Skip to content

Update oxsecurity/megalinter action to v9#22

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/oxsecurity-megalinter-9.x
Open

Update oxsecurity/megalinter action to v9#22
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/oxsecurity-megalinter-9.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Sep 20, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
oxsecurity/megalinter action major v7 → v9

Release Notes

oxsecurity/megalinter (oxsecurity/megalinter)

v9.5.0

Compare Source

Take 2 mn to read MegaLinter v9.5.0 announcements

  • Breaking changes

    • Docker images published only to GitHub Container Registry (ghcr.io) until OIDC-based publishing to Docker Hub is implemented. The Docker Hub registry (docker.io/oxsecurity/megalinter) is frozen at v9.4.0: pulls of oxsecurity/megalinter:v9 (or :beta, or any flavor tag) will keep returning v9.4.0. To get v9.5.0 and later from CI tools other than GitHub Actions (GitLab CI, Azure Pipelines, Bitbucket, Jenkins, Drone, raw docker run, …), switch your image references:

      • oxsecurity/megalinter:v9 → ghcr.io/oxsecurity/megalinter:v9
      • oxsecurity/megalinter:beta → ghcr.io/oxsecurity/megalinter:beta
      • oxsecurity/megalinter-<flavor>:v9 → ghcr.io/oxsecurity/megalinter-<flavor>:v9

      GitHub Action users (uses: oxsecurity/megalinter@v9) and mega-linter-runner users are not affected, as both already pull from ghcr.io.

    • ESLint-based linters upgraded to v10+. Legacy .eslintrc.* configs are no longer supported: you must migrate to flat-config (eslint.config.js) to keep using JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT, and JSON_ESLINT_PLUGIN_JSONC.

    • Airbnb and Standard ESLint configs replaced (they never shipped ESLint 9+ support):

      • extends: ["airbnb"] → extends: ["airbnb-extended"]
      • extends: ["standard"] → extends: ["neostandard"]

  • Core

    • User notifications system: linters can surface structured "Notices" to end users in the PR comment / report footer (used for ESLint migration, deprecated options, etc.), replaces the ad-hoc migration warnings
    • Security: more default hidden environment variables, so a compromised linter cannot leak your secrets
    • Upgrade .NET runtime to 10.0 (csharpier, dotnet-format, roslynator, devskim, tsqllint, vbdotnet-format)
    • Upgrade GO runtime to 1.26.3

  • New linters

    • osv-scanner: trivy-like vulnerability scanner by Google
    • zizmor: GitHub Actions static analysis

  • Disabled linters

    • KICS (until upstream security issue is fixed)
    • Spectral (crashing)

  • Re-enabled linters

  • Deprecated linters

  • Removed linters

  • Media

  • Linters enhancements

    • ESLint: legacy .eslintrc.* configs are now detected and a migration notice is emitted in the report so users know they need to switch to flat-config
    • shellcheck: honour the BASH_SHELLCHECK_CONFIG_FILE variable / .shellcheckrc config file
    • raku (Rakudo): now ships on ARM64 too
    • scala: linter installation is now deterministic (same binary across rebuilds)
    • v8r (JSON/YAML schema validation): output now shows only validation errors (no more "no schema found" or success noise)
    • lychee: removed the deprecated exclude_mail option (no longer supported by lychee upstream)
    • Faster image pulls: several linters (Lua/StyLua arm64, clj-kondo, kubescape, ls-lint, dotenv-linter) now use pre-built Alpine binaries instead of compiling from source

  • Fixes

    • Console output: linters now show their log sections (not only on errors), the results table and reporter logs are printed after linters complete, and parallel-run logs are no longer interleaved
    • YAML_V8R_CONFIG_FILE / JSON_V8R_CONFIG_FILE are now correctly applied (the v8r --catalogs option is wired through)
    • lychee: fix the configured headers / Accept settings being ignored
    • Custom flavor builder: works correctly for repositories whose name contains uppercase characters
    • Docs: corrected the documented default value for the pre-commands cwd option

  • Reporters

    • Comment reporters (GitHub, GitLab, Azure DevOps, Bitbucket) now work when running MegaLinter from Jenkins CI
    • GitlabCommentReporter activates as soon as GITLAB_ACCESS_TOKEN_MEGALINTER is set (no longer requires CI_JOB_TOKEN)
    • BitbucketCommentReporter: per-linter sections rendered as ### headings (Bitbucket Cloud markdown was displaying the previous <details> HTML tags as literal text)
    • Display a default user notification on PR/console reports inviting users to read the MegaLinter 9.5.0 release announcement. Can be disabled by setting SECURITY_SUGGESTIONS: false.

  • Flavors

    • Multi-arch images: In custom flavors, linters can now build for linux/arm64 in addition to linux/amd64 whenever possible (Apple Silicon, AWS Graviton, Ampere…)

  • Doc

    • Add documentation for the megalinter-ado Azure DevOps extension and the megalinter-mcp-server MCP server
    • Explicitly discourage the use of Personal Access Tokens (PAT) in workflows for security reasons

  • mega-linter-runner

    • New --list-vars [pattern] flag (with --json) lists every MegaLinter env variable that can be passed via -e, with type, default, allowed values and examples (handy for AI coding agents)
    • -e ENABLE_LINTERS=YAML_PRETTIER,YAML_YAMLLINT no longer silently drops values after the first comma (#​7500). The --env=KEY=VALUE long form is also accepted.

  • Dev

    • Add CLAUDE.md and a set of /add-linter, /update-linter-version, /review-descriptor, /fix-linter-test, /add-reporter, /add-flavor, /build, /diagnose-config, /fix-security-issue skills to help work on MegaLinter with coding agents (Claude Code, GitHub Copilot, Codex, gemini-cli…)
    • Migrate copilot-instructions into Claude Code Agents & Skills
    • New descriptor capabilities for custom linter integrations: cli_lint_extra_args_after per lint mode (list_of_files / project / file), a {file} template variable usable in command-line args, and a customizable files separator

  • CI

    • Run ARM linter jobs only when the commit message contains "ARM" (avoids 200 jobs per PR)
    • Do not push a fix commit if only markdown or JSON files were updated
    • Run osv-scanner on MegaLinter's own sources
    • Optimize the linter-job matrix for dependabot and renovate PRs
    • Exclude test dependencies from dependabot
    • Faster Docker image builds: optimized Dockerfile layer order, buildx layer cache (type=gha, zstd-compressed) on all deploy workflows, DEV pipeline split into parallel jobs sharing the image via cache, and cargo-based tools (sarif-fmt, zizmor, shellcheck-sarif, stylua) built in parallel multi-stage builders so the Rust toolchain no longer ships in the final image (except for clippy)
    • Hardened MegaLinter's own GitHub Actions workflows against script injection via untrusted PR contexts (zizmor findings)

  • Linter versions upgrades (62)

v9.4.0

Compare Source

  • Core

    • Improve files browsing performances (2 PRs)
    • Optimize parallel linter processing and improve grouping logic
    • Improve performance of listing .gitignored files by sending excluded directories to git ls-files
    • If there are more than 500 .gitignored files, advise to add more excluded directories using variable ADDITIONAL_EXCLUDED_DIRECTORIES, to improve performances
    • Reduce redundant config lookups, environment copies, and dict rebuilds across config, linter, and utils modules
    • Cache subprocess environment per linter run and excluded directories per request
    • Optimize parallel linter result update from O(n²) to O(n)
    • Add support in the build of Docker images for linux/arm64 in compatible linters

  • New linters

  • Disabled linters

  • Linters enhancements

    • Use the official checkmake image by @​bdovaz
    • Spectral: Add sarif support to spectral by @​bdovaz
    • Spectral: Change cli_lint_mode to list_of_files to improve performances

  • Fixes

    • Add support for SSH remote origins when building custom flavors (fixes: #​6511)
    • Fix issue with plugins ignored when FLAVOR_SUGGESTIONS=false
    • Fix wrong tagging apply_fixes=True when linter has no fix options configured
    • Python mypy: Remove .ipynb from file extensions (mypy doesn't support notebooks directly) - fixes #​6904
    • Fix operator precedence bug in pre_post_factory pre/post command logic
    • Fix file handle leak in GitleaksLinter
    • Fix variable name bug in utils.get_git_context_info
    • Minor fixes in logger, SqlFluffLinter, PowershellLinter, TrivyLinter

  • Reporters

    • Add a link inviting to star MegaLinter
    • Display in the console reporter the working directory from which the commands are executed by @​bdovaz
    • Update WebHook reporter so it can send more events for a better integration with UI
    • When truncating long comments in markdown reports, keep the end of the text instead of the beginning (which usually contains less useful information)
    • In case GitHub Api returns 500, do not make the whole MegaLinter fail, display a warning instead
    • Azure Reporter: Use Azure DevOps Services REST API instead of unmaintained python wrapper lib

  • Flavors

    • Custom flavor builder:
      • Add support for SSH remotes
      • Allow selection of platforms to build the custom flavor on (ex: linux/amd64, linux/arm64) and build compatible linters on these platforms
      • Build & release custom flavor builder image for linux/arm64

  • Doc

    • JSON Schema: Add default values for file extensions and file names variables + improve descriptions
    • Update default secured env variables documentation
    • Fix banner img in json_prettier and yaml_prettier docs
    • Explain better how to run tests locally
    • Vale: Mention community style packages in linter description

  • CI

    • Free more space on GitHub Actions runners to avoid build failures
    • Ignore .isorted files in secretlint to avoid scanning transient files created by other linters
    • Avoid duplicate jobs "Mirror docker image"
    • Allow to skip linters build using skip linters in latest commit text
    • Allow to disable build & push of standalone linters docker images using variable BETA_LINTERS_ENABLED=false
    • Improve performances of formatting markdown tables during build
    • Improve test classes performances and fix race conditions
    • Fix plugin test to work with forks and feature branches
    • Update .devcontainer image to trixie

  • mega-linter-runner

    • If variables are defined in a local .env file, send their values to docker/podman run command (can be useful for secret variables)
    • Never send .env file to the docker run for security reasons, instead create an empty one if needed
    • Use npm trusted publishers (OIDC) to publish mega-linter-runner

  • Linter versions upgrades (59)

v9.3.0

Compare Source

v9.2.0

Compare Source

v9.1.0

Compare Source

  • New linters

  • Linters enhancements

    • Python Linting: Added more file type supports for various linters. Full description here

  • Doc

    • Add OLLAMA_BASE_URL is MegaLinter config Json schema

  • Flavors

    • Custom flavors: Add workflow to automate detection of new MegaLinter versions and generation of new Custom Flavor

  • CI

    • Fix v9 release issue + mark hardcoded versions to upgrade at each new major release.

  • Linter versions upgrades (22)

v9.0.1

Compare Source

  • Fix v9 release issue

v9.0.0

Compare Source

  • Core

    • Create your own Megalinter Custom Flavors to dramatically improve your performances
      • See documentation for usage
      • Use npx mega-linter-runner@beta --custom-flavor-setup to initialize repo
      • Suggest new flavors in reporters with a mega-linter-runner including the list of linters
    • New LLM Advisor: call external LLMs to get hints to solve linter errors, available in:
      • Console Reporter
      • Text Reporter
      • Git platforms PR/MR comments Reporter
    • Use ghcr.io docker images by default because of rate limits on docker.io
    • Use uv to create the venv folder for pip-installed linters
    • Add copilot instructions for GitHub Copilot
    • Update base image to python:3.13-alpine3.21 (also embeds go 1.24)

  • Disabled linters

  • Removed linters

    • markdown-link-check has been removed because lychee can be used instead, and has much better performances

  • Linters enhancements

    • PHP-CS-Fixer is able to run on PHP 8.4 without error (change default configuration) by @​llaville
    • cspell: Filter output lines that do not contain found issues
    • hadolint: Extend DOCKERFILE_HADOLINT_FILE_NAMES_REGEX to include the purpose.Dockerfile convention eg service.Dockerfile.
    • sqlfluff: Handle fixing of issues

  • Fixes

    • When linter is docker based, force --platform=linux/amd64 so it works when running locally on Mac
    • Added checking of *.pyi and *.ipynb files to the ruff and ruff-format linters

  • Reporters

    • New default display for Pull Request comments, with expandable sections containing the first 1000 lines of the output log. Former display remains available by defining REPORTERS_MARKDOWN_SUMMARY_TYPE=table
    • Markdown summary reporter:
      • Write a file for Github integration if GITHUB_STEP_SUMMARY is set
      • Truncate less linter output lines
    • Text reporter: Change the output file names to put the linter name first, then the status
    • Enhance display of markdown summary

  • Doc

    • Update documentation in all megalinter descriptor files to improve accuracy and consistency
    • Fix incorrect information in linters documentation and descriptors
    • Remove dead links
    • Add linter description (linter_text) in all linter descriptor, to generate a more exhaustive documentation.
    • Update contributing guide to explain how to manage python dependencies in the codebase

  • Flavors

    • Do not suggest flavors that have more linters than the current one

  • CI

    • Update default MegaLinter CI/CD workflows to disable LLM_ADVISOR in case of bot pull requests

  • mega-linter-runner

    • Add all CI/CD providers in the --install command
    • Use ghcr.io docker images by default
    • New parameter --container-engine allowing to use podman as runner
    • mega-linter-runner --upgrade: Handle upgrade of github actions to their latest version
    • mega-linter-runner --upgrade: Upgrades MegaLinter actions and images to v9

  • Linter versions upgrades (68)

v9

Compare Source

Take 2 mn to read MegaLinter v9.5.0 announcements

  • Breaking changes

    • Docker images published only to GitHub Container Registry (ghcr.io) until OIDC-based publishing to Docker Hub is implemented. The Docker Hub registry (docker.io/oxsecurity/megalinter) is frozen at v9.4.0: pulls of oxsecurity/megalinter:v9 (or :beta, or any flavor tag) will keep returning v9.4.0. To get v9.5.0 and later from CI tools other than GitHub Actions (GitLab CI, Azure Pipelines, Bitbucket, Jenkins, Drone, raw docker run, …), switch your image references:

      • oxsecurity/megalinter:v9 → ghcr.io/oxsecurity/megalinter:v9
      • oxsecurity/megalinter:beta → ghcr.io/oxsecurity/megalinter:beta
      • oxsecurity/megalinter-<flavor>:v9 → ghcr.io/oxsecurity/megalinter-<flavor>:v9

      GitHub Action users (uses: oxsecurity/megalinter@v9) and mega-linter-runner users are not affected, as both already pull from ghcr.io.

    • ESLint-based linters upgraded to v10+. Legacy .eslintrc.* configs are no longer supported: you must migrate to flat-config (eslint.config.js) to keep using JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT, and JSON_ESLINT_PLUGIN_JSONC.

    • Airbnb and Standard ESLint configs replaced (they never shipped ESLint 9+ support):

      • extends: ["airbnb"] → extends: ["airbnb-extended"]
      • extends: ["standard"] → extends: ["neostandard"]

  • Core

    • User notifications system: linters can surface structured "Notices" to end users in the PR comment / report footer (used for ESLint migration, deprecated options, etc.), replaces the ad-hoc migration warnings
    • Security: more default hidden environment variables, so a compromised linter cannot leak your secrets
    • Upgrade .NET runtime to 10.0 (csharpier, dotnet-format, roslynator, devskim, tsqllint, vbdotnet-format)
    • Upgrade GO runtime to 1.26.3

  • New linters

    • osv-scanner: trivy-like vulnerability scanner by Google
    • zizmor: GitHub Actions static analysis

  • Disabled linters

    • KICS (until upstream security issue is fixed)
    • Spectral (crashing)

  • Re-enabled linters

  • Deprecated linters

  • Removed linters

  • Media

  • Linters enhancements

    • ESLint: legacy .eslintrc.* configs are now detected and a migration notice is emitted in the report so users know they need to switch to flat-config
    • shellcheck: honour the BASH_SHELLCHECK_CONFIG_FILE variable / .shellcheckrc config file
    • raku (Rakudo): now ships on ARM64 too
    • scala: linter installation is now deterministic (same binary across rebuilds)
    • v8r (JSON/YAML schema validation): output now shows only validation errors (no more "no schema found" or success noise)
    • lychee: removed the deprecated exclude_mail option (no longer supported by lychee upstream)
    • Faster image pulls: several linters (Lua/StyLua arm64, clj-kondo, kubescape, ls-lint, dotenv-linter) now use pre-built Alpine binaries instead of compiling from source

  • Fixes

    • Console output: linters now show their log sections (not only on errors), the results table and reporter logs are printed after linters complete, and parallel-run logs are no longer interleaved
    • YAML_V8R_CONFIG_FILE / JSON_V8R_CONFIG_FILE are now correctly applied (the v8r --catalogs option is wired through)
    • lychee: fix the configured headers / Accept settings being ignored
    • Custom flavor builder: works correctly for repositories whose name contains uppercase characters
    • Docs: corrected the documented default value for the pre-commands cwd option

  • Reporters

    • Comment reporters (GitHub, GitLab, Azure DevOps, Bitbucket) now work when running MegaLinter from Jenkins CI
    • GitlabCommentReporter activates as soon as GITLAB_ACCESS_TOKEN_MEGALINTER is set (no longer requires CI_JOB_TOKEN)
    • BitbucketCommentReporter: per-linter sections rendered as ### headings (Bitbucket Cloud markdown was displaying the previous <details> HTML tags as literal text)
    • Display a default user notification on PR/console reports inviting users to read the MegaLinter 9.5.0 release announcement. Can be disabled by setting SECURITY_SUGGESTIONS: false.

  • Flavors

    • Multi-arch images: In custom flavors, linters can now build for linux/arm64 in addition to linux/amd64 whenever possible (Apple Silicon, AWS Graviton, Ampere…)

  • Doc

    • Add documentation for the megalinter-ado Azure DevOps extension and the megalinter-mcp-server MCP server
    • Explicitly discourage the use of Personal Access Tokens (PAT) in workflows for security reasons

  • mega-linter-runner

    • New --list-vars [pattern] flag (with --json) lists every MegaLinter env variable that can be passed via -e, with type, default, allowed values and examples (handy for AI coding agents)
    • -e ENABLE_LINTERS=YAML_PRETTIER,YAML_YAMLLINT no longer silently drops values after the first comma (#​7500). The --env=KEY=VALUE long form is also accepted.

  • Dev

    • Add CLAUDE.md and a set of /add-linter, /update-linter-version, /review-descriptor, /fix-linter-test, /add-reporter, /add-flavor, /build, /diagnose-config, /fix-security-issue skills to help work on MegaLinter with coding agents (Claude Code, GitHub Copilot, Codex, gemini-cli…)
    • Migrate copilot-instructions into Claude Code Agents & Skills
    • New descriptor capabilities for custom linter integrations: cli_lint_extra_args_after per lint mode (list_of_files / project / file), a {file} template variable usable in command-line args, and a customizable files separator

  • CI

    • Run ARM linter jobs only when the commit message contains "ARM" (avoids 200 jobs per PR)
    • Do not push a fix commit if only markdown or JSON files were updated
    • Run osv-scanner on MegaLinter's own sources
    • Optimize the linter-job matrix for dependabot and renovate PRs
    • Exclude test dependencies from dependabot
    • Faster Docker image builds: optimized Dockerfile layer order, buildx layer cache (type=gha, zstd-compressed) on all deploy workflows, DEV pipeline split into parallel jobs sharing the image via cache, and cargo-based tools (sarif-fmt, zizmor, shellcheck-sarif, stylua) built in parallel multi-stage builders so the Rust toolchain no longer ships in the final image (except for clippy)
    • Hardened MegaLinter's own GitHub Actions workflows against script injection via untrusted PR contexts (zizmor findings)

  • Linter versions upgrades (62)

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions github-actions Bot added the prod label Sep 20, 2025
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Sep 20, 2025

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
❌ ACTION actionlint 3 1 0 0.27s
✅ JAVASCRIPT prettier 1 1 0 0 0.44s
✅ JSON jsonlint 8 0 0 0.22s
✅ JSON npm-package-json-lint yes no no 0.44s
✅ JSON prettier 8 2 0 0 0.39s
✅ JSON v8r 8 0 0 7.15s
⚠️ MARKDOWN markdownlint 9 0 20 0 0.82s
✅ MARKDOWN markdown-table-formatter 9 0 0 0 0.33s
✅ REPOSITORY gitleaks yes no no 0.15s
✅ REPOSITORY git_diff yes no no 0.01s
❌ REPOSITORY grype yes 5 no 26.5s
❌ REPOSITORY secretlint yes 1 no 0.37s
✅ REPOSITORY syft yes no no 1.28s
✅ REPOSITORY trivy-sbom yes no no 0.14s
✅ REPOSITORY trufflehog yes no no 2.74s
⚠️ SPELL cspell 27 117 0 6.79s
❌ SPELL lychee 24 8 0 1.06s
⚠️ SPELL proselint 9 5 0 7.03s
✅ YAML prettier 7 3 0 0 0.54s
✅ YAML yamllint 7 0 0 0.47s

Detailed Issues

❌ ACTION / actionlint - 1 error 
.github/workflows/megalinter.yml:101:13: if: condition "${{ success() }} || ${{ failure() }}" is always evaluated to true because extra characters are around ${{ }} [if-cond]
    |
101 |         if: ${{ success() }} || ${{ failure() }}
    |             ^~~
❌ REPOSITORY / grype - 5 errors 
[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal)
NAME            INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS           RISK   
braces          3.0.2      3.0.3     npm   GHSA-grv7-fg5c-xmjg  High      0.2% (45th)    0.2    
cross-spawn     5.1.0      6.0.6     npm   GHSA-3xgq-45jj-v275  High      0.1% (33rd)    < 0.1  
micromatch      4.0.5      4.0.8     npm   GHSA-952p-6rrq-rcjv  Medium    0.1% (32nd)    < 0.1  
@babel/runtime  7.24.1     7.26.10   npm   GHSA-968p-4wvh-cqc8  Medium    < 0.1% (15th)  < 0.1  
tmp             0.0.33     0.2.4     npm   GHSA-52f5-9888-hmc6  Low       < 0.1% (9th)   < 0.1
[0026] ERROR discovered vulnerabilities at or above the severity threshold
❌ SPELL / lychee - 8 errors 
[404] https://megalinter.github.io/flavors/ | Network error: Not Found
[404] https://megalinter.github.io/configuration/ | Network error: Not Found
[404] https://api.github.com/repos/$ | Network error: Not Found
[404] https://github.com/$ | Network error: Not Found
[404] https://github.com/openzeppelin/compound-monitoring-v3/workflows | Network error: Not Found
[403] https://faucet.polygon.technology/ | Network error: Forbidden
[404] https://reqbin.com/req/ | Network error: Not Found
[404] https://github.com/openzeppelin/compound-monitoring-v3/actions | Network error: Not Found
📝 Summary
---------------------
🔍 Total...........31
✅ Successful......23
⏳ Timeouts.........0
🔀 Redirected.......0
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........8

Errors in .github/markdown-link-check.json
[404] https://github.com/openzeppelin/compound-monitoring-v3/actions | Network error: Not Found
[404] https://github.com/openzeppelin/compound-monitoring-v3/workflows | Network error: Not Found
[403] https://faucet.polygon.technology/ | Network error: Forbidden
[404] https://reqbin.com/req/ | Network error: Not Found

Errors in .github/workflows/megalinter.yml
[404] https://megalinter.github.io/configuration/ | Network error: Not Found
[404] https://api.github.com/repos/$ | Network error: Not Found
[404] https://github.com/$ | Network error: Not Found
[404] https://megalinter.github.io/flavors/ | Network error: Not Found
❌ REPOSITORY / secretlint - 1 error 
TypeError [ERR_PARSE_ARGS_UNKNOWN_OPTION]: Unknown option '--secretlintignores'. To specify a positional argument starting with a '-', place it at the end of the command after '--', as in '-- "--secretlintignores"
    at checkOptionUsage (node:internal/util/parse_args/parse_args:107:13)
    at node:internal/util/parse_args/parse_args:381:9
    at Array.forEach (<anonymous>)
    at parseArgs (node:internal/util/parse_args/parse_args:378:3)
    at file:///node-deps/node_modules/secretlint/module/cli.js:161:33
    at ModuleJob.run (node:internal/modules/esm/module_job:274:25)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:644:26)
    at async file:///node-deps/node_modules/secretlint/bin/secretlint.js:14:26 {
  code: 'ERR_PARSE_ARGS_UNKNOWN_OPTION'
}
⚠️ SPELL / cspell - 117 errors 
.gitignore:5:15      - Unknown word (pdflatex)   -- ## Core latex/pdflatex auxiliary files:
	 Suggestions: [plate, palate, pilate, plated, platen]
.gitignore:31:34     - Unknown word (bibtex)     -- Bibliography auxiliary files (bibtex/biblatex/biber):
	 Suggestions: [bite, bible, biter, bites, bitte]
.gitignore:31:41     - Unknown word (biblatex)   -- auxiliary files (bibtex/biblatex/biber):
	 Suggestions: [bible, blate, bibles, biflex, binate]
.gitignore:31:50     - Unknown word (biber)      -- files (bibtex/biblatex/biber):
	 Suggestions: [bier, baber, bider, biker, biter]
.gitignore:40:7      - Unknown word (latexmk)    -- *.fdb_latexmk
	 Suggestions: [latex, latex's, latex2e, latexes, Latex]
.gitignore:41:3      - Unknown word (synctex)    -- *.synctex
	 Suggestions: [synced, synnex, syntax, synched, Synnex]
.gitignore:42:3      - Unknown word (synctex)    -- *.synctex(busy)
	 Suggestions: [synced, synnex, syntax, synched, Synnex]
.gitignore:43:3      - Unknown word (synctex)    -- *.synctex.gz
	 Suggestions: [synced, synnex, syntax, synched, Synnex]
.gitignore:44:3      - Unknown word (synctex)    -- *.synctex.gz(busy)
	 Suggestions: [synced, synnex, syntax, synched, Synnex]
.gitignore:45:3      - Unknown word (pdfsync)    -- *.pdfsync
	 Suggestions: []
.gitignore:48:3      - Unknown word (latexrun)   -- # latexrun
	 Suggestions: [lateran, Lateran, laten, later, latex]
.gitignore:56:3      - Unknown word (achemso)    -- # achemso
	 Suggestions: [aches, ahems, ache's, acheson, Acheson]
.gitignore:59:3      - Unknown word (amsthm)     -- # amsthm
	 Suggestions: [alstom, asthma, Alstom, mash, mast]
.gitignore:62:3      - Unknown word (beamer)     -- # beamer
	 Suggestions: [beaker, beamed, bearer, beater, beaver]
.gitignore:74:3      - Unknown word (cprotect)   -- # cprotect
	 Suggestions: [project, correct, crotch, coronet, curtest]
.gitignore:77:3      - Unknown word (elsarticle) -- # elsarticle (documentclass of Elsevier
	 Suggestions: []
.gitignore:77:15     - Unknown word (documentclass) -- # elsarticle (documentclass of Elsevier journals
	 Suggestions: []
.gitignore:77:32     - Unknown word (Elsevier)      -- elsarticle (documentclass of Elsevier journals)
	 Suggestions: [elzevir, Elzevir, Leerier, elsie, Elsie]
.gitignore:86:3      - Unknown word (feynmf)        -- # feynmf/feynmp
	 Suggestions: [feynman, Feynman, feme, fend, fens]
.gitignore:86:10     - Unknown word (feynmp)        -- # feynmf/feynmp
	 Suggestions: [feynman, Feynman, feme, fend, fens]
.gitignore:93:8      - Unknown word (ledmac)        -- #(r)(e)ledmac/(r)(e)ledpar
	 Suggestions: [leda, leman, lemma, legman, lehman]
.gitignore:93:21     - Unknown word (ledpar)        -- #(r)(e)ledmac/(r)(e)ledpar
	 Suggestions: [lear, leda, lpar, leper, lidar]
.gitignore:102:3     - Unknown word (eledsec)       -- *.eledsec[1-9]
	 Suggestions: [leeds, eldest, elides, eludes, leeds's]
.gitignore:103:3     - Unknown word (eledsec)       -- *.eledsec[1-9]R
	 Suggestions: [leeds, eldest, elides, eludes, leeds's]
.gitignore:104:3     - Unknown word (eledsec)       -- *.eledsec[1-9][0-9]
	 Suggestions: [leeds, eldest, elides, eludes, leeds's]
.gitignore:105:3     - Unknown word (eledsec)       -- *.eledsec[1-9][0-9]R
	 Suggestions: [leeds, eldest, elides, eludes, leeds's]
.gitignore:106:3     - Unknown word (eledsec)       -- *.eledsec[1-9][0-9][0-9]
	 Suggestions: [leeds, eldest, elides, eludes, leeds's]
.gitignore:115:3     - Unknown word (glsdefs)       -- *.glsdefs
	 Suggestions: [glades, glides, glade's, glide's, gliders]
.gitignore:129:3     - Unknown word (gnuplottex)    -- # gnuplottex
	 Suggestions: [gnuplot, unplottext, unplotText, unPlottext, unPlotText]
.gitignore:130:3     - Unknown word (gnuplottex)    -- *-gnuplottex-*
	 Suggestions: [gnuplot, unplottext, unplotText, unPlottext, unPlotText]
.gitignore:132:3     - Unknown word (gregoriotex)   -- # gregoriotex
	 Suggestions: [gregorio, gregorio's]
.gitignore:133:3     - Unknown word (gaux)          -- *.gaux
	 Suggestions: [gaud, gaul, gaur, Gaul, eaux]
.gitignore:134:3     - Unknown word (glog)          -- *.glog
	 Suggestions: [geog, glob, glom, glop, glow]
.gitignore:135:3     - Unknown word (gtex)          -- *.gtex
	 Suggestions: [gte, GTE, tex, Tex, TeX]
.gitignore:137:3     - Unknown word (htlatex)       -- # htlatex
	 Suggestions: [latex, Latex, halted, halter, theater]
.gitignore:145:3     - Unknown word (hyperref)      -- # hyperref
	 Suggestions: [hyper, hyperon, herren, hyperion, hyperons]
.gitignore:148:3     - Unknown word (knitr)         -- # knitr
	 Suggestions: [knit, knits, intr, kier, kite]
.gitignore:150:43    - Unknown word (knitr)         -- next line if you use knitr and want to ignore its
	 Suggestions: [knit, knits, intr, kier, kite]
.gitignore:150:82    - Unknown word (tikz)          -- ignore its generated tikz files
	 Suggestions: [tike, tiki, tizz, taka, take]
.gitignore:151:5     - Unknown word (tikz)          -- # *.tikz
	 Suggestions: [tike, tiki, tizz, taka, take]
.gitignore:152:3     - Unknown word (tikz)          -- *-tikzDictionary
	 Suggestions: [tike, tiki, tizz, taka, take]
.gitignore:157:3     - Unknown word (luatexja)      -- # luatexja-ruby
	 Suggestions: [latex, latex's, latex2e, latexes]
.gitignore:158:3     - Unknown word (ltjruby)       -- *.ltjruby
	 Suggestions: []
.gitignore:160:3     - Unknown word (makeidx)       -- # makeidx
	 Suggestions: [makeindex, MakeIndex, maid, make, maced]
.gitignore:165:3     - Unknown word (minitoc)       -- # minitoc
	 Suggestions: [minio, manioc, minion, manitou, monitor]
.gitignore:178:3     - Unknown word (morewrites)    -- # morewrites
	 Suggestions: [moderates, morganites]
.gitignore:181:3     - Unknown wo

(Truncated to 5714 characters out of 16790)
⚠️ MARKDOWN / markdownlint - 20 errors 
chapters/02_code.md:11:401 MD013/line-length Line length [Expected: 400; Actual: 480]
chapters/02_code.md:45:401 MD013/line-length Line length [Expected: 400; Actual: 595]
chapters/03_testing.md:10:401 MD013/line-length Line length [Expected: 400; Actual: 440]
chapters/03_testing.md:27:401 MD013/line-length Line length [Expected: 400; Actual: 472]
chapters/03_testing.md:29:401 MD013/line-length Line length [Expected: 400; Actual: 418]
chapters/03_testing.md:31:401 MD013/line-length Line length [Expected: 400; Actual: 547]
chapters/03_testing.md:35:401 MD013/line-length Line length [Expected: 400; Actual: 426]
chapters/04_auditing.md:5:401 MD013/line-length Line length [Expected: 400; Actual: 805]
chapters/04_auditing.md:9:401 MD013/line-length Line length [Expected: 400; Actual: 927]
chapters/04_auditing.md:13:401 MD013/line-length Line length [Expected: 400; Actual: 486]
chapters/04_auditing.md:19:401 MD013/line-length Line length [Expected: 400; Actual: 410]
chapters/05_deployments.md:27:401 MD013/line-length Line length [Expected: 400; Actual: 512]
chapters/05_deployments.md:31:401 MD013/line-length Line length [Expected: 400; Actual: 406]
chapters/05_deployments.md:33:401 MD013/line-length Line length [Expected: 400; Actual: 417]
chapters/05_deployments.md:37:401 MD013/line-length Line length [Expected: 400; Actual: 514]
chapters/05_deployments.md:38:401 MD013/line-length Line length [Expected: 400; Actual: 414]
chapters/05_deployments.md:43:401 MD013/line-length Line length [Expected: 400; Actual: 579]
README.md:9:401 MD013/line-length Line length [Expected: 400; Actual: 739]
README.md:11:401 MD013/line-length Line length [Expected: 400; Actual: 639]
README.md:13:401 MD013/line-length Line length [Expected: 400; Actual: 511]
⚠️ SPELL / proselint - 5 errors 
chapters/01_planning.md:15:65: redundancy.garner Redundancy. Use 'interact' instead of 'interact with each other.'.
chapters/03_testing.md:3:64: garner.phrasal_adjectives.ly No hyphen is necessary in phrasal adjectives with an adverb ending in -ly, unless the -ly adverb is part of a longer phrase
chapters/05_deployments.md:9:42: weasel_words.very Substitute 'damn' every time you're inclined to write 'very'; your editor will delete it and the writing will be just as it should be. Found 4 times elsewhere.
chapters/05_deployments.md:11:255: redundancy.garner Redundancy. Use 'interact' instead of 'interact with each other.'.
chapters/06_operating.md:3:5: leonard.exclamation.30ppm More than 30 ppm of exclamations. Keep them under control.

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,JAVASCRIPT_PRETTIER,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,SPELL_PROSELINT,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT

MegaLinter is graciously provided by OX Security

@renovate renovate Bot changed the title chore(deps): update oxsecurity/megalinter action to v9 Update oxsecurity/megalinter action to v9 Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

prod

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants