Build(deps): Bump oxsecurity/megalinter from 8 to 9 (#219)

ncalteen · web-flow · commit c25bae9cfb2b · 2025-10-03T10:37:13.000-04:00
Bumps [oxsecurity/megalinter](https://github.com/oxsecurity/megalinter) from 8 to 9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxsecurity/megalinter/releases">oxsecurity/megalinter's releases</a>.</em></p> <blockquote> <h2>v9.0.0</h2> <h2>What's Changed</h2> <ul> <li> <p>Core</p> <ul> <li>Create your own <strong>Megalinter Custom Flavors</strong> to dramatically improve your performances <ul> <li>See <a href="https://megalinter.io/beta/custom-flavors/">documentation</a> for usage</li> <li>Use <code>npx mega-linter-runner@beta --custom-flavor-setup</code> to initialize repo</li> <li>Suggest new flavors in reporters with a mega-linter-runner including the list of linters</li> </ul> </li> <li>New <strong>LLM Advisor</strong>: call external LLMs to get hints to solve linter errors, available in: <ul> <li>Console Reporter</li> <li>Text Reporter</li> <li>Git platforms PR/MR comments Reporter</li> </ul> </li> <li>Use ghcr.io docker images by default because of rate limits on docker.io</li> <li>Use uv to create the venv folder for pip-installed linters</li> <li>Add copilot instructions for GitHub Copilot</li> <li>Update base image to python:3.13-alpine3.21 (also embeds go 1.24)</li> </ul> </li> <li> <p>Disabled linters</p> <ul> <li><a href="https://megalinter.io/beta/descriptors/puppet_puppet_lint/">puppet-lint</a>: Disabled Until fix is provided for <a href="https://redirect.github.com/puppetlabs/puppet-lint/issues/251">puppetlabs/puppet-lint#251</a></li> <li><a href="https://megalinter.io/beta/descriptors/repository_checkov/">checkov</a>: Disabled until fix is provided for <a href="https://redirect.github.com/bridgecrewio/checkov/issues/7263">bridgecrewio/checkov#7263</a></li> </ul> </li> <li> <p>Removed linters</p> <ul> <li><strong>markdown-link-check</strong> has been removed because <a href="https://megalinter.io/latest/descriptors/spell_lychee/"><strong>lychee</strong></a> can be used instead, and has much better performances</li> </ul> </li> <li> <p>Linters enhancements</p> <ul> <li>PHP-CS-Fixer is able to run on PHP 8.4 without error (change default configuration) by <a href="https://github.com/llaville"><code>@​llaville</code></a></li> <li><a href="https://megalinter.io/latest/descriptors/spell_cspell/">cspell</a>: Filter output lines that do not contain found issues</li> <li><a href="https://megalinter.io/latest/descriptors/docker_hadolint/">hadolint</a>: Extend DOCKERFILE_HADOLINT_FILE_NAMES_REGEX to include the <code>purpose.Dockerfile</code> convention eg service.Dockerfile.</li> <li><a href="https://megalinter.io/beta/descriptors/sql_sqlfluff/">sqlfluff</a>: Handle fixing of issues</li> </ul> </li> <li> <p>Fixes</p> <ul> <li>When linter is docker based, force <code>--platform=linux/amd64</code> so it works when running locally on Mac</li> <li>Added checking of <code>*.pyi</code> and <code>*.ipynb</code> files to the <code>ruff</code> and <code>ruff-format</code> linters</li> </ul> </li> <li> <p>Reporters</p> <ul> <li>New default display for Pull Request comments, with expandable sections containing the first 1000 lines of the output log. Former display remains available by defining <code>REPORTERS_MARKDOWN_SUMMARY_TYPE=table</code></li> <li>Markdown summary reporter: <ul> <li>Write a file for Github integration if GITHUB_STEP_SUMMARY is set</li> <li>Truncate less linter output lines</li> </ul> </li> <li>Text reporter: Change the output file names to put the linter name first, then the status</li> <li>Enhance display of markdown summary</li> </ul> </li> <li> <p>Doc</p> <ul> <li>Update documentation in all megalinter descriptor files to improve accuracy and consistency</li> <li>Fix incorrect information in linters documentation and descriptors</li> <li>Remove dead links</li> <li>Add linter description (linter_text) in all linter descriptor, to generate a more exhaustive documentation.</li> <li>Update contributing guide to explain how to manage python dependencies in the codebase</li> </ul> </li> <li> <p>Flavors</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxsecurity/megalinter/blob/main/CHANGELOG.md">oxsecurity/megalinter's changelog</a>.</em></p> <blockquote> <h2>[v8.4.1] - 2025-01-28</h2> <ul> <li> <p>Quick fix about PRE_COMMANDS crash (see <a href="https://redirect.github.com/oxsecurity/megalinter/issues/4591">oxsecurity/megalinter#4591</a>)</p> </li> <li> <p>Linter versions upgrades (2)</p> <ul> <li><a href="https://checkstyle.org/">checkstyle</a> from 10.21.1 to <strong>10.21.2</strong></li> <li><a href="https://stylelint.io">stylelint</a> from 16.14.0 to <strong>16.14.1</strong></li> </ul> </li> </ul> <h2>[v8.4.0] - 2025-01-26</h2> <ul> <li> <p>Core</p> <ul> <li>PHP Linters use now the <code>bartlett/sarif-php-converters</code> first official release 1.0.0 to generate SARIF reports, by <a href="https://github.com/llaville"><code>@​llaville</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4357">oxsecurity/megalinter#4357</a></li> <li><a href="https://redirect.github.com/oxsecurity/megalinter/issues/4351">Upgrade PHP engine from 8.3 to 8.4</a> and allow Psalm 5.26 to run on this context (by <a href="https://github.com/llaville"><code>@​llaville</code></a>)</li> <li>Linters can specify in the pre/post commands with a <code>run_before_linters</code> / <code>run_after_linters</code> parameter whether the command is to be executed before/after the execution of the linters themselves (by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4482">#4482</a>)</li> <li>Bump python version to 3.12.8, by <a href="https://github.com/echoix"><code>@​echoix</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4372">oxsecurity/megalinter#4372</a></li> <li>Update to .NET 9, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4488">oxsecurity/megalinter#4488</a></li> <li>Upgrade PHP engine from 8.3 to 8.4, by <a href="https://github.com/llaville"><code>@​llaville</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4524">oxsecurity/megalinter#4524</a></li> </ul> </li> <li> <p>New linters</p> <ul> <li>Reactivate clj-style (Clojure formatter) since its bug is fixed, by <a href="https://github.com/nvuillam"><code>@​nvuillam</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4369">oxsecurity/megalinter#4369</a></li> <li>New python formatter: PYTHON_RUFF_FORMAT, by <a href="https://github.com/nvuillam"><code>@​nvuillam</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4329">oxsecurity/megalinter#4329</a></li> </ul> </li> <li> <p>Disabled linters</p> <ul> <li>Snakemake has been disabled, because its dependency datrie not maintained, and <a href="https://redirect.github.com/snakemake/snakemake/issues/2970">issue</a> open in snakemake repo since july is still pending</li> </ul> </li> <li> <p>Linters enhancements</p> <ul> <li>Add support to <a href="https://github.com/phpstan/extension-installer">phpstan/extension-installer</a> Composer plugin for automatic installation of PHPStan extensions, by <a href="https://github.com/llaville"><code>@​llaville</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4337">oxsecurity/megalinter#4337</a> <ul> <li>Learn more about context on <a href="https://redirect.github.com/oxsecurity/megalinter/issues/4328">GH-4328</a></li> </ul> </li> <li>Allow Terrascan to lint in file lint mode, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4498">oxsecurity/megalinter#4498</a></li> <li>Add sarif output to golangci-lint, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4557">oxsecurity/megalinter#4557</a></li> </ul> </li> <li> <p>Plugins</p> <ul> <li>Add <a href="https://github.com/liblaf/megalinter-plugins/tree/main/mega-linter-plugin-markdown-prettier">prettier for markdown</a>, by <a href="https://github.com/liblaf">Qin Li</a></li> </ul> </li> <li> <p>Fixes</p> <ul> <li><a href="https://github.com/realm/SwiftLint">swiftlint</a> Fix swiftlint error where linter is unable to find lintable files. Fixes <a href="https://redirect.github.com/oxsecurity/megalinter/issues/440">#440</a>, by <a href="https://github.com/Noraldeno"><code>@​Noraldeno</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4427">oxsecurity/megalinter#4427</a></li> <li>jscpd url fixes, by <a href="https://github.com/alexanderbazhenoff"><code>@​alexanderbazhenoff</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4352">oxsecurity/megalinter#4352</a></li> <li>Don't call get_pr_data if GitLeaks linter is not active, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4469">oxsecurity/megalinter#4469</a></li> <li>Fix linter disabled reason usage, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4466">oxsecurity/megalinter#4466</a></li> </ul> </li> <li> <p>Doc</p> <ul> <li>Add contributing docs on venv, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4479">oxsecurity/megalinter#4479</a></li> <li>Add disabled linter badge, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4477">oxsecurity/megalinter#4477</a></li> <li>Add AzureCommentReporter instructions, by <a href="https://github.com/bdovaz"><code>@​bdovaz</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4480">oxsecurity/megalinter#4480</a></li> </ul> </li> <li> <p>CI</p> <ul> <li>Fix up gitpod config and workflow to support uv 0.5.0+ by <a href="https://github.com/echoix"><code>@​echoix</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/issues/4373">#4373</a></li> <li>Use uv.lock file to build docker images, by <a href="https://github.com/echoix"><code>@​echoix</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4374">oxsecurity/megalinter#4374</a></li> <li>Update Renovate schedules for uv and sfdx-hardis, by <a href="https://github.com/echoix"><code>@​echoix</code></a> in <a href="https://redirect.github.com/oxsecurity/megalinter/pull/4568">oxsecurity/megalinter#4568</a></li> <li>Variabilize version and use renovate for updates for the following linters:</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxsecurity/megalinter/commit/0dcbedd66ea456ba2d54fd350affaa15df8a0da3"><code>0dcbedd</code></a> Release MegaLinter v9.0.1</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/9f48fcda6d925664023f5edaf8df392a3f9b58e8"><code>9f48fcd</code></a> Fix v9 release issue (<a href="https://redirect.github.com/oxsecurity/megalinter/issues/6197">#6197</a>)</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/139ebb5abb28e3785e03fe209761435529b9dc8f"><code>139ebb5</code></a> chore(deps): update dependency uvicorn to v0.36.0 (<a href="https://redirect.github.com/oxsecurity/megalinter/issues/6189">#6189</a>)</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/b23f125145a675e11eb0697eb4093d949f4b657a"><code>b23f125</code></a> [automation] Auto-update linters version, help and documentation (<a href="https://redirect.github.com/oxsecurity/megalinter/issues/6194">#6194</a>)</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/0214a3ae25048cfe1aef4a7ec1c38b06535aa3f0"><code>0214a3a</code></a> Update README with v9 announcement (<a href="https://redirect.github.com/oxsecurity/megalinter/issues/6193">#6193</a>)</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/e552e5c291b22718a17ad6008280bd73e9c86838"><code>e552e5c</code></a> chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0....</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/ecfbd883b2be3be6f96c739cd536ae34ce473c8d"><code>ecfbd88</code></a> chore(deps): update dependency sfdx-hardis to v6.5.1 (<a href="https://redirect.github.com/oxsecurity/megalinter/issues/6188">#6188</a>)</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/60af444c7ace6d7083f9de83955933260846f3db"><code>60af444</code></a> chore(deps): update dependency mega-linter-runner to v9 (<a href="https://redirect.github.com/oxsecurity/megalinter/issues/6191">#6191</a>)</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/ff177bfabd9088ff3ccaa7bc68f8ca3fd075ba5c"><code>ff177bf</code></a> Release MegaLinter v9.0.0</li> <li><a href="https://github.com/oxsecurity/megalinter/commit/a6b6815e01ccd26b0b84dd57f87bf2b9ee203336"><code>a6b6815</code></a> release changelog</li> <li>Additional commits viewable in <a href="https://github.com/oxsecurity/megalinter/compare/v8...v9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=oxsecurity/megalinter&package-manager=github_actions&previous-version=8&new-version=9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
@@ -44,4 +44,4 @@ jobs:
         env:
           DEFAULT_WORKSPACE: ${{ github.workspace }}
           GITHUB_TOKEN: ${{ github.token }}
-        uses: oxsecurity/megalinter/flavors/cupcake@v8
+        uses: oxsecurity/megalinter/flavors/cupcake@v9
