dotfiles/.mega-linter.yml at main · ulises-jeremias/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# Configuration file for MegaLinter
#
# See all available variables at https://megalinter.io/latest/config-file/ and in
# linters documentation

# all, none, or list of linter keys
APPLY_FIXES: all

# If you use ENABLE variable, all other languages/formats/tooling-formats will
# be disabled by default
# ENABLE:

# If you use ENABLE_LINTERS variable, all other linters will be disabled by
# default
# ENABLE_LINTERS:

# DISABLE:
# - COPYPASTE # Uncomment to disable checks of excessive copy-pastes
# - SPELL # Uncomment to disable checks of spelling mistakes

SHOW_ELAPSED_TIME: true

FILEIO_REPORTER: false
FLAVOR_SUGGESTIONS: false

DISABLE:
  - COPYPASTE
  - CPP
  - JAVASCRIPT
  - PYTHON
  - SPELL

DISABLE_LINTERS:
  - REPOSITORY_GITLEAKS
  - REPOSITORY_KICS
  # DevSkim flags "Accessing localhost" (DS162092) as a hygiene finding.
  # The E2E harness connects to localhost/127.0.0.1 by design (SSH port
  # forward into the test VM), so every report is a false positive.
  - REPOSITORY_DEVSKIM
  # osv-scanner scans dependency manifests (package.json, Cargo.toml, etc.).
  # This repo has none, so the scanner exits with "No package sources found"
  # and fails the run on every commit. Nothing for it to do here.
  - REPOSITORY_OSV_SCANNER
  # zizmor's unpinned-uses audit requires every action ref to be a SHA hash.
  # Standard upstream actions (actions/checkout@v4, etc.) are used here and
  # pinning 59+ refs across all workflows is impractical for a personal dotfiles
  # repo. Disable the linter rather than carry dead SHA maintenance burden.
  - ACTION_ZIZMOR
  # checkov scans IaC (Terraform, CloudFormation, Kubernetes, etc.). This repo
  # has none; it only contains shell scripts, dotfiles, and docs. Additionally,
  # MegaLinter auto-generates .megalinter_github_conf/branch_protection_rules.json
  # which contains a raw GitHub API 404 response that checkov misidentifies as a
  # broken OpenAPI spec and crashes on. No IaC to audit here.
  - REPOSITORY_CHECKOV

BASH_SHELLCHECK_ARGUMENTS: --exclude=SC2317,SC2086,SC2155,SC2030,SC2031,SC2181

BASH_EXEC_FILTER_REGEX_EXCLUDE: >-
  (^|/)(lib/.*\.sh|home/dot_local/lib/dots/.*\.sh|playground/config/\.bashrc)$

# editorconfig-checker is the style authority for first-party code only.
# Excluded: code owned upstream whose style lives elsewhere —
# quickshell/plugin/ byte-mirrors HorneroOS/shell (fix style there, never
# here), and utils/scripts/fzf.js is vendored from ajitid/fzf-for-js.
EDITORCONFIG_EDITORCONFIG_CHECKER_FILTER_REGEX_EXCLUDE: >-
  (^|/)(home/dot_config/quickshell/plugin/.*|home/dot_config/quickshell/utils/scripts/fzf\.js)$

# MegaLinter APPLY_FIXES creates temp backups of chezmoi source files it
# reformats. The backup name is .<original_name><random_number>, where the
# original file carries a chezmoi attribute prefix (executable_, private_,
# readonly_). secretlint then hits ENOENT trying to open these after they
# are already deleted. Narrow the exclusion to that exact pattern so that
# legitimate hidden files ending in digits are still scanned.
REPOSITORY_SECRETLINT_FILTER_REGEX_EXCLUDE: >-
  (^|/)\.(executable|private|readonly)_[^/]+[0-9]{10,}$

# Uncomment if you want MegaLinter to detect errors but not block CI to pass
# DISABLE_ERRORS: true