chore(deps): bump megalinter/megalinter from 9.4.0 to 9.6.0

[dependabot]

Bumps megalinter/megalinter from 9.4.0 to 9.6.0.

Release notes

Sourced from megalinter/megalinter's releases.

v9.6.0

What's Changed

• Breaking changes

  • Linters can no longer be run via a sibling Docker image at runtime. The cli_docker_image, cli_docker_image_version and cli_docker_args descriptor properties (and the matching <LINTER>_DOCKER_IMAGE_VERSION variable) have been removed, and MegaLinter no longer mounts /var/run/docker.sock (in mega-linter-runner, the GitHub Action action.yml files, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism was SWIFT_SWIFTLINT, now installed natively (see below). (#8216)
  • SWIFT_SWIFTLINT is now installed from the static swiftlint-static binary instead of running the ghcr.io/realm/swiftlint container. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)
  • @eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869)
  • ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor. (#7869)
  • JSON_ESLINT_PLUGIN_JSONC removed: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead. (#7869)

• Core

  • New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)
  • Skipped-linters summary now explains why a linter was skipped by an activation rule, including the variable to set to activate it (e.g. MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.

• New linters

  • Add betterleaks linter for repository secrets scanning — successor to gitleaks with higher recall (98.6% vs 70.4%), lower false-positive rates, and 4–5× faster scanning via BPE-based detection and CEL filter expressions (#8186)

• Disabled linters

  • SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA and SALESFORCE_SFDX_SCANNER_LWC — disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal of SlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use the SALESFORCE_CODE_ANALYZER_APEX / SALESFORCE_CODE_ANALYZER_AURA / SALESFORCE_CODE_ANALYZER_LWC variants instead (#8080).

• Deprecated linters

  • REPOSITORY_GITLEAKS — deprecated in favour of REPOSITORY_BETTERLEAKS (same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by adding REPOSITORY_GITLEAKS to DISABLE_LINTERS in your .mega-linter.yml. (#8186)

• Removed linters

  • JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes) (#7869)

• Linters enhancements

  • REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)

• Fixes

  • REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global git safe.directory config, so git mode failed with fatal: detected dubious ownership in repository in CI environments (e.g. GitHub Actions /github/workspace). Git-history mode is still used for the opt-in REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN feature. (#8186)
  • REPOSITORY_BETTERLEAKS: added --verbose so detected findings (file, line and rule) are reported instead of only the leaks found: N summary, matching gitleaks behavior. Secret values stay redacted via --redact. (#8186)
  • REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).
  • Fix intermittent ansible-lint load-failure[not-found] error on github_conf/branch_protection_rules.json caused by a race condition with checkov running in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).
  • Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected. Docker images now build on the python:3.14-alpine3.24 base image (#8080).
  • Avoid DeprecationWarning / future breakage on Python 3.14 by no longer passing count and flags as positional arguments to re.sub (#8211).
  • Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing #7845.
  • Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)
  • Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.
  • Fix make bootstrap appearing to hang because exported Make color variables re-evaluated tput during recursive make invocations. (#8090)
  • Allow MegaLinter containers to run in an opt-in non-root mode matching the host UID:GID on POSIX systems, avoiding root-owned generated files on the host (#1975).
  • Restore missing examples in the Dart descriptor that were dropped from the generated documentation (#7913).

• Reporters

  • Update Bitbucket pipeline generator template to trigger builds on pull requests from any branch, by @​yermulnik in oxsecurity/megalinter#7421

• Doc

  • Add pnpm installation and usage documentation for JavaScript and TypeScript linters (#8177)
  • Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats
  • Bump peter-evans/create-pull-request to v8 in the documented workflow examples (#8089)

... (truncated)

Changelog

Sourced from megalinter/megalinter's changelog.

[v9.6.0] - 2026-06-28

• Breaking changes

  • Linters can no longer be run via a sibling Docker image at runtime. The cli_docker_image, cli_docker_image_version and cli_docker_args descriptor properties (and the matching <LINTER>_DOCKER_IMAGE_VERSION variable) have been removed, and MegaLinter no longer mounts /var/run/docker.sock (in mega-linter-runner, the GitHub Action action.yml files, and the Docker daemon previously bundled in flavor images). This closes the host-privilege escalation surface that the mounted Docker socket exposed. The only linter that used this mechanism was SWIFT_SWIFTLINT, now installed natively (see below). (#8216)
  • SWIFT_SWIFTLINT is now installed from the static swiftlint-static binary instead of running the ghcr.io/realm/swiftlint container. It runs natively on the Alpine image with no Docker socket required. SourceKit-dependent rules are disabled in this build and reported to the console when encountered; pure-syntax style rules are unaffected. (#8216)
  • @eslint/eslintrc shim removed from JavaScript/TypeScript/JSX/TSX Docker images (was only needed for legacy FlatCompat); MegaLinter's bundled test fixtures use native flat config. (#7869)
  • ESLint linters now force migration off .eslintrc.*: JAVASCRIPT_ES, TYPESCRIPT_ES, JSX_ESLINT, TSX_ESLINT activate when they find any eslint.config.* or any deprecated .eslintrc.* / package.json#eslintConfig. In the legacy case the linter does not call ESLint at all — it emits a single hard failure with a migration message so the build stays red until the config is migrated to flat config. See the ESLint flat-config migration guide. To opt out, set DISABLE_LINTERS or DISABLE to exclude the affected linter/descriptor. (#7869)
  • JSON_ESLINT_PLUGIN_JSONC removed: upstream bug ota-meshi/eslint-plugin-jsonc#328 blocks ESLint v10 compatibility and will not be fixed. Use JSON_JSONLINT, JSON_PRETTIER, or JSON_V8R for JSON validation instead. (#7869)

• Core

  • New linter descriptor property common_linter_errors: declare known non-lint failure patterns (config issue, remote service down, missing credentials…) and the guidance message shown to users, directly in YAML — no custom Python class needed. (#7907)
  • Skipped-linters summary now explains why a linter was skipped by an activation rule, including the variable to set to activate it (e.g. MARKDOWN_RUMDL: MARKDOWN_DEFAULT_STYLE=markdownlint (set MARKDOWN_DEFAULT_STYLE=rumdl to activate)), fixing #8017.

• New linters

  • Add betterleaks linter for repository secrets scanning — successor to gitleaks with higher recall (98.6% vs 70.4%), lower false-positive rates, and 4–5× faster scanning via BPE-based detection and CEL filter expressions (#8186)

• Disabled linters

  • SALESFORCE_SFDX_SCANNER_APEX, SALESFORCE_SFDX_SCANNER_AURA and SALESFORCE_SFDX_SCANNER_LWC — disabled because sfdx-scanner 4.12.0 crashes on Node.js 22+ (TypeError: Cannot read properties of undefined (reading 'prototype'), caused by the removal of SlowBuffer.prototype), which is shipped with Alpine 3.24. These linters were already deprecated; use the SALESFORCE_CODE_ANALYZER_APEX / SALESFORCE_CODE_ANALYZER_AURA / SALESFORCE_CODE_ANALYZER_LWC variants instead (#8080).

• Deprecated linters

  • REPOSITORY_GITLEAKS — deprecated in favour of REPOSITORY_BETTERLEAKS (same author, fully compatible config, significantly better detection). Will be removed in the next major release. Disable it by adding REPOSITORY_GITLEAKS to DISABLE_LINTERS in your .mega-linter.yml. (#8186)

• Removed linters

  • JSON_ESLINT_PLUGIN_JSONC — permanently broken by upstream bug (see Breaking changes) (#7869)

• Linters enhancements

  • REPOSITORY_CHECKOV: in pull-request mode, scan only the files modified in the PR instead of the whole repository (#7119)

• Fixes

  • REPOSITORY_BETTERLEAKS: default scan now runs in filesystem (dir) mode instead of auto-switching to git-history (git) mode when a git repository is detected. betterleaks does not read the global git safe.directory config, so git mode failed with fatal: detected dubious ownership in repository in CI environments (e.g. GitHub Actions /github/workspace). Git-history mode is still used for the opt-in REPOSITORY_BETTERLEAKS_PR_COMMITS_SCAN feature. (#8186)
  • REPOSITORY_BETTERLEAKS: added --verbose so detected findings (file, line and rule) are reported instead of only the leaks found: N summary, matching gitleaks behavior. Secret values stay redacted via --redact. (#8186)
  • REPOSITORY_OSV_SCANNER: exit code 128 ("No package sources found") is now treated as a clean pass instead of a failure — osv-scanner returns this code when the repo contains no lockfiles/manifests/SBOMs, which is not a vulnerability finding (#7917).
  • Fix intermittent ansible-lint load-failure[not-found] error on github_conf/branch_protection_rules.json caused by a race condition with checkov running in parallel. Checkov's transient GitHub-conf directory is now written to a hidden path (.megalinter_github_conf) that project-mode linters skip, eliminating the conflict (#8092).
  • Complete the Alpine 3.24 upgrade across the whole image and fix how alpine version is detected. Docker images now build on the python:3.14-alpine3.24 base image (#8080).
  • Avoid DeprecationWarning / future breakage on Python 3.14 by no longer passing count and flags as positional arguments to re.sub (#8211).
  • Exclude REPORT_OUTPUT_FOLDER from linting when configured as an absolute path inside the workspace (e.g. /tmp/lint/megalinter-reports), fixing #7845.
  • Fix command injection in Roslynator linter (DOTNET_ROSLYNATOR) where a crafted .csproj filename could break out of dotnet restore arguments and execute arbitrary shell commands. The command is now invoked via argv list instead of a shell string. Reported by Francesco Sabiu. (#7857)
  • Fix IndexError when building the single-linter Docker image for a linter whose activation depends on a file (e.g. SPELL_VALE requires .vale.ini): python -m megalinter.run --linterversion now bypasses activation filtering since the per-linter image is built for that linter unconditionally.
  • Fix make bootstrap appearing to hang because exported Make color variables re-evaluated tput during recursive make invocations. (#8090)
  • Allow MegaLinter containers to run in an opt-in non-root mode matching the host UID:GID on POSIX systems, avoiding root-owned generated files on the host (#1975).
  • Restore missing examples in the Dart descriptor that were dropped from the generated documentation (#7913).

• Reporters

  • Update Bitbucket pipeline generator template to trigger builds on pull requests from any branch, by @​yermulnik in oxsecurity/megalinter#7421

• Doc

  • Add pnpm installation and usage documentation for JavaScript and TypeScript linters (#8177)
  • Update Docker pull counters in README badges and flavors-stats.json with latest ghcr.io stats
  • Bump peter-evans/create-pull-request to v8 in the documented workflow examples (#8089)

... (truncated)

Commits

• ef3e84b Release MegaLinter v9.6.0
• 8b9259b Skill prepare-release (#8245)
• 5810155 chore(deps): bump pymdown-extensions from 10.21.3 to 11.0 in /.config/python/...
• aca415c chore(deps): update dependency semver to v7.8.5 (#8198)
• 2d8b274 Remove max-parallel for linters
• e9ab3e9 chore(ci): manual run of deploy linters beta job (#8242)
• a8a6368 Changelog (#8241)
• 7f363c6 [automation] Auto-update linters version, help and documentation (#8215)
• bce5232 chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.11.25 (#8232)
• 9d98266 chore(deps): update dependency realm/swiftlint to v0.65.0 (#8240)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	2		0	0	0.01s
❌ ACTION	zizmor	2		1	0	0.19s
⚠️ COPYPASTE	jscpd	yes		13	no	0.6s
⚠️ GO	golangci-lint	yes		1	no	66.93s
✅ GO	revive	yes		no	no	10.64s
✅ MARKDOWN	markdownlint	1		0	0	1.16s
✅ MARKDOWN	markdown-table-formatter	1		0	0	0.64s
✅ REPOSITORY	betterleaks	yes		no	no	1.62s
✅ REPOSITORY	checkov	yes		no	no	27.81s
✅ REPOSITORY	gitleaks	yes		no	no	0.49s
✅ REPOSITORY	git_diff	yes		no	no	0.02s
✅ REPOSITORY	grype	yes		no	no	101.87s
❌ REPOSITORY	osv-scanner	yes		1	no	28.39s
✅ REPOSITORY	secretlint	yes		no	no	0.95s
✅ REPOSITORY	syft	yes		no	no	9.01s
✅ REPOSITORY	trivy	yes		no	no	18.39s
✅ REPOSITORY	trivy-sbom	yes		no	no	7.15s
✅ REPOSITORY	trufflehog	yes		no	no	4.92s
✅ SPELL	lychee	5		0	0	0.41s
⚠️ YAML	prettier	4		1	2	0.93s
✅ YAML	v8r	4		0	0	3.38s
✅ YAML	yamllint	4		0	0	1.48s

Detailed Issues

❌ REPOSITORY / osv-scanner - 1 error

Scanning dir .
Starting filesystem walk for root: /
Scanned go.mod file and found 162 packages
End status: 86 dirs visited, 208 inodes visited, 1 Extract calls, 9.929128ms elapsed, 9.9293ms wall time

Total 2 packages affected by 10 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 10 Unknown) from 1 ecosystem.
9 vulnerabilities can be fixed.

+------------------------------+------+-----------+-------------------------------------+---------+---------------+--------+
| OSV URL                      | CVSS | ECOSYSTEM | PACKAGE                             | VERSION | FIXED VERSION | SOURCE |
+------------------------------+------+-----------+-------------------------------------+---------+---------------+--------+
| https://osv.dev/GO-2024-3218 |      | Go        | github.com/libp2p/go-libp2p-kad-dht | 0.40.0  | --            | go.mod |
| https://osv.dev/GO-2026-4601 |      | Go        | stdlib                              | 1.25.7  | 1.25.8        | go.mod |
| https://osv.dev/GO-2026-4602 |      | Go        | stdlib                              | 1.25.7  | 1.25.8        | go.mod |
| https://osv.dev/GO-2026-4870 |      | Go        | stdlib                              | 1.25.7  | 1.25.9        | go.mod |
| https://osv.dev/GO-2026-4918 |      | Go        | stdlib                              | 1.25.7  | 1.25.10       | go.mod |
| https://osv.dev/GO-2026-4946 |      | Go        | stdlib                              | 1.25.7  | 1.25.9        | go.mod |
| https://osv.dev/GO-2026-4947 |      | Go        | stdlib                              | 1.25.7  | 1.25.9        | go.mod |
| https://osv.dev/GO-2026-4971 |      | Go        | stdlib                              | 1.25.7  | 1.25.10       | go.mod |
| https://osv.dev/GO-2026-5037 |      | Go        | stdlib                              | 1.25.7  | 1.25.11       | go.mod |
| https://osv.dev/GO-2026-5039 |      | Go        | stdlib                              | 1.25.7  | 1.25.11       | go.mod |
+------------------------------+------+-----------+-------------------------------------+---------+---------------+--------+

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

⚠️ GO / golangci-lint - 1 error

../../..cmd/mesh-commands.go:72:4: exitAfterDefer: log.Fatal will exit, and `defer cancel()` will not run (gocritic)
			log.Fatal().Err(err).Msg("dispatch failed")
			^
../../..pkg/mesh/host.go:12:1: File is not properly formatted (gofmt)
	dht "github.com/libp2p/go-libp2p-kad-dht"
^
../../..pkg/mesh/http.go:35:1: File is not properly formatted (gofmt)
	mux.HandleFunc("/exec", h.handleLocal)         // run on local node only
^
../../..pkg/mesh/types.go:68:1: File is not properly formatted (gofmt)
	ID        string          `json:"id"`        // matches Command.ID
^
../../..pkg/laws/user.go:118:2: QF1003: could use tagged switch on facts.Facts.Distro.Family (staticcheck)
	if facts.Facts.Distro.Family == "alpine" {
	^
5 issues:
* gocritic: 1
* gofmt: 3
* staticcheck: 1

⚠️ COPYPASTE / jscpd - 13 errors

Using config from /action/lib/.automation/.jscpd.json
Clone found (go)
 - cmd/local-apply.go [48:75 - 61:4] (14 lines, 56 tokens)
   cmd/local-lint.go [49:52 - 61:4]
Clone found (go)
 - cmd/local-apply.go [52:12 - 63:5] (12 lines, 58 tokens)
   cmd/local-pretend.go [52:12 - 63:7]
Clone found (go)
 - cmd/local-lint.go [48:3 - 62:33] (15 lines, 94 tokens)
   cmd/local-pretend.go [48:3 - 62:29]
Clone found (go)
 - pkg/laws/file.go [250:21 - 259:26] (10 lines, 67 tokens)
   pkg/laws/file.go [300:23 - 309:26]
Clone found (go)
 - pkg/laws/file.go [251:3 - 262:10] (12 lines, 82 tokens)
   pkg/laws/file.go [381:2 - 392:41]
Clone found (go)
 - pkg/laws/file.go [282:3 - 299:3] (18 lines, 163 tokens)
   pkg/laws/file.go [333:3 - 350:3]
Clone found (go)
 - pkg/laws/file.go [302:13 - 313:6] (12 lines, 65 tokens)
   pkg/laws/file.go [382:12 - 394:91]
Clone found (go)
 - pkg/laws/file.go [328:61 - 348:4] (21 lines, 186 tokens)
   pkg/laws/file.go [411:58 - 431:3]
Clone found (go)
 - pkg/laws/mount.go [75:15 - 81:5] (7 lines, 51 tokens)
   pkg/laws/mount.go [114:21 - 120:5]
Clone found (go)
 - pkg/laws/service.go [152:7 - 157:29] (6 lines, 55 tokens)
   pkg/laws/service.go [171:5 - 176:27]
Clone found (go)
 - pkg/laws/ssh.go [70:4 - 80:35] (11 lines, 92 tokens)
   pkg/laws/ssh.go [99:3 - 109:34]
Clone found (go)
 - pkg/mesh/http.go [215:2 - 224:2] (10 lines, 67 tokens)
   pkg/mesh/http.go [237:2 - 246:2]
Clone found (go)
 - pkg/mesh/service.go [233:61 - 238:28] (6 lines, 56 tokens)
   pkg/mesh/service.go [276:78 - 281:28]
┌────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ go     │ 32             │ 5626        │ 27785        │ 13           │ 141 (2.51%)      │ 1092 (3.93%)      │
├────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total: │ 32             │ 5626        │ 27785        │ 13           │ 141 (2.51%)      │ 1092 (3.93%)      │
└────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 13 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (2.5%) over threshold (0.0%)
time: 113.055ms

⚠️ YAML / prettier - 1 error

Checking formatting...
[warn] .github/workflows/megalinter.yaml
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,COPYPASTE_JSCPD,GO_GOLANGCI_LINT,GO_REVIVE,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository