
25
25
|
"license": "Apache-2.0",
|
|
26
26
|
"bugs": {
|
|
27
|
-
"url": "https://github.com/
|
|
27
|
+
"url": "https://github.com/wharflab/tally/issues"
|
|
28
28
|
},
|
|
29
|
-
"homepage": "https://github.com/
|
|
29
|
+
"homepage": "https://github.com/wharflab/tally#readme",
|
|
30
30
|
"engines": {
|
|
31
31
|
"node": ">=18.0.0"
|
|
32
32
|
},
|
|
33
33
|
"optionalDependencies": {
|
|
34
|
-
"@
|
|
35
|
-
"@
|
|
36
|
-
"@
|
|
37
|
-
"@
|
|
38
|
-
"@
|
|
39
|
-
"@
|
|
40
|
-
"@
|
|
34
|
+
"@wharflab/tally-darwin-arm64": "0.9.0",
|
|
35
|
+
"@wharflab/tally-darwin-x64": "0.9.0",
|
|
36
|
+
"@wharflab/tally-linux-arm64": "0.9.0",
|
|
37
|
+
"@wharflab/tally-linux-x64": "0.9.0",
|
|
38
|
+
"@wharflab/tally-windows-arm64": "0.9.0",
|
|
39
|
+
"@wharflab/tally-windows-x64": "0.9.0",
|
|
40
|
+
"@wharflab/tally-freebsd-x64": "0.9.0"
|
|
41
41
|
},
|
|
42
42
|
"publishConfig": {
|
|
43
43
|
"access": "public"
|