carson 2.16.1 → 2.17.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/RELEASE.md +24 -0
- data/VERSION +1 -1
- data/lib/carson/config.rb +1 -1
- data/templates/.github/.mega-linter.yml +24 -0
- data/templates/.github/workflows/carson-lint.yml +1 -0
- metadata +2 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d65e5e487eef845979a9d198caa500ba17464cd944a19fe0eed72920eabe5c0b
|
|
4
|
+
data.tar.gz: 84cc21d8a7b499e69918410c69c78573a6c6d58b0b83e395ad2d4303bec90f6c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: dbc24993812dc8bed85be6493a85386cf8038ef265c842c23bc428779cd215eedb7f8a642cbcddfed04722b26ebdeae57d7609944d2a439fc7322035c458d357
|
|
7
|
+
data.tar.gz: 681e8626a1e3185df143b4a2202d4633bb5d25c58c7f3a74debe6459fed95d49a194edca27d3f09792cbe43a7d7b65199c4e3eca5c846dbe4d887cefa7171464
|
data/RELEASE.md
CHANGED
|
@@ -5,6 +5,30 @@ Release-note scope rule:
|
|
|
5
5
|
- `RELEASE.md` records only version deltas, breaking changes, and migration actions.
|
|
6
6
|
- Operational usage guides live in `MANUAL.md` and `API.md`.
|
|
7
7
|
|
|
8
|
+
## 2.17.1 — Disable IaC Security Scanners
|
|
9
|
+
|
|
10
|
+
### What changed
|
|
11
|
+
|
|
12
|
+
- Disabled `REPOSITORY_CHECKOV` and `REPOSITORY_KICS` in the MegaLinter config template. Both are IaC security scanners that flag Carson's own workflow permissions (`issues: write`, `pull-requests: write`) as overly permissive — but MegaLinter needs these to post PR comments. Same false positive in every governed repo.
|
|
13
|
+
|
|
14
|
+
### No migration required
|
|
15
|
+
|
|
16
|
+
Run `carson refresh` — the updated template propagates automatically.
|
|
17
|
+
|
|
18
|
+
## 2.17.0 — MegaLinter Configuration Template
|
|
19
|
+
|
|
20
|
+
### What changed
|
|
21
|
+
|
|
22
|
+
- Added `.mega-linter.yml` as a Carson-managed template, deployed to `.github/.mega-linter.yml` in governed repositories. Previously MegaLinter ran with its own defaults, ignoring project-level configs and producing thousands of false positives.
|
|
23
|
+
- **Project configs first**: `LINTER_RULES_PATH: "."` tells MegaLinter to use project-root config files (`.rubocop.yml`, `.eslintrc`, etc.) instead of built-in defaults. Fixes the RuboCop indentation mismatch.
|
|
24
|
+
- **Vendor exclusions**: `FILTER_REGEX_EXCLUDE` skips `vendor/`, `node_modules/`, `public/packs`, `public/assets`, `tmp/`, `log/`, and `coverage/`.
|
|
25
|
+
- **Noisy linters disabled**: `SPELL_CSPELL` (needs per-project dictionary), `COPYPASTE_JSCPD` (false positives on generated code), `HTML_DJLINT` (designed for Jinja, not ERB).
|
|
26
|
+
- Updated `carson-lint.yml` workflow with `MEGALINTER_CONFIG: .github/.mega-linter.yml` to point MegaLinter at the non-default config location.
|
|
27
|
+
|
|
28
|
+
### Migration
|
|
29
|
+
|
|
30
|
+
Run `carson refresh` — the new template is applied automatically and propagated to governed repos.
|
|
31
|
+
|
|
8
32
|
## 2.16.1 — Template Propagation Cleanup Fix
|
|
9
33
|
|
|
10
34
|
### What changed
|
data/VERSION
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
2.
|
|
1
|
+
2.17.1
|
data/lib/carson/config.rb
CHANGED
|
@@ -48,7 +48,7 @@ module Carson
|
|
|
48
48
|
}
|
|
49
49
|
},
|
|
50
50
|
"template" => {
|
|
51
|
-
"managed_files" => [ ".github/carson.md", ".github/copilot-instructions.md", ".github/CLAUDE.md", ".github/AGENTS.md", ".github/pull_request_template.md", ".github/workflows/carson-lint.yml" ],
|
|
51
|
+
"managed_files" => [ ".github/carson.md", ".github/copilot-instructions.md", ".github/CLAUDE.md", ".github/AGENTS.md", ".github/pull_request_template.md", ".github/workflows/carson-lint.yml", ".github/.mega-linter.yml" ],
|
|
52
52
|
"superseded_files" => [ ".github/carson-instructions.md" ]
|
|
53
53
|
},
|
|
54
54
|
"lint" => {
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# Carson-managed MegaLinter configuration.
|
|
2
|
+
# Pushed to governed repositories by `carson template apply`.
|
|
3
|
+
# To override, add entries to a local .mega-linter.yml — MegaLinter merges both.
|
|
4
|
+
|
|
5
|
+
# Use project-root linter configs (.rubocop.yml, .eslintrc, etc.)
|
|
6
|
+
# instead of MegaLinter's built-in defaults.
|
|
7
|
+
LINTER_RULES_PATH: "."
|
|
8
|
+
|
|
9
|
+
# Only lint changed files on PRs, not the entire codebase.
|
|
10
|
+
VALIDATE_ALL_CODEBASE: false
|
|
11
|
+
|
|
12
|
+
# Exclude vendored, generated, and dependency directories.
|
|
13
|
+
FILTER_REGEX_EXCLUDE: "(vendor/|node_modules/|public/packs|public/assets|tmp/|log/|coverage/)"
|
|
14
|
+
|
|
15
|
+
# Disable linters that are too noisy without per-project configuration.
|
|
16
|
+
# checkov and kics are IaC security scanners — they flag Carson's own
|
|
17
|
+
# workflow permissions (issues: write, pull-requests: write) as overly
|
|
18
|
+
# permissive, but MegaLinter needs these to post PR comments.
|
|
19
|
+
DISABLE_LINTERS:
|
|
20
|
+
- SPELL_CSPELL
|
|
21
|
+
- COPYPASTE_JSCPD
|
|
22
|
+
- HTML_DJLINT
|
|
23
|
+
- REPOSITORY_CHECKOV
|
|
24
|
+
- REPOSITORY_KICS
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: carson
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.
|
|
4
|
+
version: 2.17.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Hailei Wang
|
|
@@ -63,6 +63,7 @@ files:
|
|
|
63
63
|
- lib/carson/runtime/review/utility.rb
|
|
64
64
|
- lib/carson/runtime/setup.rb
|
|
65
65
|
- lib/carson/version.rb
|
|
66
|
+
- templates/.github/.mega-linter.yml
|
|
66
67
|
- templates/.github/AGENTS.md
|
|
67
68
|
- templates/.github/CLAUDE.md
|
|
68
69
|
- templates/.github/carson.md
|