Add dockerfile and actions security linting

Author: dflook

.github/workflows/test.yaml

@@ -97,6 +97,14 @@ jobs:
           ./actionlint
           ./actionlint example_workflows/*.yaml
 
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@f94ec6bedd8674c4426838e6b50417d36b6ab231 # v5
+      - name: Actions Security Check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          uvx zizmor --format plain .
+
       - name: Lint CHANGELOG
         uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19
         with:
@@ -111,15 +119,19 @@ jobs:
             docs/*.md
             **/README.md
 
-  ensure-pinned-actions:
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Ensure SHA pinned actions
+      - name: ensure-sha-pinned-actions
         uses: zgosalvez/github-actions-ensure-sha-pinned-actions@25ed13d0628a1601b4b44048e63cc4328ed03633 # v3
         with:
           allowlist: |
             actions/
             dflook/
+
+      - name: Lint Dockerfile
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: ./image/Dockerfile
+
+      - name: Lint Dockerfile
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: ./image/Dockerfile-base

image/Dockerfile

@@ -1,3 +1,4 @@
+# hadolint ignore=DL3007
 FROM danielflook/terraform-github-actions-base:latest
 
 ARG TARGETARCH
@@ -8,7 +9,7 @@ ARG VERSION=99.0.0
 COPY src/ /tmp/src/
 COPY setup.py /tmp
 RUN sed -i "s|version='.*'|version=\'${VERSION}\'|" /tmp/setup.py \
- && pip install /tmp \
+ && pip install --no-cache-dir /tmp \
  && rm -rf /tmp/src /tmp/setup.py
 
 RUN if [ "$FETCH_CHECKSUMS" = "yes" ]; then \

image/Dockerfile-base

@@ -1,5 +1,6 @@
 FROM golang:1.12.6 AS tfmask
 
+# hadolint ignore=DL3003
 RUN git clone https://github.com/cloudposse/tfmask.git \
  && cd tfmask \
  && git checkout 9a15f421210397f2c321a57b5ed3d108a012a86d \
@@ -14,6 +15,8 @@ ENV TF_IN_AUTOMATION=true
 ENV TF_INPUT=false
 ENV TF_PLUGIN_CACHE_DIR=/usr/local/share/terraform/plugin-cache
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+# hadolint ignore=DL3008
 RUN <<EOF
  apt-get update
  apt-get install --no-install-recommends -y \