Bump oxsecurity/megalinter from 9.6.0 to 10.1.0

[dependabot]

Bumps oxsecurity/megalinter from 9.6.0 to 10.1.0.

Release notes

Sourced from oxsecurity/megalinter's releases.

v10.1.0

What's Changed

• Core

  • MegaLinter now prints a crash traceback when it is killed by a fatal signal (SIGSEGV, SIGBUS…), instead of exiting silently with no clue about what happened (#8779)
  • The LLM Advisor supports a new provider, OrcaRouter, an OpenAI-compatible AI gateway: set LLM_PROVIDER: orcarouter and ORCAROUTER_API_KEY in your environment to get fix suggestions routed through OrcaRouter (see the OrcaRouter provider page) (#8826)

• New linters

  • biome, one fast toolchain linting, formatting and sorting imports of JavaScript, TypeScript, JSX, TSX, JSON, CSS and GraphQL files, available as JAVASCRIPT_BIOME, TYPESCRIPT_BIOME, JSX_BIOME, TSX_BIOME, JSON_BIOME, CSS_BIOME and GRAPHQL_BIOME (#8706)
    • Activated only when a biome.json or biome.jsonc configuration file is found in the repository
    • Supports APPLY_FIXES (safe fixes with --write) and native SARIF output
    • EXCLUDED_DIRECTORIES are forwarded in project lint mode through a generated configuration extending the workspace one
  • ApexGuru, the AI-driven engine of Salesforce Code Analyzer, available as SALESFORCE_CODE_ANALYZER_APEXGURU (#8820)
    • Detects SOQL inefficiencies, critical anti-patterns and scalability hotspots in your .cls and .trigger files, with line-level highlights, severity ratings and suggested fixes
    • The analysis runs in a connected Salesforce org, not locally: store the auth url of the target org in a CI secret named SFDX_AUTH_URL, and MegaLinter logs in to that org before the scan
    • The scan is sent to that org explicitly, so a .sfdx/sfdx-config.json left at the root of the repository, usually naming a long gone scratch org, can not hijack it
    • Inactive by default: it activates only when SFDX_AUTH_URL is defined, so nothing changes for existing Salesforce projects
    • Requires ApexGuru to be enabled on the org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers
    • A run where the engine could not analyze anything is reported as an error rather than a silent success, together with the reason and how to fix it
    • Supports native SARIF output, like the other Code Analyzer engines
  • tofu fmt, the built-in formatter of OpenTofu (the MPL-2.0 licensed fork of Terraform), available as TERRAFORM_TOFU_FMT (#8729)
    • Analyzes .tofu files only, the OpenTofu specific extension, so it never doubles up with TERRAFORM_TERRAFORM_FMT which keeps .tf
    • To format your .tf files with OpenTofu instead, set TERRAFORM_TOFU_FMT_FILE_EXTENSIONS: [".tofu", ".tf", ".tfvars"] and DISABLE_LINTERS: [TERRAFORM_TERRAFORM_FMT]
    • Supports APPLY_FIXES to rewrite files in the canonical OpenTofu style
  • tofu validate, the built-in validator of OpenTofu, available as TERRAFORM_TOFU_VALIDATE (#8793)
    • Reports what formatters and rule-based linters can not see: unsupported or missing arguments, wrong attribute types, references to undeclared variables, locals or outputs, and broken module input contracts
    • Analyzes .tofu files only, like TERRAFORM_TOFU_FMT, leaving .tf free for a future terraform validate linter. To validate .tf files, set TERRAFORM_TOFU_VALIDATE_FILE_EXTENSIONS: [".tofu", ".tf"]
    • Validates one whole module per directory, so every .tf and .tofu file of a selected directory is parsed and can produce diagnostics
    • Every directory is initialized with tofu init -backend=false beforehand, so no state is read, no state lock is taken and no cloud credentials are needed
    • Set TERRAFORM_TOFU_VALIDATE_INIT_ARGUMENTS to change those initialization arguments, for example adding -lockfile=readonly to have an out-of-sync .terraform.lock.hcl reported as an error instead of being updated

• Disabled linters

  • COFFEE_COFFEELINT is disabled: CoffeeScript tooling is discontinued, and coffeelint can not receive EXCLUDED_DIRECTORIES in project lint mode (it has no exclusion option and reads .coffeelintignore only from its working directory). The linter will be removed in a future version (#8720)
  • GRAPHQL_GRAPHQL_SCHEMA_LINTER is disabled: graphql-schema-linter is unmaintained, with no release or commit since May 2022, and its peer dependency range pins graphql to ^15 || ^16, which held the whole GraphQL install back from graphql v17. Use GRAPHQL_BIOME to lint your GraphQL files. The linter will be removed in a future version (#8894)

• Re-enabled linters

  • spectral is back as API_SPECTRAL, together with the API descriptor, to lint your OpenAPI, AsyncAPI and Arazzo specifications (#8717)
    • It was removed in v10.0.0 because it crashed at startup on every run: the cause has been found and fixed
    • Nothing to change in your configuration: API_SPECTRAL works again in ENABLE_LINTERS / DISABLE_LINTERS, and the default ruleset file is still .spectral.yaml

• Linters enhancements

  • TERRAFORM_TFLINT now documents the tflint native GITHUB_TOKEN_github_com variable to authenticate plugin downloads on github.com, which is the recommended way to fix tflint --init failures when your GITHUB_TOKEN targets a GitHub Enterprise instance (#8795)
    • Set your github.com token in GITHUB_TOKEN_github_com, then list it in TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES: tflint gives it priority over GITHUB_TOKEN, which other linters and reporters keep using
    • PAT_GITHUB_COM is deprecated: it still works and now logs a warning, and will be removed in a future major release
  • CLOJURE_CLJSTYLE now forwards EXCLUDED_DIRECTORIES through its native repeatable --ignore argument, instead of a temporary .cljstyle written in your repository. Exclusions are now also applied when your repository already has a .cljstyle config, whose own ignore patterns are preserved (#8720)
  • SQL_SQLFLUFF does not receive EXCLUDED_DIRECTORIES in project lint mode anymore: sqlfluff reads path exclusions only from a .sqlfluffignore, .sqlfluff or pyproject.toml located inside the analyzed sources, where MegaLinter used to write a temporary file. List the directories to skip in your own .sqlfluffignore, or keep the default list_of_files lint mode where MegaLinter filters the files itself (#8720)
  • SARIF output is now available for 13 more linters: zizmor, bicep_linter, cppcheck, clj-kondo, roslynator, htmlhint, protolint, sqlfluff, swiftlint, osv-scanner, trufflehog, jscpd and lintr. Enable it the same way as any other SARIF-capable linter, with SARIF_REPORTER: true (optionally scoped with SARIF_REPORTER_LINTERS) (#8715)
    • The 4 Salesforce Code Analyzer engines (SALESFORCE_CODE_ANALYZER_APEX, _AURA, _LWC, _FLOW) also gained SARIF output: their report switches from CSV to SARIF automatically when SARIF reporting is requested
    • csharp_roslynator is bumped from 0.12.0 to 0.13.0, the first release including its SARIF output support

... (truncated)

Changelog

Sourced from oxsecurity/megalinter's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased] (beta, main branch content)

Note: Can be used with oxsecurity/megalinter@beta in your GitHub Action mega-linter.yml file, or with oxsecurity/megalinter:beta docker image

• Breaking changes

• Core

• New linters

• Disabled linters

• Re-enabled linters

• Deprecated linters

• Removed linters

• Media

• Linters enhancements

  • CLOJURE_CLJ_KONDO now lints all your Clojure files in a single clj-kondo run, with the new default list_of_files lint mode
    • Cross-namespace checks, such as calls with a wrong number of arguments to a function defined in another file, are now reported without a clj-kondo cache
    • The console log and reports now show clj-kondo's warnings count, and its errors count when errors are found, instead of a single error for any failing run
    • clj-kondo now runs with --cache false: it no longer writes into your repository's .clj-kondo/.cache folder during the run, and no longer reads a cache built beforehand. To use such a cache, for example one built with --dependencies, set CLOJURE_CLJ_KONDO_COMMAND_REMOVE_ARGUMENTS: ["--cache", "false"]
    • To lint each file separately as before, set CLOJURE_CLJ_KONDO_CLI_LINT_MODE: file

• Fixes

  • CLOJURE_CLJ_KONDO now really forwards EXCLUDED_DIRECTORIES and ADDITIONAL_EXCLUDED_DIRECTORIES in project lint mode: they were never applied before, so files in folders like node_modules or .wireit could be reported
    • The directories are passed as a merged :output {:exclude-files [...]} inline configuration, so your own :output :exclude-files patterns in .clj-kondo/config.edn are kept
    • Disable the forwarding with CLOJURE_CLJ_KONDO_FORWARD_EXCLUDED_DIRECTORIES: false

• Reporters

• Flavors

• Doc

• mega-linter-runner

  • --container-engine container: run MegaLinter with Apple's native macOS container engine (Apple Silicon only, no Docker Desktop needed): https://github.com/apple/container

• Agent Skills

  • megalinter-fix now explains how to fix clj-kondo :type-mismatch and :constant-condition findings, and the difference between the top-level :exclude-files and :output :exclude-files clj-kondo settings

... (truncated)

Commits

• 9949bad Release MegaLinter v10.1.0
• 4270990 fix release workflow
• 4d8bf14 [automation] Auto-update linters version, help and documentation (#8902)
• 98bcce2 fix(ci): install zensical in the auto-update linters container (#8901)
• b63dee7 fix(deps): update langchain (minor) (#8878)
• 4d17aee fix(renovate-rebase): force UTF-8 console output in tick_dashboard (#8900)
• b034be4 Disable the unmaintained graphql-schema-linter (#8894)
• e00d096 chore(deps): update dependency snakemake to v9.26.1 (#8897)
• 9591933 chore(deps): update dependency langsmith to v0.11.2 (#8896)
• e87989e chore(deps): update dependency golangci/golangci-lint to v2.13.2 (#8895)
• Additional commits viewable in compare view

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
⚠️ COPYPASTE	jscpd	yes		3		no	0.91s
⚠️ MARKDOWN	markdownlint	1	1	3		0	1.22s
✅ MARKDOWN	markdown-table-formatter	1	1	0		0	0.21s
❌ POWERSHELL	powershell	7		1		0	15.74s
✅ POWERSHELL	powershell_formatter	7		0		0	8.48s
✅ REPOSITORY	betterleaks	yes		no		no	0.8s
⚠️ REPOSITORY	checkov	yes		4		no	23.86s
⚠️ REPOSITORY	devskim	yes		1		8	3.24s
✅ REPOSITORY	dustilock	yes		no		no	0.01s
✅ REPOSITORY	git_diff	yes		no		no	0.03s
✅ REPOSITORY	grype	yes		no		no	99.12s
✅ REPOSITORY	kingfisher	yes		no		no	8.26s
✅ REPOSITORY	secretlint	yes		no		no	1.4s
✅ REPOSITORY	syft	yes		no		no	2.79s
✅ REPOSITORY	trivy	yes		no		no	12.36s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.27s
✅ REPOSITORY	trufflehog	yes		no	2	no	4.96s
⚠️ SPELL	cspell	10		62		0	7.95s
✅ SPELL	lychee	1		0		0	2.06s
✅ XML	xmllint	1	0	0		0	0.1s

Detailed Issues

❌ POWERSHELL / powershell - 1 error

Linter output file not found

⚠️ REPOSITORY / checkov - 4 errors

Linter output file not found

⚠️ SPELL / cspell - 62 errors

Linter output file not found

⚠️ REPOSITORY / devskim - 1 error

Linter output file not found

⚠️ COPYPASTE / jscpd - 3 errors

Linter output file not found

⚠️ MARKDOWN / markdownlint - 3 errors

Linter output file not found

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

Show us your support by starring ⭐ the repository