Add more and fix linting

.github/workflows/build.yml

@@ -3,6 +3,8 @@ name: Docker images
 
 on: [push, pull_request, workflow_dispatch]
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -75,7 +77,7 @@ jobs:
             git submodule update --remote Pillow
           fi
           (cd Pillow && git checkout main)
-          sudo chown -R 1001 $(pwd)
+          sudo chown -R 1001 "$(pwd)"
 
       - name: Test Image Build
         if: "matrix.test-image"
@@ -91,7 +93,7 @@ jobs:
         run: |
           cd "${{ matrix.image }}" && sudo chmod a+w . && make update
           if [[ -n "$DOCKER_USERNAME" ]]; then
-            echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin && echo "logged_in=true" >> $GITHUB_OUTPUT
+            echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin && echo "logged_in=true" >> "$GITHUB_OUTPUT"
           fi
           make build BRANCH=main
         env:
@@ -120,7 +122,7 @@ jobs:
 
       - name: Post build
         if: always()
-        run: sudo chown -R $(id -u) $(pwd)
+        run: sudo chown -R "$(id -u)" "$(pwd)"
 
   success:
     needs: build

.github/workflows/lint.yml

@@ -0,0 +1,23 @@
+name: Lint
+
+on: [push, pull_request, workflow_dispatch]
+
+permissions: {}
+
+env:
+  FORCE_COLOR: 1
+  RUFF_OUTPUT_FORMAT: github
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: j178/prek-action@v1

.github/zizmor.yml

@@ -0,0 +1,6 @@
+# https://docs.zizmor.sh/configuration/
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

.hadolint.yaml

@@ -0,0 +1,11 @@
+ignored:
+  - DL3003 # Use WORKDIR to switch to a directory
+  - DL3006 # Always tag the version of an image explicitly
+  - DL3007 # Using latest is prone to errors
+  - DL3008 # Pin versions in apt-get install
+  - DL3013 # Pin versions in pip
+  - DL3018 # Pin versions in apk add
+  - DL3033 # Pin versions in yum install
+  - DL3041 # Pin versions in dnf install
+  - DL3059 # Multiple consecutive RUN instructions
+  - SC2016 # Expressions don't expand in single quotes

.pre-commit-config.yaml

@@ -2,9 +2,40 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v6.0.0
     hooks:
+      - id: check-added-large-files
+      - id: check-case-conflict
       - id: check-merge-conflict
       - id: check-json
       - id: check-yaml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.36.2
+    hooks:
+      - id: check-github-workflows
+      - id: check-renovate
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.11
+    hooks:
+      - id: actionlint
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.22.0
+    hooks:
+      - id: zizmor
+
+  - repo: https://github.com/AleksaC/hadolint-py
+    rev: v2.14.0
+    hooks:
+      - id: hadolint
+        exclude: ^archive/
+
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
 
 ci:
   autoupdate_schedule: quarterly

Makefile.sub

@@ -34,4 +34,3 @@ clean:
 .PHONY: shell
 shell:
 	docker run --rm -it -v $(ROOT):/Pillow $(IMAGENAME):$(BRANCH) /bin/bash
-

alpine/Dockerfile

@@ -35,7 +35,7 @@ RUN apk --no-cache add \
     tk-dev \
     zlib-dev
 
-ADD depends /depends
+COPY depends /depends
 RUN cd /depends \
     && ./install_webp.sh \
     && ./install_raqm.sh

alpine/update.sh

@@ -1,4 +1,2 @@
 #!/bin/sh
 docker pull alpine
-
-

amazon-2-amd64/Dockerfile

@@ -2,7 +2,6 @@ FROM amazonlinux:2
 
 RUN yum install -y \
     cmake \
-    curl \
     findutils \
     fribidi-devel \
     gcc \
@@ -30,20 +29,21 @@ RUN yum install -y \
     zlib-devel \
     && yum clean all
 
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN wget -qO- https://sh.rustup.rs | sh -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
 
 RUN useradd --uid 1001 pillow
 
-ADD depends /depends
+COPY depends /depends
 RUN cd /depends \
     && ./install_imagequant.sh
 
 RUN yum remove -y openssl-devel && \
     yum install -y openssl11-devel && \
     yum clean all
 
-RUN wget https://www.python.org/ftp/python/3.10.18/Python-3.10.18.tgz \
+RUN wget --no-verbose https://www.python.org/ftp/python/3.10.18/Python-3.10.18.tgz \
     && tar xzf Python-3.10.18.tgz \
     && cd Python-3.10.18 \
     && ./configure \
@@ -61,10 +61,10 @@ RUN bash -c "python3.10 -m pip install virtualenv \
     && /vpy3/bin/pip install numpy --only-binary=:all: || true \
     && chown -R pillow:pillow /vpy3"
 
-RUN wget https://github.com/ninja-build/ninja/releases/download/v1.13.2/ninja-linux.zip \
+RUN wget --no-verbose https://github.com/ninja-build/ninja/releases/download/v1.13.2/ninja-linux.zip \
     && unzip ninja-linux.zip \
     && mv ninja /usr/bin
-RUN python3.10 -m pip install meson
+RUN python3.10 -m pip install --no-cache-dir meson
 RUN ln -s /usr/local/bin/python3.10 /usr/bin/python3
 RUN cd /depends \
     && ./install_openjpeg.sh \

amazon-2023-amd64/Dockerfile

@@ -33,7 +33,8 @@ RUN yum install -y \
     zlib-devel \
     && yum clean all
 
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN wget -qO- https://sh.rustup.rs | sh -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
 
 RUN useradd --uid 1001 pillow
@@ -48,8 +49,8 @@ RUN bash -c "/usr/bin/python3.11 -m pip install virtualenv \
     && /vpy3/bin/pip install numpy --only-binary=:all: || true \
     && chown -R pillow:pillow /vpy3"
 
-ADD depends /depends
-RUN wget https://github.com/ninja-build/ninja/releases/download/v1.13.2/ninja-linux.zip \
+COPY depends /depends
+RUN wget --no-verbose https://github.com/ninja-build/ninja/releases/download/v1.13.2/ninja-linux.zip \
     && unzip ninja-linux.zip \
     && mv ninja /usr/bin
 RUN /usr/bin/python3.11 -m pip install meson

arch/Dockerfile

@@ -36,7 +36,7 @@ RUN pacman -Sy --noconfirm \
             xorg-server-xvfb \
     && find /var/cache/pacman/ -type f -delete
 
-ADD depends /depends
+COPY depends /depends
 RUN cd /depends \
      && ./install_imagequant.sh \
      && ./install_raqm.sh

arch/update.sh

@@ -1,4 +1,2 @@
 #!/bin/sh
 docker pull greyltc/archlinux
-
-

archive/centos-6-amd64/update.sh

@@ -1,3 +1,2 @@
 #!/bin/sh
 docker pull centos:6
-

archive/centos-7-amd64/update.sh

@@ -1,3 +1,2 @@
 #!/bin/sh
 docker pull centos:7
-

archive/centos-8-amd64/update.sh

@@ -1,3 +1,2 @@
 #!/bin/sh
 docker pull centos:8
-

archive/centos-stream-8-amd64/update.sh

@@ -1,3 +1,2 @@
 #!/bin/sh
 docker pull quay.io/centos/centos:stream8
-

archive/debian-10-buster-x86/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.

archive/debian-11-bullseye-amd64/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.

archive/debian-11-bullseye-x86/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.

archive/debian-12-bookworm-x86/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.

archive/debian-9-stretch-x86/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.

archive/manylinux1-wheel-build/Makefile

@@ -43,4 +43,3 @@ clean:
 .PHONY: shell
 shell:
 	docker run --rm -it -v $(ROOT):/Pillow $(IMAGENAME):$(BRANCH) /bin/bash
-

archive/manylinux1-wheel-build/README.md

@@ -32,4 +32,3 @@ other images. .
 * yum_install is syntactic sugar to make the multibuild repo work with
   the base manylinux wheel image, rather than with it's custom set of
   images
-

centos-stream-9-amd64/Dockerfile

@@ -34,7 +34,7 @@ RUN yum install -y \
 
 RUN useradd --uid 1001 pillow
 
-RUN wget https://www.python.org/ftp/python/3.10.18/Python-3.10.18.tgz \
+RUN wget --no-verbose https://www.python.org/ftp/python/3.10.18/Python-3.10.18.tgz \
     && tar xzf Python-3.10.18.tgz \
     && cd Python-3.10.18 \
     && ./configure \

debian-12-bookworm-amd64/Dockerfile

@@ -31,9 +31,11 @@ RUN echo '#!/bin/sh' > /usr/sbin/policy-rc.d \
 # Pillow customization
 #
 
-RUN apt-get -qq update && DEBIAN_FRONTEND=noninteractive apt-get -y install \
+RUN apt-get -qq update \
+    && DEBIAN_FRONTEND=noninteractive apt-get -y --no-install-recommends install \
     cmake \
-    curl \
+    g++ \
+    gcc \
     ghostscript \
     git \
     libfreetype6-dev \
@@ -58,11 +60,13 @@ RUN apt-get -qq update && DEBIAN_FRONTEND=noninteractive apt-get -y install \
     tk8.6-dev \
     virtualenv \
     wget \
+    xauth \
     xvfb \
     zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN wget -qO- https://sh.rustup.rs | sh -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
 
 RUN useradd --uid 1001 pillow \
@@ -77,7 +81,7 @@ RUN virtualenv -p /usr/bin/python3.11 --system-site-packages /vpy3 \
     && /vpy3/bin/pip install olefile pytest pytest-cov pytest-timeout \
     && chown -R pillow:pillow /vpy3
 
-ADD depends /depends
+COPY depends /depends
 RUN cd /depends && ./install_imagequant.sh && ./install_libavif.sh && ./install_raqm.sh
 
 ENV FORCE_COLOR=1

debian-12-bookworm-amd64/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.

debian-12-bookworm-x86/Dockerfile

@@ -31,9 +31,11 @@ RUN echo '#!/bin/sh' > /usr/sbin/policy-rc.d \
 # Pillow customization
 #
 
-RUN apt-get -qq update && DEBIAN_FRONTEND=noninteractive apt-get -y install \
+RUN apt-get -qq update \
+    && DEBIAN_FRONTEND=noninteractive apt-get -y --no-install-recommends install \
     cmake \
-    curl \
+    g++ \
+    gcc \
     ghostscript \
     git \
     libfreetype6-dev \
@@ -58,11 +60,13 @@ RUN apt-get -qq update && DEBIAN_FRONTEND=noninteractive apt-get -y install \
     tk8.6-dev \
     virtualenv \
     wget \
+    xauth \
     xvfb \
     zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-host=i686-unknown-linux-gnu
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN wget -qO- https://sh.rustup.rs | sh -s -- -y --default-host=i686-unknown-linux-gnu
 ENV PATH="/root/.cargo/bin:${PATH}"
 
 RUN useradd -u 1001 pillow \
@@ -77,7 +81,7 @@ RUN virtualenv -p /usr/bin/python3.11 --system-site-packages /vpy3 \
     && /vpy3/bin/pip install olefile pytest pytest-cov pytest-timeout \
     && chown -R pillow:pillow /vpy3
 
-ADD depends /depends
+COPY depends /depends
 RUN cd /depends && ./install_imagequant.sh && ./install_libavif.sh && ./install_raqm.sh
 
 ENV FORCE_COLOR=1

debian-12-bookworm-x86/README.txt

@@ -1,3 +1,3 @@
-Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL. 
+Update.sh sourced from https://github.com/docker-32bit/debian, and is distributed under the GPL.
 
-Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot. 
+Note that this update script requires sudo access due to the permissions required in the debbootstrap stage and the chroot.