From the 2026-07-24 Analyze run. Done — see PR #3833 (adds .mega-linter.yml + .jscpd.json). This issue documents the reasoning and the full list of occurrences that drove it.

.github/workflows/*.lock.yml — compiled, not hand-written

autoapprove.lock.yml, autofix.lock.yml, autotriage.lock.yml, monitor_changelog.lock.yml. Each has a matching .md source file that's 20-50x smaller (e.g. autoapprove.md is 3.9KB, autoapprove.lock.yml is 108KB) and there's a dedicated recompile_agentic_workflows.yml workflow — these are gh-aw CLI output, not source of truth. Concretely, they accounted for:

• 48% of all yamllint findings (114 of 236 — document-start, truthy, indentation, trailing-spaces, empty-lines, comments-indentation all hit on all 4 files)
• 6 of actionlint's 7 syntax-check findings (unexpected key "queue" for concurrency — gh-aw emits a key actionlint's schema doesn't recognize)
• a few of the embedded-shellcheck findings on autoapprove.lock.yml

demos/**/otlp.json — captured OTel export output, not single-document JSON

These are multiple concatenated OTLP JSON export payloads per file (captured during demo runs, refreshed by refresh_demos.yml), not one JSON document — which is why both jsonlint and prettier failed on all 8 of them with the same root cause: SyntaxError: input should contain exactly one expression ... unexpected character '{'. Affected: demos/_complex_download_github_releases/otlp.json, demos/context_propagation_http_curl/otlp.json, demos/context_propagation_http_wget/otlp.json, demos/injection_child/otlp.json, demos/injection_deep_gradle/otlp.json, demos/injection_deep_java/otlp.json, demos/injection_deep_python/otlp.json, demos/injection_docker_renovate/otlp.json, demos/injection_inner_xargs_parallel/otlp.json, demos/observe_subprocesses/otlp.json.

These same files also accounted for 139 of lychee's 187 "broken link" errors (demos/injection_docker_renovate/otlp.json alone contributed 139 of the ~187, e.g. 136× https://api.github.com/graphql returning 403 because it's an authenticated endpoint, plus expired SAS-signed release-assets.githubusercontent.com/ghcr.io/index.docker.io URLs) — the URLs are recorded HTTP-call attribute values from the demo run, not documentation links for a reader to click.

**/gradlew — vendored Gradle wrapper

demos/injection_deep_gradle/gradlew is standard Gradle wrapper boilerplate; it showed up in shfmt's 99-file formatting list purely because it's shell-shaped, not because anyone's meant to hand-format it.

**/package-lock.json — npm lockfile

Contributed one lychee false positive: https://www.patreon.com/feross (403 Forbidden, most likely bot-blocking rather than a dead link) inside actions/instrument/job/package-lock.json — a generated file regardless of whether that specific link is actually alive.

Implementation

Global FILTER_REGEX_EXCLUDE in .mega-linter.yml covers all of the above for every list_of_files/file-mode linter (confirmed this applies to jsonlint, prettier, v8r, yamllint, actionlint, shfmt, cspell, lychee, markdownlint — all run in that mode per the log's summary table). jscpd runs in project mode, which MegaLinter's filter variables explicitly don't reach, so the same patterns were added separately to .jscpd.json's own ignore list.