You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(ci): record the scanner versions MegaLinter now runs - #5847
The main branch check is red. The organization's shared lint workflow now scans this repository with newer scanner releases than the ones the platform records. The guard that compares the two stops main until they match again.
What
Records the scanner releases the shared workflow now runs, and moves the local vendoring check with them, so main is green again. Re-measuring the scan baseline on the new releases is still to do (#5849). The new required scan findings are tracked separately in #5843.
Validate Main fails on main because the organization's Go workflow now runs
MegaLinter 10.1.0 (checkov 3.3.15, trivy 0.74.0) for this repository, while
the recorded constants still name 10.0.0 (3.3.9, 0.73.0). Move the three
constants and the vendored-operator checkov pin together, as the guard and
the pin's own comment require.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pending baseline measurement now has an open delivery record: #5849, linked as a native child of #5843. #2787 is closed, so it no longer tracks the remeasurement mentioned in this PR. The follow-up retains exact scanner versions, complete framework/parse coverage, a same-tree comparison for changed counts, coupled vendoring validation and post-merge hosted acceptance. Updating these constants does not by itself establish a clean scan or complete that follow-up.
"--help"]
github_actions scan results:
Passed checks: 941, Failed checks: 3, Skipped checks: 0
Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. "
FAILED for resource: on(Verify Alert Publisher App)
File: /.github/workflows/verify-alert-publisher-app.yaml:9-15
9 | confirm:
10 | description: "Type exactly: verify-alert-publisher-read-only"
11 | required: true
12 | type: string
13 |
14 | permissions: {}
15 |
Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. "
FAILED for resource: on(🗂️ Stale Issue Triage)
File: /.github/workflows/stale-issues.yaml:11-17
11 | dry-run:
12 | description: Preview without changing issues or saved progress.
13 | type: boolean
14 | default: true
15 |
16 | permissions: {}
17 |
Check: CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. "
FAILED for resource: on(Prove Cilium Default Deny)
File: /.github/workflows/prove-cilium-default-deny.yaml:8-26
8 | confirm:
9 | description: Type RUN_DISPOSABLE_CILIUM_PROOF after approving this run
10 | required: true
11 | type: string
12 | workflow_head:
13 | description: Exact approved main SHA containing the proof workflow
14 | required: true
15 | type: string
16 | candidate_pr:
17 | description: Trusted same-repository candidate PR number
18 | required: true
19 | type: string
20 | candidate_head:
21 | description: Exact 40-character candidate PR head SHA
22 | required: true
23 | type: string
24 |
25 | permissions: {}
26 |
(Truncated to last 2105 characters out of 21015)
❌ HTML / djlint - 8 errors
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H011 Attribute values should be quoted.
::warning file=scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html,line=1::H025 Tag seems to be an orphan.
k8s/bases/infrastructure/controllers/kyverno/BackgroundDownstreamCleanup.Dockerfile:32 DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile:33 DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile:49 DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
k8s/bases/infrastructure/coroot/CorootCheckpoint.Dockerfile:9 DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
❌ HTML / htmlhint - 21 errors
ico...
^ The value of attribute [ href ] must be in double quotes. (attr-value-double-quotes)
L1 |...icon-16x16.png><link rel="shortcut icon" href=favicon.ico><script defer src=bundle.main.60a3ef75467cd...
^ The value of attribute [ href ] must be in double quotes. (attr-value-double-quotes)
L1 |...cut icon" href=favicon.ico><script defer src=bundle.main.60a3ef75467cd3b8a057.js></script><link href=...
^ The value of attribute [ src ] must be in double quotes. (attr-value-double-quotes)
L1 |...nk rel="shortcut icon" href=favicon.ico><script defer src=bundle.main.60a3ef75467cd3b8a057.js></scrip...
^ The <script> tag cannot be used in a <head> tag. (head-script-disabled)
L1 |...n.60a3ef75467cd3b8a057.js></script><link href=bundle.main.841ee8bbb7cc9d85b79e.css rel=stylesheet></h...
^ The value of attribute [ href ] must be in double quotes. (attr-value-double-quotes)
L1 |...ref=bundle.main.841ee8bbb7cc9d85b79e.css rel=stylesheet></head><body><div id=app class=test></div></b...
^ The value of attribute [ rel ] must be in double quotes. (attr-value-double-quotes)
L1 |...79e.css rel=stylesheet></head><body><div id=app class=test></div></body></html>
^ The value of attribute [ id ] must be in double quotes. (attr-value-double-quotes)
L1 |... rel=stylesheet></head><body><div id=app class=test></div></body></html>
^ The value of attribute [ class ] must be in double quotes. (attr-value-double-quotes)
L1 |...ody><div id=app class=test></div></body></html>
^ Tag must be paired, no start tag: [ </html> ] (tag-pair)
Scanned 1 files, found 21 errors in 1 files (16 ms)
(Truncated to last 2105 characters out of 5427)
e comment
scripts/migrate-longhorn-v2/api.go:1:1: should have a package comment
scripts/verify-email-data-recovery/forward.go:1:1: should have a package comment
internal/backupcatalogue/transport.go:21:6: exported type Policy should have comment or be unexported
internal/backupcatalogue/transport.go:56:1: exported function NewReadTransport should have comment or be unexported
internal/backupcatalogue/transport.go:169:1: exported method ReadTransport.RoundTrip should have comment or be unexported
internal/backupcatalogue/transport.go:285:1: exported method ReadTransport.Close should have comment or be unexported
scripts/replace-wedding-standby/cluster_transport.go:1:1: should have a package comment
scripts/openbao-backup-recovery/collector.go:1:1: should have a package comment
scripts/expand-openbao-audit/price.go:1:1: should have a package comment
scripts/verify-email-storage-canary/resources.go:1:1: should have a package comment
scripts/verify-arc-app-identity/verify.go:1:1: should have a package comment
scripts/validate-feature-flags/main.go:1:1: should have a package comment
scripts/verify-email-data-recovery/main.go:1:1: should have a package comment
scripts/tests/webapp-compiler/tenant_ownership_test.go:48:45: context.Context should be the first parameter of a function
scripts/validate-merge-group-heal/flux_bridge_test.go:186:3: redefinition of the built-in function copy
scripts/validate-eks-ci-role-policy/approval_summary.go:1:1: should have a package comment
scripts/migrate-longhorn-v2/capacity.go:1:1: should have a package comment
scripts/observe-crossplane-recovery/main.go:1:1: should have a package comment
scripts/reconcile-talos-kernel-args/main_test.go:873:2: redefinition of the built-in function real
scripts/validate-merge-group-heal/production_outcome.go:1:1: should have a package comment
scripts/retire-arc-pool/proof.go:1:1: should have a package comment
scripts/tests/openbao-transport-runtime/tls_test.go:138:58: redefinition of the built-in function min
scripts/tests/openbao-transport-runtime/tls_test.go:138:63: redefinition of the built-in function max
(Truncated to last 2105 characters out of 34871)
In scripts/bootstrap-tenant-source.sh line 247:
[ -r "$OUTPUT" ] && [ ! -L "$OUTPUT" ] || return 1
^-----^ SC2153 (info): Possible misspelling: OUTPUT may not be assigned. Did you mean output?
For more information:
https://www.shellcheck.net/wiki/SC2153 -- Possible misspelling: OUTPUT may ...
❌ REPOSITORY / trivy - 1 error
──────────────────
11 ┌ - name: fixture
12 └ image: registry.k8s.io/pause:3.10
────────────────────────────────────────
KSV-0118 (HIGH): pod coroot-dns-probe in observability namespace is using the default security context, which allows root privileges
════════════════════════════════════════
Security context controls the allocation of security parameters for the pod/container/volume, ensuring the appropriate level of protection. Relying on default security context may expose vulnerabilities to potential attacks that rely on privileged access.
See https://avd.aquasec.com/misconfig/ksv-0118
────────────────────────────────────────
scripts/tests/fixtures/coroot-dns-probe/pod.yaml:9-12
────────────────────────────────────────
9 ┌ spec:
10 │ containers:
11 │ - name: fixture
12 └ image: registry.k8s.io/pause:3.10
────────────────────────────────────────
scripts/tests/fixtures/wedding-database-priority/cluster.yaml (kubernetes)
==========================================================================
Tests: 118 (SUCCESSES: 117, FAILURES: 1)
Failures: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
KSV-0040 (LOW): A resource quota policy with hard memory and CPU limits should be configured per namespace
════════════════════════════════════════
Ensure that a ResourceQuota policy is configured to limit aggregate resource usage within a namespace
See https://avd.aquasec.com/misconfig/ksv-0040
────────────────────────────────────────
scripts/tests/fixtures/wedding-database-priority/cluster.yaml:6-15
────────────────────────────────────────
6 ┌ spec:
7 │ instances: 3
8 │ storage:
9 │ size: 1Gi
10 │ storageClass: longhorn-wffc
11 │ plugins:
12 │ - name: barman-cloud.cloudnative-pg.io
13 │ isWALArchiver: true
14 │ parameters:
15 └ barmanObjectName: dedicated-backups
────────────────────────────────────────
📣 Notices:
- Version 0.76.1 of Trivy is now available, current version is 0.74.0
To suppress version checks, run Trivy scans with the --skip-version-check flag
(Truncated to last 2105 characters out of 984070)
❌ YAML / v8r - 1 error
✖ scripts/tests/fixtures/wedding-database-priority/cluster.yaml is invalid
scripts/tests/fixtures/wedding-database-priority/cluster.yaml# must NOT have additional properties, found additional property 'apiVersion'
scripts/tests/fixtures/wedding-database-priority/cluster.yaml# must NOT have additional properties, found additional property 'kind'
scripts/tests/fixtures/wedding-database-priority/cluster.yaml# must NOT have additional properties, found additional property 'metadata'
scripts/tests/fixtures/wedding-database-priority/cluster.yaml# must NOT have additional properties, found additional property 'spec'
a4bc0b73d1f32bc45510 # v3.3.0
| ------------------------------------------------------------------------ app token requested here
...
203 | owner: devantler-tech
| ^^^^^^^^^^^^^^^^^^^^^ token granted access to all repositories for this owner's app installation
|
= note: audit confidence → High
= tip: use `repositories: 'repo1,repo2'` to scope the token to specific repositories
= help: audit documentation → https://docs.zizmor.sh/audits/#github-app
error[github-app]: dangerous use of GitHub App tokens
--> .github/workflows/regenerate-publish-workflow-approved-revisions.yaml:78:11
|
66 | uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
| ------------------------------------------------------------------------ app token requested here
...
78 | owner: ${{ github.repository_owner }}
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ token granted access to all repositories for this owner's app installation
|
= note: audit confidence → High
= tip: use `repositories: 'repo1,repo2'` to scope the token to specific repositories
= help: audit documentation → https://docs.zizmor.sh/audits/#github-app
error[github-app]: dangerous use of GitHub App tokens
--> .github/workflows/regenerate-publish-workflow-approved-revisions.yaml:98:11
|
91 | uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
| ------------------------------------------------------------------------ app token requested here
...
98 | owner: ${{ github.repository_owner }}
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ token granted access to all repositories for this owner's app installation
|
= note: audit confidence → High
= tip: use `repositories: 'repo1,repo2'` to scope the token to specific repositories
= help: audit documentation → https://docs.zizmor.sh/audits/#github-app
40 findings (35 suppressed): 0 informational, 0 low, 0 medium, 5 high
No fixes available to apply.
(Truncated to last 2105 characters out of 9984)
⚠️ BASH / bash-exec - 18 errors
te-publish-workflow-matchers.sh
✅ [SUCCESS] scripts/update-vendored-operators.sh
✅ [SUCCESS] scripts/use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/validate-alert-coverage.sh
✅ [SUCCESS] scripts/validate-embedded-json.sh
✅ [SUCCESS] scripts/validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/validate-kyverno-fixture-evaluation.sh
❌ [ERROR] scripts/validate-webapp-inputs.sh
Error: File:[scripts/validate-webapp-inputs.sh] is not executable
✅ [SUCCESS] scripts/verify-arc-transport.sh
✅ [SUCCESS] scripts/verify-data-product-rollout.sh
❌ [ERROR] scripts/verify-email-provider/probe-client.sh
Error: File:[scripts/verify-email-provider/probe-client.sh] is not executable
❌ [ERROR] scripts/verify-email-provider/run.sh
Error: File:[scripts/verify-email-provider/run.sh] is not executable
✅ [SUCCESS] scripts/verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/verify-heartbeat-cleanup.sh
✅ [SUCCESS] scripts/verify-image-unsigned.sh
✅ [SUCCESS] scripts/verify-kubelet-config-readback.sh
✅ [SUCCESS] scripts/verify-matcher-accepts-digest.sh
❌ [ERROR] scripts/verify-private-mail-storage-recovery.sh
Error: File:[scripts/verify-private-mail-storage-recovery.sh] is not executable
✅ [SUCCESS] scripts/verify-prod-recovery-source.sh
✅ [SUCCESS] scripts/verify-published-evidence.sh
❌ [ERROR] scripts/verify-shared-backup-consumers.sh
Error: File:[scripts/verify-shared-backup-consumers.sh] is not executable
✅ [SUCCESS] scripts/verify-talos-schematic-readback.sh
✅ [SUCCESS] scripts/verify-umami-tracking.sh
✅ [SUCCESS] scripts/verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial-pod.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage-pod.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/wait-for-platform-flux-revision.sh
✅ [SUCCESS] scripts/wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/write-publish-workflow-matchers.sh
✅ [SUCCESS] tests/kyverno-stale-report-prune/assert-probe-result.sh
(Truncated to last 2105 characters out of 25906)
⚠️ SPELL / cspell - 1 error
pdatekeys",
"upjet",
"uprobe",
"uprobes",
"urandom",
"urlencode",
"usec",
"userextras",
"userinfo",
"userns",
"ushfn",
"validatable",
"validatealertcoverage",
"validatingadmissionpolicies",
"validatingadmissionpolicybindings",
"validatingpolicies",
"validatingpolicy",
"validatingwebhookconfigurations",
"valuesfrom",
"vanything",
"vbmx",
"vcluster",
"vcunav",
"vdual",
"velero",
"velero's",
"verticalpodautoscalers",
"vfio",
"virt",
"volumeattachments",
"volumeattributesclasses",
"volumeconfig",
"volumegroupsnapshotclasses",
"volumegroupsnapshotcontents",
"volumegroupsnapshots",
"volumesnapshot",
"volumesnapshotclasses",
"volumesnapshotcontents",
"volumesnapshots",
"volumestatus",
"vpas",
"vpol",
"vpolengine",
"vulnerabilitymanifests",
"vulnerabilitymanifestsummaries",
"vulnerabilitymanifestsummary",
"vulns",
"wailsapp",
"wals",
"webadmin",
"webapps",
"webui",
"wffc",
"wgpolicyk",
"wildcarded",
"wildcarding",
"wireids",
"wlan",
"wlid",
"wmem",
"workloadconfigurationscan",
"workloadconfigurationscans",
"workloadconfigurationscansummaries",
"workloadconfigurationscansummary",
"worktree",
"worktrees",
"wraparg",
"wrapctl",
"wrapopt",
"wrongns",
"wrongowner",
"xcheckov",
"xcrun",
"xcrun's",
"xform",
"xlated",
"xoxb",
"xpkg",
"xprov",
"xtrace",
"yamlutil",
"yannh",
"yubikey",
"yzwvjjmcyfnl",
"zizmor",
"\u017ftatus"
]
}
You can also copy-paste megalinter-reports/.cspell.json at the root of your repository
(Truncated to last 2105 characters out of 3344390)
/ (at 109:27) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 102:17) | Connection refused - server may be down or port blocked
Errors in .github/workflows/verify-email-storage-key-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 109:17) | Error (cached)
Errors in .github/workflows/verify-openbao-backup-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 113:17) | Error (cached)
Errors in docs/costs.md
[404] https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/#cloud-servers (at 24:27) | Rejected status code: 404 Not Found
Errors in scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html
[ERROR] error: (at 1:78) | Cannot resolve root-relative link '/': To resolve root-relative links in local files, provide a root dir
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/bundle.main.841ee8bbb7cc9d85b79e.css (at 1:536) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-16x16.png (at 1:401) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-32x32.png (at 1:336) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon.ico (at 1:450) | File not found. Check if file exists and path is correct
Errors in talos/control-planes/wireguard.yaml
[404] https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ (at 48:5) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ --[308]--> https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig
Hint: Followed 12 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
(Truncated to last 2105 characters out of 6311)
⚠️ MARKDOWN / markdownlint - 100 errors
Line length [Expected: 400; Actual: 505]
k8s/bases/README.md:10:141 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:39 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:138 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:91 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:207 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:9:234 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/alert-publisher/README.md:90 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "4683. It uses the maintained A..."]
scripts/alert-publisher/README.md:90:75 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ',']
scripts/alert-publisher/README.md:161 error MD001/heading-increment Heading levels should only increment by one level at a time [Expected: h2; Actual: h3]
scripts/judge-openbao-quorum/README.md:25:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
scripts/README.md:15:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:16:185 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:98 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:20:255 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
(Truncated to last 2105 characters out of 11292)
⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.
Cleared 2026-11-04: re-verified 09:18Z: the fix platform#5853 merged 08:01Z; at head 60e6c6f every required check passes (CLEAN). #5843 stays open for its remaining follow-up (#5849), which this PR does not depend on.
Previous record (historical):
> 🤖 Generated by the Agentic Engineer
<!-- pr-blocker-record -->
**Blocker cleared 2026-11-04 08:5xZ:** platform#5853 merged at 08:01Z, so the repository-wide findings from #5843 no longer fail the required MegaLinter run. At head `60e6c6f0` all 42 checks pass, merge state is `CLEAN`, there are no open review threads, and a local review round is GREEN at that head (CodeRabbit rate-limited, Codex and Cursor Bugbot at usage limits). Promoting and merging to turn main's `Validate Scanner Versions` green. Re-measuring the checkov baseline on the new versions stays on #2787.
CodeRabbit: rate-limited at 2026-11-04T08:28:01Z, retry window until 09:16:58Z (review-lane-health, portfolio-wide); no CodeRabbit artifact on this PR at any head.
Codex: usage limit since 2026-11-04T08:07:43Z (review-lane-health); recovers only when the maintainer lifts it.
Cursor Bugbot: usage limit since 2026-11-04T08:07:41Z (review-lane-health); recovers only when the maintainer lifts it.
Checked:
The three recorded constants now equal what main's failing Validate Scanner Versions job read from the live MegaLinter run (run 41796302144): MegaLinter 10.1.0, checkov 3.3.15, trivy 0.74.0.
scripts/update-vendored-operators.sh moves its checkov pin to 3.3.15 in the same commit, as its own same-pin guard requires.
No other script still pins checkov 3.3.9 or trivy 0.73.0 at this head.
nit (outside the diff): the .trivyignore.yaml:128 comment still says CI runs trivy 0.73.0 on MegaLinter 10.0.0. It is prose only; the re-measurement in #2787 is the place to refresh it.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
The scanner versions and vendored Checkov pin are aligned with the stated update.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly summarizes the main change: recording the scanner versions used by MegaLinter in CI.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Description check
The description states that the main-branch check is failing because the shared lint workflow runs newer scanner releases than the ones the platform records. It says the fix records the new scanner re…
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files.
Full details: Description check
Explanation
The description states that the main-branch check is failing because the shared lint workflow runs newer scanner releases than the ones the platform records. It says the fix records the new scanner releases (Checkov 3.3.15, Trivy 0.74.0, MegaLinter 10.1.0) and moves the local vendoring check to match. This aligns with the raw summary of changes to scripts/megalinter-scan-counts.sh and scripts/update-vendored-operators.sh. It also says re-measuring the scan baseline is still pending and points to follow-up issues, which sets accurate scope.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Reviewing files that changed from the base of the PR and between 28794fb and 60e6c6f.
Files selected for processing: 2
scripts/megalinter-scan-counts.sh
scripts/update-vendored-operators.sh
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Context from checks skipped due to timeout: 1
GitHub Check: CodeRabbit
Additional context used
Learnings: 1
Learning: 2026-08-17T12:41:36.470Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 3193
File: scripts/megalinter-scan-counts.sh:50-51
Timestamp: 2026-08-17T12:41:36.470Z
Learning: In `scripts/update-vendored-operators.sh`, the Checkov version pin is enforced and can block the vendor-refresh path when it differs from CI’s `CI_CHECKOV_VERSION`. Updating this pin requires an end-to-end rescan of both vendored bundles. Any changed Checkov evaluated keys or resource fingerprints must be reviewed against the upstream resources before updating `scripts/annotate-vendored-checkov/main.go` data. GitHub issue #3194 tracks this work and a guard for drift between these pins.
Review: CodeRabbit reviewed this head at 09:20Z, after the 09:17Z request, and found no actionable comments. There are no unresolved threads.
CI: every required check passes at this head, including --validate-committed, which refuses a Checkov pin that differs between the two files. mergeStateStatus is CLEAN.
Tried as a user: main's red 🔢 Validate Scanner Versions run (41796302144) prints the exact constants it expects: MegaLinter 10.1.0, Checkov 3.3.15 and Trivy 0.74.0. This PR records exactly those values. The guard runs only on main, so the post-merge Validate Main run is the confirmation. I will check it after merge.
Verified after merge: Validate Main run 41824603562 at merge commit 85206b13 passed, including 🔢 Validate Scanner Versions. Platform main is green again. The baseline re-measurement stays on #5849.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
devantler
left a comment
Why
The main branch check is red. The organization's shared lint workflow now scans this repository with newer scanner releases than the ones the platform records. The guard that compares the two stops main until they match again.
What
Records the scanner releases the shared workflow now runs, and moves the local vendoring check with them, so main is green again. Re-measuring the scan baseline on the new releases is still to do (#5849). The new required scan findings are tracked separately in #5843.
No issue: trivial fix.