mega-linter-runner 9.4.0 → 9.6.0

package/generators/mega-linter/index.js

@@ -191,6 +191,14 @@ When you don't know what option to select, please use default values`
       this.validateAllCodeBaseGha += "              github.ref == 'refs/heads/main'"
       this.validateAllCodeBaseGha += "            }}";
     }
+    // persist-credentials
+    if (this.props.applyFixes === true) {
+      this.persistCredentials =
+        "# persist-credentials: false # Comment this line and uncomment the next one if you use APPLY_FIXES\n          persist-credentials: true # zizmor: ignore[artipacked]";
+    } else {
+      this.persistCredentials =
+        "persist-credentials: false # Comment this line and uncomment the next one if you use APPLY_FIXES\n          # persist-credentials: true # zizmor: ignore[artipacked]";
+    }
     this.disable = false;
     // COPY PASTES
     if (this.props.copyPaste === true) {
@@ -224,6 +232,7 @@ When you don't know what option to select, please use default values`
         DEFAULT_BRANCH: this.props.defaultBranch,
         GITHUB_ACTION_NAME: this.gitHubActionName,
         GITHUB_ACTION_VERSION: this.gitHubActionVersion,
+        PERSIST_CREDENTIALS: this.persistCredentials,
         VALIDATE_ALL_CODE_BASE_GHA: this.validateAllCodeBaseGha,
       }
     );

package/generators/mega-linter/templates/bitbucket-pipelines.yml

@@ -4,22 +4,23 @@
 image: atlassian/default-image:5
 
 pipelines:
-  default:
-    - parallel:
-        - step:
-            name: Run MegaLinter
-            image: <%= DOCKER_IMAGE_NAME %>:<%= DOCKER_IMAGE_VERSION %>
-            script:
-              # Disable LLM Advisor for bot PRs (dependabot, renovate, etc.)
-              # Note: Bitbucket has limited access to PR metadata, this is a basic check
-              - |
-                if [[ "$BITBUCKET_BRANCH" =~ ^(dependabot|renovate)/ ]] ||
-                   [[ "$BITBUCKET_PR_TITLE" =~ ^(chore|fix|deps?|bump)(\(.*\))?: ]] ||
-                   [[ "$BITBUCKET_STEP_TRIGGERER_UUID" =~ dependabot|renovate ]]; then
-                  export LLM_ADVISOR_ENABLED=false
-                else
-                  export LLM_ADVISOR_ENABLED=true
-                fi
-              - export DEFAULT_WORKSPACE=$BITBUCKET_CLONE_DIR && bash /entrypoint.sh
-            artifacts:
-              - megalinter-reports/**
+  pull-requests: # Note: Bitbucket PR comment reporting requires pull request context
+    "**": # Run on PRs for any branch (the source branch of the pull request)
+      - parallel:
+          - step:
+              name: Run MegaLinter
+              image: <%= DOCKER_IMAGE_NAME %>:<%= DOCKER_IMAGE_VERSION %>
+              script:
+                # Disable LLM Advisor for bot PRs (dependabot, renovate, etc.)
+                # Note: Bitbucket has limited access to PR metadata, this is a basic check
+                - |
+                  if [[ "$BITBUCKET_BRANCH" =~ ^(dependabot|renovate)/ ]] ||
+                     [[ "$BITBUCKET_PR_TITLE" =~ ^(chore|fix|deps?|bump)(\(.*\))?: ]] ||
+                     [[ "$BITBUCKET_STEP_TRIGGERER_UUID" =~ dependabot|renovate ]]; then
+                    export LLM_ADVISOR_ENABLED=false
+                  else
+                    export LLM_ADVISOR_ENABLED=true
+                  fi
+                - export DEFAULT_WORKSPACE=$BITBUCKET_CLONE_DIR && bash /entrypoint.sh
+              artifacts:
+                - megalinter-reports/**

package/generators/mega-linter/templates/mega-linter.yml

@@ -35,6 +35,8 @@ concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   megalinter:
     name: MegaLinter
@@ -52,7 +54,17 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v6
         with:
+          # SECURITY NOTE: Using a Personal Access Token (PAT) is NOT
+          # recommended. Open-source projects have been heavily targeted by
+          # supply-chain attacks in recent months, and a leaked PAT can give
+          # attackers broad write access to your repository — better safe
+          # than sorry! If you only need workflows to re-trigger after
+          # MegaLinter applies fixes, prefer one of these safer alternatives:
+          #   - Manually re-run the workflow from the GitHub Actions tab, or
+          #   - Push another commit on the branch to trigger workflows again.
+          # Only define `secrets.PAT` if you fully understand the trade-off.
           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
+          <%- PERSIST_CREDENTIALS %>
 
           # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
           # improve performance
@@ -124,7 +136,7 @@ jobs:
       # Create pull request if applicable
       # (for now works only on PR from same repository, not from forks)
       - name: Create Pull Request with applied fixes
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8
         id: cpr
         if: >-
           steps.ml.outputs.has_updated_sources == 1 &&
@@ -139,6 +151,10 @@ jobs:
           ) &&
           !contains(github.event.head_commit.message, 'skip fix')
         with:
+          # SECURITY NOTE: see the warning on the checkout step above —
+          # using `secrets.PAT` is NOT recommended for security reasons.
+          # Prefer manually re-running the workflow or pushing another
+          # commit on the branch to trigger workflows again.
           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
           commit-message: "[MegaLinter] Apply linters automatic fixes"
           title: "[MegaLinter] Apply linters automatic fixes"
@@ -157,9 +173,12 @@ jobs:
             github.event.pull_request.head.repo.full_name == github.repository
           ) &&
           !contains(github.event.head_commit.message, 'skip fix')
+        env:
+          PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
+          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
         run: |
-          echo "PR Number - ${{ steps.cpr.outputs.pull-request-number }}"
-          echo "PR URL - ${{ steps.cpr.outputs.pull-request-url }}"
+          echo "PR Number - ${PR_NUMBER}"
+          echo "PR URL - ${PR_URL}"
 
       # Push new commit if applicable
       # (for now works only on PR from same repository, not from forks)

package/generators/mega-linter-custom-flavor/templates/README.md

@@ -33,14 +33,20 @@ This custom flavor is automatically kept up to date with MegaLinter releases:
 
 ## Configuration requirements
 
-### Required: Personal Access Token
+### Optional: Personal Access Token (use with care)
+
+> **Security warning**: Using a Personal Access Token (PAT) is **not recommended**. Open-source projects have been heavily targeted by supply-chain attacks in recent months, and a leaked or compromised PAT can give attackers broad write access to your repository — better safe than sorry!
+> If you do not need fully automatic daily version sync, you can skip the PAT entirely and trigger the `check-new-megalinter-version` workflow manually whenever you want to upgrade.
+
+If you decide automatic daily releases are worth the trade-off, configure a `PAT_TOKEN` secret as a **repository-scoped fine-grained token** with:
 
-For automatic version checking to work, a `PAT_TOKEN` secret must be configured as a **repository-scoped fine-grained token** with:
 - **Repository access**: Only select repositories (select this repository)
 - **Repository permissions**:
   - Contents: Read and write
   - Actions: Read and write
 
+Rotate the token regularly.
+
 See the [Custom Flavors documentation](https://megalinter.io/beta/custom-flavors/) for detailed setup instructions.
 
 ### Optional: Docker Hub publishing

package/generators/mega-linter-custom-flavor/templates/action.yml

@@ -9,9 +9,6 @@ runs:
   using: "docker"
   # You can manually update the Docker image version here, or use the latest tag
   image: "docker://<%= DOCKER_IMAGE_VERSION %>"
-  args:
-    - "-v"
-    - "/var/run/docker.sock:/var/run/docker.sock:rw"
 branding:
   icon: "check"
   color: "green"

package/generators/mega-linter-custom-flavor/templates/check-new-megalinter-version.yml

@@ -26,7 +26,17 @@
 #     This is required to trigger the builder workflow. Without it, the workflow
 #     will fail and the release will be deleted (to be recreated once the token is set).
 #
-# To create a Fine-grained PAT (recommended - more secure):
+# SECURITY WARNING: Using a PAT comes with risk. Open-source projects have been
+# heavily targeted by supply-chain attacks in recent months, and a leaked or
+# compromised PAT can give attackers broad write access to your repository —
+# better safe than sorry! If you do not need fully automatic daily version
+# sync, you can skip the PAT entirely and trigger this workflow manually
+# (Actions tab → "Check for New MegaLinter Version" → "Run workflow") whenever
+# you want to bump to a new MegaLinter release. Only configure PAT_TOKEN if
+# the daily automation is worth the trade-off, and always scope it to this
+# single repository with the minimum required permissions.
+#
+# To create a Fine-grained PAT (still discouraged unless you need automation):
 #   1. Go to GitHub Settings > Developer settings > Personal access tokens > Fine-grained tokens
 #   2. Click "Generate new token"
 #   3. Give it a descriptive name (e.g., "MegaLinter Auto-Release")
@@ -62,6 +72,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Fetch MegaLinter Repository Tags
         id: fetch-megalinter-tags
@@ -109,12 +120,12 @@ jobs:
 
       - name: Find New Version
         id: find-new-version
+        env:
+          LATEST_MEGALINTER_TAG: ${{ steps.fetch-megalinter-tags.outputs.latest_tag }}
+          LATEST_REPO_TAG: ${{ steps.fetch-repo-tags.outputs.latest_repo_tag }}
         run: |
           echo "Comparing versions..."
 
-          LATEST_MEGALINTER_TAG="${{ steps.fetch-megalinter-tags.outputs.latest_tag }}"
-          LATEST_REPO_TAG="${{ steps.fetch-repo-tags.outputs.latest_repo_tag }}"
-
           echo "Latest MegaLinter tag: $LATEST_MEGALINTER_TAG"
           echo "Latest repository tag: $LATEST_REPO_TAG"
 
@@ -170,11 +181,10 @@ jobs:
           # Use PAT_TOKEN if available, otherwise fall back to GITHUB_TOKEN
           # Note: GITHUB_TOKEN doesn't have permission to trigger workflows
           GITHUB_TOKEN: ${{ secrets.PAT_TOKEN || secrets.GITHUB_TOKEN }}
+          NEW_VERSION: ${{ steps.find-new-version.outputs.new_version }}
         run: |
           echo "Triggering megalinter-custom-flavor-builder workflow..."
 
-          NEW_VERSION="${{ steps.find-new-version.outputs.new_version }}"
-
           # Trigger the workflow using GitHub CLI and capture output
           set +e  # Don't exit immediately on error
           gh workflow run megalinter-custom-flavor-builder.yml \
@@ -212,12 +222,12 @@ jobs:
               echo "::error::2. Token name: 'MegaLinter Auto-Release'"
               echo "::error::3. Expiration: Choose 90 days or 1 year"
               echo "::error::4. Repository access: Select 'Only select repositories'"
-              echo "::error::5. Choose repository: ${{ github.repository }}"
+              echo "::error::5. Choose repository: ${GITHUB_REPOSITORY}"
               echo "::error::6. Repository permissions:"
               echo "::error::   - Contents: Read and write"
               echo "::error::   - Actions: Read and write"
               echo "::error::7. Click 'Generate token' and copy it"
-              echo "::error::8. Go to: https://github.com/${{ github.repository }}/settings/secrets/actions"
+              echo "::error::8. Go to: https://github.com/${GITHUB_REPOSITORY}/settings/secrets/actions"
               echo "::error::9. Click 'New repository secret'"
               echo "::error::10. Name: 'PAT_TOKEN', Value: paste your token"
               echo "::error::"
@@ -231,43 +241,22 @@ jobs:
 
       - name: Summary
         if: always()
+        env:
+          LATEST_MEGALINTER_TAG: ${{ steps.fetch-megalinter-tags.outputs.latest_tag }}
+          LATEST_REPO_TAG: ${{ steps.fetch-repo-tags.outputs.latest_repo_tag }}
+          NEW_VERSION_FOUND: ${{ steps.find-new-version.outputs.new_version_found }}
+          NEW_VERSION: ${{ steps.find-new-version.outputs.new_version }}
+          GH_REPO: ${GITHUB_REPOSITORY}
         run: |
           echo "## Check for New MegaLinter Version Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          LATEST_MEGALINTER_TAG="${{ steps.fetch-megalinter-tags.outputs.latest_tag }}"
-          LATEST_REPO_TAG="${{ steps.fetch-repo-tags.outputs.latest_repo_tag }}"
-
-          if [ "${{ steps.find-new-version.outputs.new_version_found }}" == "true" ]; then
-            echo "✅ New version found: **${{ steps.find-new-version.outputs.new_version }}**" >> $GITHUB_STEP_SUMMARY
+          if [ "${NEW_VERSION_FOUND}" == "true" ]; then
+            echo "New version found: **${NEW_VERSION}**" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "A new release has been created, which will trigger the custom flavor builder workflow." >> $GITHUB_STEP_SUMMARY
-            
-            # Check if PAT_TOKEN is configured
-            if [ -z "${{ secrets.PAT_TOKEN }}" ]; then
-              echo "" >> $GITHUB_STEP_SUMMARY
-              echo "### ⚠️ REQUIRED: Configure PAT_TOKEN" >> $GITHUB_STEP_SUMMARY
-              echo "" >> $GITHUB_STEP_SUMMARY
-              echo "**PAT_TOKEN is required to trigger the builder workflow and create releases.**" >> $GITHUB_STEP_SUMMARY
-              echo "" >> $GITHUB_STEP_SUMMARY
-              echo "Without it, releases will be automatically deleted and the workflow will fail." >> $GITHUB_STEP_SUMMARY
-              echo "" >> $GITHUB_STEP_SUMMARY
-              echo "**To create a Fine-grained Personal Access Token (recommended - more secure):**" >> $GITHUB_STEP_SUMMARY
-              echo "1. Go to [GitHub Settings > Personal access tokens > Fine-grained tokens](https://github.com/settings/personal-access-tokens/new)" >> $GITHUB_STEP_SUMMARY
-              echo "2. Token name: \`MegaLinter Auto-Release\`" >> $GITHUB_STEP_SUMMARY
-              echo "3. Expiration: Choose 90 days or 1 year" >> $GITHUB_STEP_SUMMARY
-              echo "4. Repository access: **Only select repositories**" >> $GITHUB_STEP_SUMMARY
-              echo "5. Choose repository: \`${{ github.repository }}\`" >> $GITHUB_STEP_SUMMARY
-              echo "6. Repository permissions:" >> $GITHUB_STEP_SUMMARY
-              echo "   - **Contents**: Read and write" >> $GITHUB_STEP_SUMMARY
-              echo "   - **Actions**: Read and write" >> $GITHUB_STEP_SUMMARY
-              echo "7. Click **Generate token** and copy it" >> $GITHUB_STEP_SUMMARY
-              echo "8. Go to [Repository Settings > Secrets](https://github.com/${{ github.repository }}/settings/secrets/actions)" >> $GITHUB_STEP_SUMMARY
-              echo "9. Click **New repository secret**" >> $GITHUB_STEP_SUMMARY
-              echo "10. Name: \`PAT_TOKEN\`, Value: paste your token" >> $GITHUB_STEP_SUMMARY
-            fi
           else
-            echo "ℹ️ No new versions found. Repository is up to date with MegaLinter." >> $GITHUB_STEP_SUMMARY
+            echo "No new versions found. Repository is up to date with MegaLinter." >> $GITHUB_STEP_SUMMARY
           fi
 
           echo "" >> $GITHUB_STEP_SUMMARY

package/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml

@@ -45,6 +45,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build-custom-flavor:
     name: Build Custom MegaLinter Flavor
@@ -61,12 +63,17 @@ jobs:
 
       - name: Determine MegaLinter Version Tag
         id: determine-tag
+        env:
+          INPUT_MEGALINTER_VERSION: ${{ inputs.megalinter-version }}
+          INPUT_IS_LATEST: ${{ inputs.is-latest }}
+          EVENT_NAME: ${{ github.event_name }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          if [ -n "${{ inputs.megalinter-version }}" ]; then
-            TAG="${{ inputs.megalinter-version }}"
+          if [ -n "${INPUT_MEGALINTER_VERSION}" ]; then
+            TAG="${INPUT_MEGALINTER_VERSION}"
             echo "Using workflow input version: $TAG"
-          elif [ "${{ github.event_name }}" == "release" ]; then
-            TAG="${{ github.event.release.tag_name }}"
+          elif [ "${EVENT_NAME}" == "release" ]; then
+            TAG="${RELEASE_TAG}"
             echo "Using release tag: $TAG"
           else
             TAG="beta"
@@ -75,10 +82,10 @@ jobs:
           echo "tag=$TAG" >> $GITHUB_OUTPUT
 
           # Determine is-latest flag
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            IS_LATEST="${{ inputs.is-latest }}"
+          if [ "${EVENT_NAME}" == "workflow_dispatch" ]; then
+            IS_LATEST="${INPUT_IS_LATEST}"
             echo "Using workflow input is-latest: $IS_LATEST"
-          elif [ "${{ github.event_name }}" == "release" ]; then
+          elif [ "${EVENT_NAME}" == "release" ]; then
             IS_LATEST="true"
             echo "Release event - is-latest: true"
           else
@@ -103,6 +110,10 @@ jobs:
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
         continue-on-error: true
 
+      - name: Set Lowercase Repository Name
+        id: lowercase-repo
+        run: echo "repo=$(echo "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+
       - name: Build MegaLinter Custom Flavor
         uses: oxsecurity/megalinter/flavors/custom-builder@main
         with:
@@ -114,6 +125,6 @@ jobs:
           dockerhub-repo: ${{ vars.DOCKERHUB_REPO }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CUSTOM_FLAVOR_BUILD_REPO: ${{ github.repository }}
+          CUSTOM_FLAVOR_BUILD_REPO: ${{ steps.lowercase-repo.outputs.repo }}
           CUSTOM_FLAVOR_BUILD_REPO_URL: ${{ github.repositoryUrl }}
           CUSTOM_FLAVOR_BUILD_USER: ${{ github.actor }}

package/lib/cli.js

@@ -1,4 +1,3 @@
-#! /usr/bin/env node
 import { MegaLinterRunner } from "./runner.js";
 import {optionsDefinition} from "./options.js";
 

package/lib/env-parser.js

@@ -0,0 +1,28 @@
+const ENV_KEY_VALUE_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+
+// Expand a list of -e values, splitting the legacy comma-separated KEY=VAL,KEY=VAL form
+// into multiple entries while preserving values that simply contain a comma
+// (e.g. ENABLE_LINTERS=YAML_PRETTIER,YAML_YAMLLINT).
+//
+// Heuristic: split on `,` only when every comma-separated part looks like KEY=...
+// Otherwise the comma belongs to the value of a single env var.
+export function expandEnvEntries(envList) {
+  if (!Array.isArray(envList)) {
+    return envList;
+  }
+  const result = [];
+  for (const entry of envList) {
+    if (typeof entry !== "string" || !entry.includes(",")) {
+      result.push(entry);
+      continue;
+    }
+    const parts = entry.split(",");
+    const allLookLikeKv = parts.every((p) => ENV_KEY_VALUE_RE.test(p));
+    if (allLookLikeKv && parts.length > 1) {
+      result.push(...parts);
+    } else {
+      result.push(entry);
+    }
+  }
+  return result;
+}

package/lib/list-vars.js

@@ -0,0 +1,100 @@
+import { default as fs } from "fs-extra";
+import * as path from "path";
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+
+const VARS_FILE = path.join(
+  dirname(fileURLToPath(import.meta.url)),
+  "megalinter-vars.json",
+);
+
+function loadVars() {
+  if (!fs.existsSync(VARS_FILE)) {
+    throw new Error(
+      `Bundled variables file not found at ${VARS_FILE}. Re-run \`make megalinter-build\` to regenerate it.`,
+    );
+  }
+  return fs.readJsonSync(VARS_FILE);
+}
+
+function matches(variable, pattern) {
+  if (!pattern) return true;
+  const p = pattern.toLowerCase();
+  return (
+    variable.name.toLowerCase().includes(p) ||
+    (variable.category || "").toLowerCase().includes(p) ||
+    (variable.section || "").toLowerCase().includes(p) ||
+    (variable.title || "").toLowerCase().includes(p)
+  );
+}
+
+function formatType(variable) {
+  const t = variable.type;
+  if (Array.isArray(t)) return t.join(" | ");
+  return t || "string";
+}
+
+function renderHuman(variables, pattern, meta) {
+  const lines = [];
+  if (pattern) {
+    lines.push(
+      `MegaLinter variables matching "${pattern}" (${variables.length}/${meta.variable_count}):`,
+    );
+  } else {
+    lines.push(`MegaLinter variables (${variables.length} total):`);
+  }
+  lines.push("");
+  for (const v of variables) {
+    lines.push(`  ${v.name}  [${formatType(v)}]  (${v.category || "GENERAL"})`);
+    if (v.title) {
+      lines.push(`    ${v.title}`);
+    }
+    if (v.description && v.description !== v.title) {
+      lines.push(`    ${v.description}`);
+    }
+    if (v.default !== undefined) {
+      lines.push(`    default: ${JSON.stringify(v.default)}`);
+    }
+    if (Array.isArray(v.enum) && v.enum.length > 0) {
+      lines.push(`    allowed: ${v.enum.join(", ")}`);
+    }
+    if (Array.isArray(v.items_enum) && v.items_enum.length > 0) {
+      const preview = v.items_enum.slice(0, 6).join(", ");
+      const suffix =
+        v.items_enum.length > 6
+          ? `, … (${v.items_enum.length} values)`
+          : "";
+      lines.push(`    item values: ${preview}${suffix}`);
+    }
+    if (Array.isArray(v.examples) && v.examples.length > 0) {
+      lines.push(`    examples: ${v.examples.map((e) => JSON.stringify(e)).join(", ")}`);
+    }
+    lines.push("");
+  }
+  lines.push(`Reference: ${meta.doc_url}`);
+  lines.push(
+    pattern
+      ? "Pass variables with: mega-linter-runner -e KEY=VALUE"
+      : "Filter results: mega-linter-runner --list-vars <pattern>",
+  );
+  return lines.join("\n");
+}
+
+export function listVars({ pattern, asJson } = {}) {
+  const data = loadVars();
+  const all = Object.values(data.variables);
+  const filtered = all.filter((v) => matches(v, pattern));
+  if (asJson) {
+    return {
+      stdout: JSON.stringify(
+        {
+          _meta: { ...data._meta, pattern: pattern || null, returned: filtered.length },
+          variables: filtered,
+        },
+        null,
+        2,
+      ),
+    };
+  }
+  return { stdout: renderHuman(filtered, pattern, data._meta) };
+}