DL3057 checks that images produced in multistage builds have a
healthcheck (if the rule is enabled). But if one stage already has the
healthcheck instruction, the other stages should not trigger a warning.
If the stage comes earlier, it's obviously not used as a build result,
therefore doesn't need a healthcheck instruction on its own.
If the stage comes later, it will inherit the healthcheck instruction
from the stage that has it.

This fix works because when a healthcheck is found in a build stage,
that stage is marked as good, but also all stages it inherited from are
also marked as good. Only stages that don't inherit the healthcheck
instruction remain marked as bad, if they don't have the instruction
themselves. Therefore Dockerfiles, which produce multiple images are
also considered.

fixes: #843
Signed-off-by: Moritz Röhrich moritz.rohrich@suse.com

How to verify it

This does not trigger DL3057 at all anymore:

FROM opensuse/leap:15.4 AS base0
FROM base0 AS base1
HEALTHCHECK NONE
FROM base1

This triggers for the last stage only:

FROM opensuse/leap:15.4 AS base0
FROM base0 AS base1
FROM base1 AS base2.1
HEALTHCHECK NONE

FROM base1 AS base2.2