Add oelint-adv linting with a clean, blocking CI gate#83
Merged
Conversation
Make the class pass oelint-adv: * document the rootfs postprocess function with a [doc] flag (oelint.task.docstrings), * drop the trailing blank and use double quotes in the ROOTFS_POSTPROCESS_COMMAND append (oelint.var.rootfspostcmd), * remove the duplicate blank line (oelint.newline.consecutive), * suppress oelint.bbclass.underscores inline, as the dash in the class name is harmless here (no EXPORT_FUNCTIONS). No functional change.
* set DESCRIPTION (mandatory), BUGTRACKER and SECTION, * collapse the single-entry RDEPENDS into a plain assignment, which also drops the leading blank flagged by oelint.vars.inconspaces and oelint.vars.notneededspace. No functional change.
* rename to shellhub-agent-config_1.0.bb so the filename carries a version (oelint.file.underscores); PN is unchanged, so the RDEPENDS references to shellhub-agent-config keep resolving, * set DESCRIPTION, HOMEPAGE, BUGTRACKER and SECTION, * generate the configuration with an echo block instead of a tab-indented here-doc, dropping oelint.tabs.notabs and oelint.task.heredocs, * document the genuinely-not-applicable rules inline: the missing SRC_URI and CVE_PRODUCT (this recipe generates its config and ships no code), the layer-internal LIC_FILES_CHKSUM (oelint.var.licenseremotefile) and the parse-time SkipRecipe anonymous python (oelint.task.noanonpython). The generated configuration file is identical; no functional change.
* set DESCRIPTION, BUGTRACKER and SECTION, * drop the leading blank in SRC_URI (oelint.vars.notneededspace), * use 'install -d' instead of 'mkdir -p' in do_install (oelint.task.nomkdir), * order the RDEPENDS entries alphabetically and place RDEPENDS before RRECOMMENDS (oelint.vars.dependsordered, oelint.var.order), * suppress oelint.task.network inline, as the go modules are fetched during do_compile by design. No functional change.
The recipe name (shellhub-agent) does not match the product name ShellHub is tracked under in the NVD, so cve-check would not associate any CVE with this recipe. Set CVE_PRODUCT = "shellhub" so its CVEs are reported. This also satisfies oelint.var.suggestedvar.CVE_PRODUCT.
Add the declarative oelint-adv setup shared across the OEL layers: * .oelint.cfg pins the release (wrynose) and the only layer-wide suppression, oelint.var.bbclassextend, which never applies to a target-only layer, * oelint.constants.json declares the project distro/machine override tokens oelint cannot know when run standalone, * contrib/oelint/run-oelint.sh enumerates the recipes and runs the linter serially, * .github/workflows/oelint.yaml runs it on pull requests, merge groups and master pushes through the yocto-env.nix lint devshell. The layer lints clean, with every remaining exception documented inline as a '# nooelint: <rule.id>' comment, so the gate is blocking.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the declarative
oelint-advsetup used across the OEL layers and makes every recipe in this layer lint clean, so the CI gate can be blocking.Tooling (last commit)
.oelint.cfg— pins the release (wrynose) and the only layer-wide suppression (oelint.var.bbclassextend).oelint.constants.json— declares the project distro/machine override tokens.contrib/oelint/run-oelint.sh— enumerates the recipes and runs the linter serially..github/workflows/oelint.yaml— runs it on PRs, merge groups andmasterpushes via theyocto-env.nixlint devshell.Recipe fixes
bbclass.underscoressuppression.RDEPENDS._1.0), metadata, here-doc → echo, inline suppressions for genuinely N/A rules.install -d,RDEPENDSordering,SRC_URI, network suppression), plus a separate commit settingCVE_PRODUCT = "shellhub"for cve-check.Every remaining exception is documented inline as a
# nooelint: <rule.id>comment.oelint-advreports zero findings.