{
  "id": 19544142,
  "title": "Your README is lying to you (and so is your Dockerfile)",
  "url": "https://urgent.news/2026/11/11/your-readme-is-lying-to-you-and-so-is-your-dockerfile",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-11T20:20:55.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/harshith_m_b2b8806b18627f/your-readme-is-lying-to-you-and-so-is-your-dockerfile-3hf"
  },
  "original_language": "en",
  "account": "Your README file may be misleading and so is your Dockerfile. A project I have encountered many times shows a discrepancy between the README and the pyproject.toml file. The README states that Python 3.8+ is sufficient, while the pyproject.toml file requires a minimum version of 3.10. Similarly, the Dockerfile points to the python:3.9-slim image, but the project cannot even be installed on this version. The setup guide also instructs users to run the `make lint` target, which no longer exists. Moreover, the code snippet uses the JWT_SECRET variable, which is not mentioned in the .env.example file. Every file seems fine on its own, but when taken together, they contradict each other and can confuse new contributors or cause production issues. To address this, I have developed a tool called truthlint, which cross-examines the files in a repository against each other. It is a command-line interface that checks for contradictions between files such as README, Dockerfile, CI configurations, and more. The tool is safe to use on any repository, even those cloned from strangers, as it does not run any code or rely on git. It checks for various rules across the files, such as runtime versions, documented commands, environment variables, dependencies, Docker layers, and documentation. The tool also provides an onboarding audit, walking users through the setup instructions to ensure a newcomer can follow them. Truthlint works by parsing various file formats like Markdown, TOML, YAML, Dockerfiles, and Makefiles, while also reading Python code using the ast module. It simulates enough of a shell environment to verify commands without actually executing them. The tool is available on GitHub and PyPI, and it allows users to preview fixes, apply them one by one, or export them as a patch for further review.",
  "summary": "Every file in your repository can pass its own linter while the repository as a whole lies. Here's a project I've seen a hundred times: README: \"Requires Python 3.8+\" pyproject.toml: requires-python = \">=3.10\" Dockerfile: FROM python:3.9-slim CI: tests on 3.9, a version users can't even install on Setup guide: \"run make lint \", a target that was renamed months ago The code: reads JWT_SECRET ,…",
  "key_points": [
    "README claims Python 3.8+, but pyproject.toml requires 3.10",
    "Dockerfile uses python:3.9-slim, incompatible with project",
    "Missing make lint target and JWTSECRET variable in documentation"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}