This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 2e62fd86037 Mount the checkout read-only in the hadolint and RAT prek
hooks (#76162)
2e62fd86037 is described below
commit 2e62fd8603753b86a72db6f4b42c2cb3547d2646
Author: Jarek Potiuk <[email protected]>
AuthorDate: Sat Oct 31 19:53:36 2026 +0100
Mount the checkout read-only in the hadolint and RAT prek hooks (#76162)
Both containers only read the tree, but mounted it writable. A
container-gateway refuses a writable bind of a checkout root, since it would
let the container rewrite .claude/settings.json, .git/hooks and similar files
that run code outside the agent sandbox, so the two hooks failed under it in
every checkout and agent worktree.
Generated-by: Claude Opus 5
---
scripts/ci/prek/check_license.py | 2 +-
scripts/ci/prek/lint_dockerfile.py | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/ci/prek/check_license.py b/scripts/ci/prek/check_license.py
index 1eb3470f682..944f5546d67 100755
--- a/scripts/ci/prek/check_license.py
+++ b/scripts/ci/prek/check_license.py
@@ -32,7 +32,7 @@ cmd = [
"docker",
"run",
"-v",
- f"{AIRFLOW_ROOT_PATH}:/opt/airflow",
+ f"{AIRFLOW_ROOT_PATH}:/opt/airflow:ro",
"-t",
"--user",
f"{os.getuid()}:{os.getgid()}",
diff --git a/scripts/ci/prek/lint_dockerfile.py
b/scripts/ci/prek/lint_dockerfile.py
index ecf5254c461..854eb833485 100755
--- a/scripts/ci/prek/lint_dockerfile.py
+++ b/scripts/ci/prek/lint_dockerfile.py
@@ -30,7 +30,7 @@ cmd = [
"docker",
"run",
"-v",
- f"{AIRFLOW_ROOT_PATH}:/root",
+ f"{AIRFLOW_ROOT_PATH}:/root:ro",
"-w",
"/root",
"--rm",
