Skip to content

fix(ci): record the scanner versions MegaLinter now runs #5847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 2 commits into from
Nov 4, 2026
Merged

fix(ci): record the scanner versions MegaLinter now runs #5847

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7117287
fix(ci): record the scanner versions MegaLinter now runs
devantler Nov 3, 2026
60e6c6f
Merge branch 'main' into claude/ci-scanner-version-drift
devantler Nov 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions scripts/megalinter-scan-counts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,8 +69,8 @@ set -euo pipefail
#
# scripts/update-vendored-operators.sh pins the same Checkov version and refuses to run, including in
# CI's --validate-committed step, while its pin differs from this one. Bump both together.
readonly CI_CHECKOV_VERSION='3.3.9'
readonly CI_TRIVY_VERSION='0.73.0'
readonly CI_CHECKOV_VERSION='3.3.15'
readonly CI_TRIVY_VERSION='0.74.0'

# The MegaLinter release those two versions came from. It is not a local concept — nothing here runs
# MegaLinter — but it is what makes the pair above checkable: MegaLinter bundles both scanners AND
Expand All @@ -81,7 +81,7 @@ readonly CI_TRIVY_VERSION='0.73.0'
# Nothing in THIS repository selects it: the MegaLinter action is pinned in devantler-tech/actions,
# so all three constants go stale here when that pin moves, silently and in both directions.
# scripts/check-megalinter-version-drift.sh is the CI-side guard that catches it (#2853).
readonly CI_MEGALINTER_VERSION='10.0.0'
readonly CI_MEGALINTER_VERSION='10.1.0'

# The frameworks MegaLinter's checkov run reports, and their current contribution to the CI total.
#
Expand Down
2 changes: 1 addition & 1 deletion scripts/update-vendored-operators.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ readonly cert_approver_image_digest='sha256:445a8e5584f659701092d2ec8b625da8929d
# refresh cannot miss a rule that the non-blocking CI scan knows. Every mode,
# --validate-committed included, refuses to run while the two differ, so a bump
# of either pin fails CI until the other moves with it.
readonly checkov_version='3.3.9'
readonly checkov_version='3.3.15'
# CKV2_K8S_6 only understands networking.k8s.io NetworkPolicy. An isolated
# bundle scan cannot see that cilium-network-policy.yaml protects every CDI
# endpoint; the full-repository CI scan remains unskipped and owns graph checks.
Expand Down
Loading