From 7117287a1445df37dc27ae18ff38554bb10246d5 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 3 Nov 2026 18:48:43 +0100 Subject: [PATCH] fix(ci): record the scanner versions MegaLinter now runs Validate Main fails on main because the organization's Go workflow now runs MegaLinter 10.1.0 (checkov 3.3.15, trivy 0.74.0) for this repository, while the recorded constants still name 10.0.0 (3.3.9, 0.73.0). Move the three constants and the vendored-operator checkov pin together, as the guard and the pin's own comment require. Co-Authored-By: Claude Opus 5.5 --- scripts/megalinter-scan-counts.sh | 6 +++--- scripts/update-vendored-operators.sh | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/megalinter-scan-counts.sh b/scripts/megalinter-scan-counts.sh index 024fa66771..a15057bf8e 100755 --- a/scripts/megalinter-scan-counts.sh +++ b/scripts/megalinter-scan-counts.sh @@ -69,8 +69,8 @@ set -euo pipefail # # scripts/update-vendored-operators.sh pins the same Checkov version and refuses to run, including in # CI's --validate-committed step, while its pin differs from this one. Bump both together. -readonly CI_CHECKOV_VERSION='3.3.9' -readonly CI_TRIVY_VERSION='0.73.0' +readonly CI_CHECKOV_VERSION='3.3.15' +readonly CI_TRIVY_VERSION='0.74.0' # The MegaLinter release those two versions came from. It is not a local concept — nothing here runs # MegaLinter — but it is what makes the pair above checkable: MegaLinter bundles both scanners AND @@ -81,7 +81,7 @@ readonly CI_TRIVY_VERSION='0.73.0' # Nothing in THIS repository selects it: the MegaLinter action is pinned in devantler-tech/actions, # so all three constants go stale here when that pin moves, silently and in both directions. # scripts/check-megalinter-version-drift.sh is the CI-side guard that catches it (#2853). -readonly CI_MEGALINTER_VERSION='10.0.0' +readonly CI_MEGALINTER_VERSION='10.1.0' # The frameworks MegaLinter's checkov run reports, and their current contribution to the CI total. # diff --git a/scripts/update-vendored-operators.sh b/scripts/update-vendored-operators.sh index 83545dcdf4..0d9899c405 100755 --- a/scripts/update-vendored-operators.sh +++ b/scripts/update-vendored-operators.sh @@ -30,7 +30,7 @@ readonly cert_approver_image_digest='sha256:445a8e5584f659701092d2ec8b625da8929d # refresh cannot miss a rule that the non-blocking CI scan knows. Every mode, # --validate-committed included, refuses to run while the two differ, so a bump # of either pin fails CI until the other moves with it. -readonly checkov_version='3.3.9' +readonly checkov_version='3.3.15' # CKV2_K8S_6 only understands networking.k8s.io NetworkPolicy. An isolated # bundle scan cannot see that cilium-network-policy.yaml protects every CDI # endpoint; the full-repository CI scan remains unskipped and owns graph checks.