Skip to content

Update oxsecurity/megalinter action to v9 #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update oxsecurity/megalinter action to v9 #15

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 20, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
oxsecurity/megalinter action major v7 -> v9

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

oxsecurity/megalinter (oxsecurity/megalinter)

v9

Compare Source

  • New linters

  • Linters enhancements

    • Python Linting: Added more file type supports for various linters. Full description here

  • Doc

    • Add OLLAMA_BASE_URL is MegaLinter config Json schema

  • Flavors

    • Custom flavors: Add workflow to automate detection of new MegaLinter versions and generation of new Custom Flavor

  • CI

    • Fix v9 release issue + mark hardcoded versions to upgrade at each new major release.

  • Linter versions upgrades (22)

v8

Compare Source

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from nsheaps as a code owner September 20, 2025 12:54
@github-actions GitHub Actions
Copy link

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
❌ ACTION actionlint 1 1 0 0.23s
✅ EDITORCONFIG editorconfig-checker 1 0 0 0.21s
✅ REPOSITORY gitleaks yes no no 0.08s
✅ REPOSITORY git_diff yes no no 0.22s
✅ REPOSITORY grype yes no no 24.7s
❌ REPOSITORY kics yes 4 no 1.38s
✅ REPOSITORY secretlint yes no no 0.43s
✅ REPOSITORY syft yes no no 1.03s
✅ REPOSITORY trivy yes no no 4.73s
✅ REPOSITORY trivy-sbom yes no no 0.1s
✅ REPOSITORY trufflehog yes no no 2.16s
✅ YAML prettier 1 0 0 0 0.35s
✅ YAML v8r 1 0 0 1.65s
✅ YAML yamllint 1 0 0 0.28s

Detailed Issues

❌ ACTION / actionlint - 1 error 
.github/workflows/lint.yaml:57:15: the runner of "peter-evans/create-pull-request@v5" action is too old to run on GitHub Actions. update the action's version to fix this issue [action]
   |
57 |         uses: peter-evans/create-pull-request@v5
   |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❌ REPOSITORY / kics - 4 errors 
MLLLLLM             MLLLLLLLLL   LLLLLLL             KLLLLLLLLLLLLLLLL       LLLLLLLLLLLLLLLLLLLLLLL 
   MMMMMMM           MMMMMMMMMML    MMMMMMMK       LMMMMMMMMMMMMMMMMMMMML   KLMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM         MMMMMMMMML       MMMMMMMK     LMMMMMMMMMMMMMMMMMMMMMML  LMMMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM      MMMMMMMMMML         MMMMMMMK   LMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM    LMMMMMMMMML           MMMMMMMK  LMMMMMMMMMLLMLLLLLLLLLLLLLL LMMMMMMMLLLLLLLLLLLLLLLLLLLLM 
   MMMMMMM  MMMMMMMMMLM             MMMMMMMK LMMMMMMMM                    LMMMMMML                      
   MMMMMMMLMMMMMMMML                MMMMMMMK MMMMMMML                     LMMMMMMMMLLLLLLLLLLLLLMLL     
   MMMMMMMMMMMMMMMM                 MMMMMMMK MMMMMML                       LMMMMMMMMMMMMMMMMMMMMMMMMML  
   MMMMMMMMMMMMMMMMMM               MMMMMMMK MMMMMMM                         LMMMMMMMMMMMMMMMMMMMMMMMML 
   MMMMMMM KLMMMMMMMMML             MMMMMMMK LMMMMMMM                                          MMMMMMMML
   MMMMMMM    LMMMMMMMMMM           MMMMMMMK LMMMMMMMMLL                                        MMMMMMML
   MMMMMMM      LMMMMMMMMMLL        MMMMMMMK  LMMMMMMMMMMMMMMMMMMMMMMMMML LLLLLLLLLLLLLLLLLLLLMMMMMMMMMM
   MMMMMMM        MMMMMMMMMMML      MMMMMMMK   MMMMMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMMMM 
   MMMMMMM          LLMMMMMMMMML    MMMMMMMK     LLMMMMMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMMMML  
   MMMMMMM             MMMMMMMMMML  MMMMMMMK         KLMMMMMMMMMMMMMMMMML LMMMMMMMMMMMMMMMMMMMMMMMLK    
                                                                                                            
                                                                                                                                                                                                                                                                                                                        


Scanning with Keeping Infrastructure as Code Secure v2.1.13





Unpinned Actions Full Length Commit SHA, Severity: LOW, Results: 4
Description: Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
Platform: CICD
CWE: 829
Learn more about this vulnerability: https://docs.kics.io/latest/queries/cicd-queries/555ab8f9-2001-455e-a077-f2d0f41e2fb9

	[1]: .github/workflows/lint.yaml:45

		044:         # More info at https://megalinter.io/flavors/
		045:         uses: oxsecurity/megalinter/flavors/cupcake@v9
		046:         env:


	[2]: .github/workflows/lint.yaml:57

		056:         if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_n
		057:         uses: peter-evans/create-pull-request@v5
		058:         with:


	[3]: .github/workflows/lint.yaml:87

		086:         if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.
		087:         uses: stefanzweifel/git-auto-commit-action@v5
		088:         with:


	[4]: .github/workflows/update-formulae.yaml:42

		041:       - name: Update Homebrew formula
		042:         uses: nsheaps/action-homebrew-bump-formula@master
		043:         with:



Results Summary:
CRITICAL: 0
HIGH: 0
MEDIUM: 0
LOW: 4
INFO: 0
TOTAL: 4

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nsheaps nsheaps Awaiting requested review from nsheaps nsheaps is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants