Feat: Add scan toggles, rename the lint job

[ModeSevenIndustrialSolutions]

Summary

Three related changes bringing this repo into line with the rest of the workflow estate.

1. Rename the audit job to dockerfile-lint

The audit job runs hadolint against Dockerfiles. It does not audit dependencies. Everywhere else in the estate audit_* means "dependency audit" (pip-audit, govulncheck, npm audit), so the same prefix meant two different things depending on which family you were reading.

• Job id audit → dockerfile-lint
• New lint_enabled (default true) and lint_permit_fail (default false)
• audit_permit_fail retained as a deprecated alias, so existing callers keep working:

  NO_BLOCK: ${{ inputs.lint_permit_fail || inputs.audit_permit_fail || vars.NO_BLOCK_AUDIT_FAIL == 'true' }}

Branch protection is unaffected. The job's name: is already 'Dockerfile Lint' and is unchanged; check names derive from the display name, not the job id. The id is internal to the reusable workflow.

Note this repo has no dependency-audit job by design — for containers that role is filled by the image SBOM + Grype lane. Freeing the audit_* prefix makes that clear rather than implying a missing lane.

2. Add sbom_enabled and grype_enabled

Neither stage could previously be skipped. Both default true.

grype_enabled is independent of sbom_enabled, so the image SBOMs are still generated and uploaded when only the scan is dropped. In build-test.yaml the new clause composes with the existing image_count != '0' guard rather than replacing it:

if: >-
  ${{ !cancelled() && needs.build.result == 'success'
      && needs.build.outputs.image_count != '0'
      && inputs.sbom_enabled }}

3. Fix a latent gate bug in the release lane

The tests job required success from both audit and grype:

if: ${{ ... && needs.audit.result == 'success' && needs.grype.result == 'success' }}

A skipped job does not report success, so setting either new toggle to false would have left tests permanently unrunnable. Switched to the contains(fromJSON('["success", "skipped"]'), …) idiom already used by python-workflows, go-workflows and node-workflows. The gating inversion is preserved — a lint or scan that runs and fails still blocks tests.

Compatibility

All new inputs default to current behaviour. audit_permit_fail still works. No inputs removed.

Also updated

README.md job-graph diagrams and input table, and examples/build-test/github.yaml.

Validation

• yamllint, actionlint — clean (actionlint resolves the renamed needs.dockerfile-lint reference)
• zizmor --persona=auditor — No findings to report
• markdown-table-fixer lint README.md --auto-fix — No issues found
• Full prek run over the changed files — all hooks passed

Related

Trims the scope of #35: the two Grype items that issue lists (Grype audit SBOMs 63×2, Grype summary 13×2 — 152 of the 262 lines) were already resolved by the migration to grype-scan-action. The genuinely duplicated blocks remaining are Generate image SBOMs, Lint Dockerfiles (hadolint) and Require Gerrit project, branch and URL. I will update that issue separately.

Context

Part of a seven-PR series standardising these toggles across the workflow estate. Companions: lfreleng-actions/workflows-template#56, lfreleng-actions/python-workflows#85, lfreleng-actions/go-workflows#67, lfreleng-actions/node-workflows#83, lfreleng-actions/java-workflows#45.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Standardizes Docker workflow controls and naming across the workflow estate.

Changes:

• Renames audit to dockerfile-lint while retaining a deprecated input alias.
• Adds lint, SBOM, and Grype toggles.
• Updates release gating and documentation.

File summaries

File	Description
README.md	Documents job graphs and inputs.
examples/build-test/github.yaml	Demonstrates new toggles.
.github/workflows/build-test.yaml	Adds toggles and renames the lint job.
.github/workflows/build-test-release.yaml	Adds toggles and adjusts release gating.

Review details

Suppressed comments (2)

.github/workflows/build-test-release.yaml:1481

• A skipped Grype job does not necessarily mean the scan was disabled: when SBOM generation fails, line 1423 skips Grype as well. Accepting every skipped result lets the tests gate pass after an SBOM failure, contrary to the preserved gating behavior. Only accept skipped when sbom_enabled or grype_enabled was explicitly disabled.

    if: ${{ !cancelled() && needs.build.result == 'success' && contains(fromJSON('["success", "skipped"]'), needs.dockerfile-lint.result) && contains(fromJSON('["success", "skipped"]'), needs.grype.result) }}

.github/workflows/build-test-release.yaml:1473

• This updated comment still labels hadolint as an “audit,” although the purpose of the job rename is to reserve that term for dependency audits. Describe these as the lint and scan gates instead.

    # Deferred until the audit operations (hadolint and Grype) pass,
    # so the expensive test hook is skipped when either audit fails
    # (gating inversion: audits gate tests on releases). A DISABLED
    # lint or scan must not block tests, so a skipped result is
    # permitted alongside success.

• Files reviewed: 4/4 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🟢 Approval recommended

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[zxiiro]

🤖 Auto-approved by agent: reviewed workflow/code change for security and CI/CD impact, found low risk. Renames internal lint job, keeps audit_permit_fail as deprecated alias, adds lint/sbom/grype toggles defaulting to true. No permission/secret/pin changes; skip-vs-fail gating still blocks on real failures.