Repository navigation
Update oxsecurity/megalinter action to v10.2.0 - #194
Merged
Merged
Conversation
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| actionlint | 4 | 2 | 0 | 0.07s | |||
| ✅ ACTION | zizmor | 4 | 0 | 0 | 1.94s | ||
| ✅ COPYPASTE | jscpd | yes | no | no | 0.85s | ||
| ✅ JAVASCRIPT | eslint | 11 | 0 | 0 | 1.03s | ||
| ✅ JSON | jsonlint | 8 | 0 | 0 | 0.12s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.72s | ||
| ✅ JSON | prettier | 8 | 0 | 0 | 0.53s | ||
| ✅ JSON | v8r | 8 | 0 | 0 | 16.5s | ||
| markdownlint | 7 | 19 | 0 | 1.26s | |||
| markdown-table-formatter | 7 | 1 | 0 | 0.33s | |||
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.82s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 20.48s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | ||
| ✅ REPOSITORY | grype | yes | no | no | 89.6s | ||
| ✅ REPOSITORY | osv-scanner | yes | no | no | 0.65s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.27s | ||
| ✅ REPOSITORY | syft | yes | no | no | 2.85s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 12.91s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.34s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 4.02s | ||
| ✅ SPELL | cspell | 39 | 0 | 0 | 4.34s | ||
| lychee | 26 | 4 | 0 | 0.78s | |||
| ✅ TYPESCRIPT | eslint | 1 | 0 | 0 | 0.46s | ||
| ✅ TYPESCRIPT | prettier | 1 | 0 | 0 | 0.73s | ||
| ts-standard | 1 | 1 | 0 | 0.72s | |||
| ✅ YAML | prettier | 9 | 0 | 0 | 0.78s | ||
| ✅ YAML | v8r | 9 | 0 | 0 | 9.94s | ||
| ✅ YAML | yamllint | 9 | 0 | 0 | 0.75s |
Detailed Issues
⚠️ ACTION / actionlint - 2 errors
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:15: Double quote to prevent globbing and word splitting [shellcheck]
|
55 | run: sudo chown -R $USER:$USER .
| ^~~~
.github/workflows/github-dependents-info.yml:55:9: shellcheck reported issue in this script: SC2086:info:1:21: Double quote to prevent globbing and word splitting [shellcheck]
|
55 | run: sudo chown -R $USER:$USER .
| ^~~~
⚠️ SPELL / lychee - 4 errors
📝 Summary
---------------------
🔍 Total...........75
🔗 Unique..........63
✅ Successful......24
⏳ Timeouts.........0
🔀 Redirected.......7
👻 Excluded........47
❓ Unknown..........0
🚫 Errors...........4
⛔ Unsupported......4
Errors in README.md
[403] https://npmjs.org/package/java-caller (at 5:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://npmjs.org/package/java-caller (at 6:1) | Rejected status code: 403 Forbidden | Followed 1 redirect. Redirects: https://npmjs.org/package/java-caller --[301]--> https://www.npmjs.com/package/java-caller
[403] https://www.npmjs.com/package/java-caller (at 4:1) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/njre (at 16:145) | Rejected status code: 403 Forbidden
Hint: Followed 7 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdown-table-formatter - 1 error
1 files contain markdown tables to format:
- README.md
⚠️ MARKDOWN / markdownlint - 19 errors
CHANGELOG.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 518]
CHANGELOG.md:14:401 error MD013/line-length Line length [Expected: 400; Actual: 442]
CODE_OF_CONDUCT.md:58:44 error MD034/no-bare-urls Bare URL used [Context: "nicolas.vuillamy@gmail.com"]
CODE_OF_CONDUCT.md:71:14 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
CODE_OF_CONDUCT.md:76:1 error MD034/no-bare-urls Bare URL used [Context: "https://www.contributor-covena..."]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:47 error MD060/table-column-style Table column style [Table pipe is missing space to the left for style "compact"]
README.md:66:1 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:13 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:27 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:66:37 error MD060/table-column-style Table column style [Table pipe is missing space to the right for style "compact"]
README.md:67:361 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:69:123 error MD060/table-column-style Table column style [Table pipe has extra space to the left for style "compact"]
README.md:73:315 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:74:310 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:75:208 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
README.md:76:233 error MD055/table-pipe-style Table pipe style [Expected: leading_and_trailing; Actual: leading_only; Missing trailing pipe]
⚠️ TYPESCRIPT / ts-standard - 1 error
Unable to locate the project file. A project file (tsconfig.json or tsconfig.eslint.json) is required in order to use ts-standard.
See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v10.1.0→v10.2.0Release Notes
oxsecurity/megalinter
v10.2.0Compare Source
Core
PARALLEL_PROCESS_NUMBERnow defaults to the number of cores minus one, so your machine stays responsive while MegaLinter runs. CI runs still use every core, and setting the variable still overrides the default (#9216)Linters enhancements
recommendedpreset now reports likely mistakes only (no style or layout rules) (#9411)"extends": "advanced"(or"all") in your.groovylintrc.json, see the migration guidelist_of_fileslint mode (#9029)--cache false: it no longer writes into your repository's.clj-kondo/.cachefolder during the run, and no longer reads a cache built beforehand. To use such a cache, for example one built with--dependencies, setCLOJURE_CLJ_KONDO_COMMAND_REMOVE_ARGUMENTS: ["--cache", "false"]CLOJURE_CLJ_KONDO_CLI_LINT_MODE: fileFixes
SARIF_REPORTER: true, findings the linter marks as suppressed in its SARIF output (for example# nosemgrep) no longer count as errors or warnings, and no longer appear in the console log, text reports and PR/MR comments. The SARIF reports still contain them. Fixes #9373EXTENDSnow sendsGITHUB_TOKENonly tohttps://raw.githubusercontent.com, to read configs in private repositories. A URL that merely starts with that text no longer receives it. See GHSA-rq55-6pj8-6v8v.lycheeignorerules MegaLinter finds outside the repository root (for example in.github/linterswithLINTER_RULES_PATH). Fixes #9281mirror.gcr.iois unavailable. Fixes #9254mirror.gcr.io,ghcr.ioandpublic.ecr.awsin turn, and waits between retriesTRIVY_DB_REPOSITORYvariable of the custom flavor builder workflow, see Custom flavorsNo such objecterror when pushing the imageMEGALINTER_UID/MEGALINTER_GID): Go module and build caches go to the user's home folder, unless you setGOMODCACHE/GOCACHEyourself. Fixes #9280filelint mode instead of reporting SUCCESS with 0 errors, and aPRE_COMMANDS/POST_COMMANDSentry withcontinue_if_failed: falsestops the run. Fixes #9257GIT_STRATEGYno longer trigger a false removed-linter warning. Removed MegaLinter options and linter selections still warn. Fixes #9024persist-credentials: trueorGIT_AUTHORIZATION_BEARER) and lints the whole codebase. Fixes #9104FAIL_IF_UPDATED_SOURCESis now reliable. Fixes #9103truenorfalse(for example an empty CI variable), and the console log tells whether the option is activeDISABLE_ERRORS: true: the exit code is 1, as the summary saysprojectlint mode linters and byPOST_COMMANDSnow fail the run too, and set thehas_updated_sourcesoutputEMAIL_REPORTER_SEND_SUCCESSistrue, and the File.io reporter skips such runs whenFILEIO_REPORTER_SEND_SUCCESSistrue, as documented (#9219)EXCLUDED_DIRECTORIESandADDITIONAL_EXCLUDED_DIRECTORIESinprojectlint mode: they were never applied before, so files in folders likenode_modulesor.wireitcould be reported (#9029):output {:exclude-files [...]}inline configuration, so your own:output :exclude-filespatterns in.clj-kondo/config.ednare keptCLOJURE_CLJ_KONDO_FORWARD_EXCLUDED_DIRECTORIES: false.mega-linter.ymlJSON Schema is no longer rejected by strict JSON Schema validators withInvalid anchor value: the invalid$idvalues are removed from the configuration and descriptor schemas. Fixes #9177vendor/were analyzed again by linters like phpcs, phpstan or editorconfig-checker, making runs slow and noisy. Fixes #8955.: eslint, biome, standard, ruff, ruff format, flake8, rubocop, phplint, jscpd, gherkin-lint, dart analyze, cljstyle and editorconfig-checker (which honours.gitignoreagain).only when their configuration does not define the paths to analyze: phpcs (<file>), phpstan (paths), psalm (<projectFiles>), php-cs-fixer (Finderin()), pylint and mypy (files), pyright (include), cfn-lint (templates), checkov (directory) and cspell (files)<LINTER_KEY>_COMMAND_REMOVE_ARGUMENTS: "."workaround is no longer neededIGNORE_GITIGNORED_FILES: true(default), the directories ignored by git are now forwarded to project lint mode linters withEXCLUDED_DIRECTORIES: a gitignoredvendor/orbuild/folder is no longer analyzed by phpcs, trivy, checkov... (#9199)/lib/build output andsrc/libsources) is only sent to the linters receiving exact paths, so your tracked sources stay analyzedFORWARD_GITIGNORED_DIRECTORIES: falsevariableEXCLUDED_DIRECTORIEStoprojectlint mode linters: the forwarded directories used to replace the exclusions defined in the linter's own configuration, so folders you left out were analyzed again. Fixes #8955exclude), pylint (ignore), black (extend-exclude), flake8 (extend-exclude), isort (extend_skip), bandit (.banditexclude), nbqa (exclude), djlint (extend_exclude), robocop (exclude), npm-groovy-lint (ignorepattern), rumdl (exclude) and jsonlint (patterns).gitignore, v8r yourignorePatternFiles, yamllint anignoreinherited throughextendsor anignore-from-file, and StyLua the file patterns of.styluaignoreand.gitignore(and.luaufiles are linted again)<LINTER_KEY>_ARGUMENTSis read too, and an exclusion argument you already pass there (ex: phpcs--ignore=) is merged with the forwarded directories instead of being overriddenEXCLUDED_DIRECTORIES: the forwarded directories are excluded from analysis only, so the symbols of yourscanDirectories(ex:vendor-bin/*/vendor) are found again. Fixes #8955robocop.tomlthrough--config: the-cargument sent before is robocop's--configureoption (#9216)BETTERLEAKS_CONFIG,GITLEAKS_CONFIGor their*_CONFIG_TOMLvariants when MegaLinter forwardsEXCLUDED_DIRECTORIES(#9216)RST_RST_LINT_CLI_LINT_MODE: projectnow lints the.rstfiles of the workspace, instead of failing with rst-lint's usage messageTEKTON_TEKTON_LINT_CLI_LINT_MODE: projectnow lints the.ymland.yamlfiles of the workspace (or theglobsof your.tektonlintrc.yaml), instead of failing withNo paths match glob "".EXCLUDED_DIRECTORIESare applied tooCLOUDFORMATION_CFN_LINT_CLI_LINT_MODE: projectnow lints the.json,.yamland.ymlfiles of the workspace (or thetemplatesof your.cfnlintrc), instead of failing withTemplate references a directory, not a fileENV_DOTENV_LINTER_CLI_LINT_MODE: projectnow lints the.envfiles of the workspace and its subfolders, instead of failing with dotenv-linter's usage message.EXCLUDED_DIRECTORIESare applied at any nesting levelprojectlint mode: infileorlist_of_filesmode they analyzed no file at all. If you setREPOSITORY_LS_LINT_CLI_LINT_MODEto another mode, remove itmega-linter-runner
--container-engine container: run MegaLinter with Apple's native macOS container engine (Apple Silicon only, no Docker Desktop needed): https://github.com/apple/container (#8956)npx mega-linter-runnerreports an unsupported engine. This comes with a security upgrade of thesimple-gitdependencyAgent Skills
:type-mismatchand:constant-conditionfindings, and the difference between the top-level:exclude-filesand:output :exclude-filesclj-kondo settings (#9029)Dev
mega-linter-runner/test/runtime-image.test.js) runGO_GOLANGCI_LINTon a fixture with an external dependency (.automation/test/golang_runtime_deps), so the Go module cache is exercised as root and non-root (#9326)megalinter/descriptors/schemas/is not compliant with its draft-07 meta-schema, or declares an$idholding a JSON Pointer fragment (validate_json_schemasin.automation/build.py) (#9180)CLOJURE_CLJ_KONDOtest fixtures are split intogood/andbad/folders, so theprojectlint mode tests no longer lint the failing files, and.wireitpoison fixtures now guard the excluded directories forwarding, at root and nested levels (#9029)ES, nbqa mypy):LinterTestRootset<DESCRIPTOR>_<LINTER-NAME>_CLI_LINT_MODEinstead of the linter key, so the override was ignored. A new assertion fails the test when the requested lint mode is not applied (#9030)CLOUDFORMATION_CFN_LINT,EDITORCONFIG_EDITORCONFIG_CHECKER,ENV_DOTENV_LINTER,GHERKIN_GHERKIN_LINTandGROOVY_NPM_GROOVY_LINTare split intogood/andbad/folders, so theprojectlint mode tests no longer lint the failing filesTEKTON_TEKTON_LINTgets a.wireitpoison fixture guarding its new excluded directories forwarding, andENV_DOTENV_LINTERroot and nested ones.editorconfigof theEDITORCONFIG_EDITORCONFIG_CHECKERfixtures moves intogood/andbad/, so the linter is activated in the split folders, and theTYPESCRIPT_ES/TYPESCRIPT_STANDARDfixtures no longer fail on their owneslint.config.jsinprojectlint modeCljKondoLinterforwards excluded directories through:output :exclude-filesinstead of a top-level:exclude-filesvector (an invalid value), and no longer skips the forwarding when a--configfile is passed, which was always the case since the defaultTEMPLATES/.clj-kondo/config.ednis used when the repository has none (#9029)--lintmoved fromcli_lint_extra_args_afterto the per-modecli_lint_mode_*_extra_args_afterproperties, because clj-kondo assigns every following argument to the last option: the forwarded--configmust come before it (#9029)cli_lint_mode_project_config_paths_regex: a regex searched in the resolved linter config file; when it matches,cli_lint_mode_project_extra_args_afteris not sent, as it would override the paths defined in the config. Every project-mode.was reviewed against the tools' docs/source (rules in.claude/rules/descriptors.md) (#9199)Megalinter.get_gitignored_directories()extracts the ignored directories from thegit ls-files --directoryoutput (skipping the ones inside an excluded directory, capped toMAX_GITIGNORED_DIRECTORIES_BYTES), andget_unambiguous_gitignored_directories()keeps for{{DIR}}templates only the ones whose path suffix no tracked directory shares;Linter.compute_project_exclude_directories()forwards them throughproject_gitignored_name_directories/project_gitignored_directories(#9199)cli_lint_mode_project_config_paths_regexis searched in the config file with XML comments removed, so a commented-out<file>or<projectFiles>does not count (#9199)PhpCsFixerLinterno longer drops.itself (the descriptor regex does it), andJsCpdLinterrebases the configuredpathentries when it generates its config in the report folder (#9199)PHP_PHPCSregression fixture:.automation/test/php/good/phpcs.xmllists the files to analyze, andout_of_config_paths.inc(not collected by MegaLinter) fails theprojectlint mode test if.overrides them (#9199)cli_lint_mode_project_exclude_config_keynow reads TOML, JSON (with comments), INI and YAML configs, accepts a list of alternative key paths and a*wildcard segment, splits comma separated string values (kept whole for|joined regexes), and also reads the config passed inARGUMENTS(#9216)cli_lint_mode_project_exclude_config_files(workspace configs discovered by the tool itself),cli_lint_mode_project_exclude_conflicting_args(user arguments disabling the forwarding) andcli_lint_mode_project_exclude_ignore_file_merge_all_seedscli_lint_mode_project_exclude_config_keylists the user's ignore files, re-passed instead ofcli_lint_mode_project_exclude_ignore_file_pass_existingPhpstanLintergeneratesexcludePaths: analyse:instead of a plain list (analyseAndScan),YamllintLinterfollows theextendschain and supportsignore-from-file,PhpCsFixerLinterguardsexclude()against non-Finder iterables, andMegaLinter.get_parallel_process_number()holds the default parallelism (#9216)PSScriptAnalyzerinstall step of thePOWERSHELLdescriptor now uses-ErrorAction Stop, so a PowerShell Gallery failure breaks the Docker build instead of silently producing an image withoutInvoke-ScriptAnalyzer(#9334)CI
.automation/test/: they must stay outdated, in particular the.wireitpoison fixtures guarding the excluded directories forwarding (#9168)close-frozen-fixture-prs.ymlworkflow: Dependabot security updates ignore thedependabot.ymlignore rules, so it closes the Dependabot PRs that only bump frozen fixtures (bad/and.wireit/folders under.automation/test/), and flags the PRs mixing them with other updates (#9322).automation/test/up to date (good/, fix/... folders) in one weekly grouped PR, and only skips the frozenbad/and.wireit/fixtures (#9322).python-versionis the single reference (#9392)pythonbase image (main, flavors, linters, server, quick and custom-flavor Dockerfiles) is pinned to the same patch instead of a floating3.14tagpython-version-file, and the localmake bootstrapfallback launcher follows it.python-versionand every base image in onePythonPR, patches apart from minor upgradesUV_PYTHON_DOWNLOADS=never, so a mismatch fails the build instead of silently bundling another Pythontypescripton v6: TypeScript 7 drops the JavaScript compiler API that typescript-eslint needs (#8404)429 Too Many Requests, theSALESFORCE_CODE_ANALYZER_APEXGURUsuccess, failure and SARIF tests are skipped instead of failed (#8947)utils.is_ci()): local test runs still fail, so a real regression stays visibledeploy-DEV-linters.yml,deploy-BETA-linters.yml) now passGITHUB_ACTIONSto the test containertest-agent-plugins.ymlvalidation script now accepts both the{"plugins": [...], "errors": [...]}wrapper and the bare-array shape the GitHub Copilot CLI'splugins list --jsoncan return, fixing a crash of the "Validate agent plugins manifests" check (#8979)REPOSITORY_DUSTILOCKis now non-blocking in MegaLinter's own.mega-linter.yml: dustilock reports any PyPI lookup error (such as intermittent503responses) as a package "available for public registration", which failed the "Run against all code base - DEV" job on unrelated PRs (#9076)github-actionsmanager is disabled): Renovate can not date SHA-pinned digest updates, so they stayed pending forever and duplicated Dependabot's PRsflavors/custom-builder/action.ymlLinter versions upgrades (61)
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.