Run the Markdown Linter on markdownlint-cli2 instead of Super Linter - #10640
Open
Jakub Jareš (nohwnd) wants to merge 2 commits into
Open
Run the Markdown Linter on markdownlint-cli2 instead of Super Linter#10640Jakub Jareš (nohwnd) wants to merge 2 commits into
Jakub Jareš (nohwnd) wants to merge 2 commits into
Conversation
The Markdown Linter workflow has never run. All 63 runs since 2026-05-22 ended in
startup_failure, because it is the only workflow in the repository that references an
action outside actions/* and github/*, and this repository restricts Actions to a
selected list:
patterns_allowed: dotnet/arcade/.github/workflows/*,
peter-evans/create-pull-request@*,
DavidAnson/markdownlint-cli2-action@*
verified_allowed: false
super-linter/super-linter is not on that list, so the run was rejected before any job
started. This is the same failure that took out the markdownlint gate in #10636.
Swap Super Linter for markdownlint-cli2, pinned to 0.23.1, the version bundled by
DavidAnson/markdownlint-cli2-action@v24.1.0 that markdownlint.yml already runs on every
pull request. The scheduled report and the pull request gate now apply the same rules
from .markdownlint-cli2.jsonc, including its ignores, so the report cannot flag anything
the gate would let through.
Two more bugs fixed along the way:
- The lint step no longer fails the job when it finds violations. Super Linter failed the
job, which skipped the agent that was supposed to write the report, so the workflow
could not have reported violations even if it had started.
- Super Linter ran with VALIDATE_ALL_CODEBASE=false, which lints only files that differ
from the default branch. On a scheduled run on main that is nothing. markdownlint-cli2
scans all 86 tracked Markdown files.
Also drop the now-unused packages: read and statuses: write permissions, and the dead
check-results step whose output no job consumed.
The workflow keeps no source: field. It came from
githubnext/agentics/workflows/markdown-linter.md@main, and relinking it would let
gh aw update restore the blocked action and break the workflow again.
Compiled with gh aw v0.86.0 using --action-mode release --action-tag 435186c5, matching
the pins in the other lock files; .github/scripts/check_action_pins.py passes.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Replaces the blocked Super Linter job with markdownlint-cli2 for scheduled Markdown reporting.
Changes:
- Aligns scheduled linting with the pull-request Markdown gate.
- Preserves lint logs while reducing permissions.
- Regenerates the compiled agentic workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/markdown-linter.md |
Defines the new markdownlint-cli2 workflow. |
.github/workflows/markdown-linter.lock.yml |
Compiles the updated workflow definition. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The step swallowed every exit code, so an npm or configuration failure looked the same as a clean run: the log held a stack trace instead of lint results, and the agent went on to report "no issues" over a run that never linted. markdownlint-cli2 exits 0 clean, 1 with violations, and 2 when it fails to run. Keep 0 and 1 green, because violations are what the agent reports on, and fail the job for anything above that. Also update the workflow catalog entry, which still described this workflow as running Super Linter. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Markdown Linterworkflow has never run. All 63 runs since 2026-05-22 ended instartup_failure, so it produced zero reports.Super Linter is not on this repository's Actions allow-list, so the run was rejected before any job started. Same failure as the markdownlint gate, fixed in #10636. A startup failure has no annotation and no job log, which is why nobody noticed for three months.
Changes
Replace Super Linter with
markdownlint-cli2, pinned to0.23.1, the versionmarkdownlint.ymlalready runs on every PR. Both now read.markdownlint-cli2.jsonc, so the scheduled report cannot flag anything the gate allows. Bump them together.Two more bugs, found while rewriting:
agentjob that writes the report. Even if the workflow had started, only a clean run could have produced output.VALIDATE_ALL_CODEBASE=false, which lints only files differing from the default branch. On a scheduled run onmainthat is nothing.markdownlint-cli2scans all 86 tracked files.Violations keep the job green, since that is what the agent reports on, but only exit 0 and 1 do.
markdownlint-cli2exits 2 when it cannot run at all, and the log then holds a stack trace instead of results. Anything above 1 fails the step, so the agent cannot report "no issues" over a run that never linted.Also drop the unused
packages: readandstatuses: write, and the deadcheck-resultsstep. Update the workflow table in.github/workflows/README.md, which still said Super Linter.No
source:field, deliberately. It came fromgithubnext/agentics, and relinking would letgh aw updaterestore the blocked action. There is a comment in the frontmatter saying so.Security review
Required by the gh-aw safe-update warning.
super-linter/super-linter@4ce20838(v8.7.0). Removal only.actions/checkoutandactions/upload-artifactmove within the file at their existing pins.npx --yes markdownlint-cli2@0.23.1from the npm registry.Verification
check_action_pins.pypasses, 2273 references across 49 files.gh aw v0.86.0,--action-mode release --action-tag 435186c5. Plaingh aw compilerewrites the setup pins to a different repository, Localgh aw compilesilently corrupts two pinned actions in generated.lock.ymlfiles #10258 again. The lock diff has no unintendeduses:change.noop.bash -ewith the linter stubbed: 0 and 1 pass, 2 and 127 fail.One thing worth deciding separately:
markdownlint.ymlgates every PR, somainshould always be clean and this report will usually have nothing to say. If that holds for a few weeks, deleting it is reasonable. Did not want to make that call inside a fix.🤖