Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

MegaLinter config: exclude generated files, disable non-applicable linters, fix jscpd threshold - #3833

#3833
Open
plengauer wants to merge 1 commit into
mainplengauer/Thoth:mainfrom
chore/megalinter-config-triageplengauer/Thoth:chore/megalinter-config-triageCopy head branch name to clipboard
Open

MegaLinter config: exclude generated files, disable non-applicable linters, fix jscpd threshold#3833
plengauer wants to merge 1 commit into
mainplengauer/Thoth:mainfrom
chore/megalinter-config-triageplengauer/Thoth:chore/megalinter-config-triageCopy head branch name to clipboard

Conversation

@plengauer

Copy link
Copy Markdown
Owner

Follows a full triage of the 2026-07-24 Analyze workflow run (megalinter log analyzed conversationally, ~30k line CI log). Full writeup and per-finding detail is split across the linked issues; this PR is just the resulting config.

Adds .mega-linter.yml:

  • DISABLE_LINTERS: [BASH_EXEC, JAVASCRIPT_STANDARD] — see disable/reconfigure tracking issue
  • FILTER_REGEX_EXCLUDE for *.lock.yml, **/otlp.json, **/gradlew, package-lock.json — see generated-files issue
  • SPELL_LYCHEE_FILTER_REGEX_EXCLUDE for .github/workflows/ — template/placeholder URLs, not real links

Adds .jscpd.json: raises the copy-paste threshold from MegaLinter's own default of 0% (which fails on any repo with normal duplication) to 5%, and adds the same generated-file ignores (jscpd runs in project mode so it can't use the MegaLinter-level filters above).

Since main is protected (required status checks, PR-only), opening this as a normal PR rather than pushing directly. Merging this will change what the next Analyze run reports — worth reviewing the two files directly before merging.

…e linters, fix jscpd threshold

Follows a full triage of the 2026-07-24 Analyze workflow run. See linked
issues for the detailed reasoning behind each change.

- Exclude *.lock.yml (gh-aw compiled workflows), demos/**/otlp.json
  (captured OTel export output), **/gradlew (vendored wrapper), and
  package-lock.json (npm lockfile) from all list_of_files/file-mode linters.
- Scope lychee away from .github/workflows/ (template/placeholder URLs
  aren't real links to check).
- Disable BASH_EXEC (no script here is invoked via `./script.sh`) and
  JAVASCRIPT_STANDARD (codebase uses semicolons; standard's core style
  clashes with nearly every line).
- Set jscpd threshold to 5% via .jscpd.json (MegaLinter's own default is 0%,
  which fails on any repo with normal levels of duplication).

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds repository-level MegaLinter and jscpd configuration to reduce noise from generated/vendored artifacts, disable non-applicable linters, and set a more practical duplication threshold.

Changes:

  • Add .mega-linter.yml to disable selected linters and exclude generated/captured files from linting.
  • Add .jscpd.json to set a 5% duplication threshold and ignore the same generated/captured files for copy/paste detection.
  • Exclude .github/workflows/ from Lychee checks to avoid false positives from template/placeholder URLs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
.mega-linter.yml Configures MegaLinter with disabled linters and regex-based excludes (including Lychee-specific excludes).
.jscpd.json Configures jscpd threshold/reporters and ignore globs for generated/vendored files.

Comment thread .mega-linter.yml
Comment thread .mega-linter.yml
Comment thread .mega-linter.yml
@github-actions

Copy link
Copy Markdown

MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
❌ COPYPASTE jscpd yes 811 no 6.31s
✅ JSON jsonlint 1 0 0 0.16s
✅ JSON prettier 1 0 0 0.25s
✅ JSON v8r 1 0 0 1.94s
✅ REPOSITORY betterleaks yes no no 3.64s
✅ REPOSITORY checkov yes no no 25.75s
❌ REPOSITORY devskim yes 2027 185 97.6s
✅ REPOSITORY dustilock yes no no 2.54s
✅ REPOSITORY gitleaks yes no no 51.0s
✅ REPOSITORY git_diff yes no no 0.15s
✅ REPOSITORY grype yes no no 86.28s
❌ REPOSITORY kingfisher yes 1 4 15.37s
❌ REPOSITORY osv-scanner yes 1 no 11.15s
✅ REPOSITORY secretlint yes no no 3.25s
✅ REPOSITORY syft yes no no 5.65s
❌ REPOSITORY trivy yes 8 6 9.61s
✅ REPOSITORY trivy-sbom yes no no 1.09s
✅ REPOSITORY trufflehog yes no no 3.82s
❌ SPELL cspell 3 4 0 2.76s
❌ SPELL lychee 2 2 0 5.19s
✅ YAML prettier 1 0 0 0.58s
✅ YAML v8r 1 0 0 3.51s
✅ YAML yamllint 1 0 0 0.73s

Detailed Issues

❌ SPELL / cspell - 4 errors
.jscpd.json:9:9       - Unknown word (gradlew)    -- "**/gradlew",
	 Suggestions: [gradle, gradely, grade, grable, graded]
.mega-linter.yml:11:8      - Unknown word (otelapi)    -- # `. otelapi.sh` sourcing, `bash
	 Suggestions: [openapi, otelaws, OpenAPI, toecap, outleap]
.mega-linter.yml:31:8      - Unknown word (gradlew)    -- # - **/gradlew is the standard Gradle
	 Suggestions: [gradle, gradely, grade, grable, graded]
.mega-linter.yml:33:53     - Unknown word (gradlew)    -- \.yml|/otlp\\.json|/gradlew|/package-lock\\.json
	 Suggestions: [gradle, gradely, grade, grable, graded]
CSpell: Files checked: 3, Issues found: 4 in 2 files.


You can skip this misspellings by defining the following .cspell.json file at the root of your repository
Of course, please correct real typos before :)

{
    "version": "0.2",
    "language": "en",
    "ignorePaths": [
        "**/node_modules/**",
        "**/vscode-extension/**",
        "**/.git/**",
        "**/.pnpm-lock.json",
        ".vscode",
        "package-lock.json",
        "megalinter-reports"
    ],
    "words": [
        "gradlew",
        "otelapi"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository
❌ REPOSITORY / devskim - 2027 errors

No output available

❌ COPYPASTE / jscpd - 811 errors
- 375:2]
Clone found (python)
 - src/usr/share/opentelemetry_shell/sdk.py [65:9 - 87:42] (23 lines, 141 tokens)
   src/usr/share/opentelemetry_shell/sdk.py [105:9 - 128:37]
Clone found (bash)
 - tests/assert.sh [37:45 - 54:8] (18 lines, 79 tokens)
   tests/assert.sh [54:44 - 71:8]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [7:45 - 17:14] (11 lines, 97 tokens)
   tests/auto/test_auto_wget.sh [9:50 - 18:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [12:1 - 17:14] (6 lines, 62 tokens)
   tests/auto/test_auto_curl.sh [66:1 - 71:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [17:43 - 22:89] (6 lines, 60 tokens)
   tests/auto/test_auto_curl.sh [71:41 - 76:89]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [19:19 - 25:84] (7 lines, 80 tokens)
   tests/auto/test_auto_curl.sh [39:29 - 45:84]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [30:61 - 35:14] (6 lines, 54 tokens)
   tests/auto/test_auto_curl.sh [64:68 - 69:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [32:1 - 37:14] (6 lines, 62 tokens)
   tests/auto/test_auto_wget.sh [32:1 - 37:14]
Clone found (bash)
 - tests/auto/test_auto_curl.sh [49:1 - 54:14] (6 lines, 62 tokens)
   tests/auto/test_auto_wget.sh [49:1 - 54:14]
Clone found (bash)
 - tests/auto/test_auto_injection_node.sh [67:1 - 79:26] (13 lines, 65 tokens)
   tests/auto/test_auto_injection_node.sh [98:1 - 110:26]
Clone found (bash)
 - tests/auto/test_auto_injection_node.sh [80:1 - 98:6] (19 lines, 117 tokens)
   tests/auto/test_auto_injection_node.sh [112:1 - 130:6]
Clone found (bash)
 - tests/auto/test_auto_injection_node.sh [109:9 - 115:14] (7 lines, 54 tokens)
   tests/auto/test_auto_injection_node.sh [135:2 - 141:14]
Clone found (bash)
 - tests/auto/test_auto_netcat.sh [98:19 - 104:193] (7 lines, 69 tokens)
   tests/auto/test_auto_netcat.sh [109:33 - 115:193]
Clone found (bash)
 - tests/auto/test_auto_wget.sh [20:19 - 28:37] (9 lines, 92 tokens)
   tests/auto/test_auto_wget.sh [39:29 - 48:20]
┌────────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format     │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ bash       │ 110            │ 8522        │ 58441        │ 59           │ 617 (7.24%)      │ 6078 (10.40%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ c          │ 2              │ 334         │ 2652         │ 4            │ 26 (7.78%)       │ 236 (8.90%)       │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ java       │ 6              │ 313         │ 2886         │ 2            │ 10 (3.19%)       │ 142 (4.92%)       │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ javascript │ 9              │ 296         │ 2690         │ 5            │ 69 (23.31%)      │ 632 (23.49%)      │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ json       │ 7              │ 4003        │ 10717        │ 27           │ 888 (22.18%)     │ 2640 (24.63%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ kotlin     │ 2              │ 57          │ 703          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ log        │ 1              │ 104         │ 2847         │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ markdown   │ 18             │ 29221       │ 114942       │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ markup     │ 1              │ 21          │ 135          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ python     │ 3              │ 733         │ 5265         │ 1            │ 22 (3.00%)       │ 141 (2.68%)       │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ text       │ 16             │ 28668       │ 113444       │ 603          │ 21818 (76.11%)   │ 79419 (70.01%)    │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt        │ 2              │ 16          │ 134          │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ yaml       │ 34             │ 5666        │ 39079        │ 110          │ 1524 (26.90%)    │ 10087 (25.81%)    │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:     │ 211            │ 77954       │ 353935       │ 811          │ 24974 (32.04%)   │ 99375 (28.08%)    │
└────────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 811 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (32.0%) over threshold (5.0%)
time: 805.806ms

(Truncated to last 5714 characters out of 141837)
❌ REPOSITORY / kingfisher - 1 error

No output available

❌ SPELL / lychee - 2 errors
📝 Summary
---------------------
🔍 Total............3
🔗 Unique...........3
✅ Successful.......1
⏳ Timeouts.........0
🔀 Redirected.......0
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2

Errors in .mega-linter.yml
[404] https://github.com/owner/repo/actions/runs/12345 (at 38:14) | Rejected status code: 404 Not Found
[ERROR] https://x-access-token/ (at 39:3) | Connection failed. Check network connectivity and firewall settings

Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
❌ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
Scanned src/opt/opentelemetry_shell/requirements.txt file and found 8 packages
Scanned src/usr/share/opentelemetry_shell/agent.instrumentation.java/pom.xml file and found 2 packages
Scanned src/usr/share/opentelemetry_shell/agent.instrumentation.python/requirements.txt file and found 8 packages
Scanned src/usr/share/opentelemetry_shell/agent.instrumentation.python/instrumentation_roots_requirements.txt file and found 2 packages
Scanned actions/instrument/job/package-lock.json file and found 157 packages
End status: 92 dirs visited, 523 inodes visited, 5 Extract calls, 17.140744ms elapsed, 17.140884ms wall time
Warning: enricher transitivedependency/pomxml may be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts.
failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.python/requirements.txt: resolution impossible:
no candidates at all for: opentelemetry-distro "==0.65b0"
Error during extraction: (extracting as transitivedependency/requirements) failed resolution for src/usr/share/opentelemetry_shell/agent.instrumentation.python/requirements.txt: resolution impossible:
no candidates at all for: opentelemetry-distro "==0.65b0"


Total 1 package affected by 1 known vulnerability (0 Critical, 0 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
1 vulnerability can be fixed.

+-------------------------------------+------+-----------+---------+---------+---------------+----------------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE                                       |
+-------------------------------------+------+-----------+---------+---------+---------------+----------------------------------------------+
| https://osv.dev/PYSEC-2026-215      | 6.9  | PyPI      | idna    | 3.9.0   | 3.15          | src/opt/opentelemetry_shell/requirements.txt |
| https://osv.dev/GHSA-65pc-fj4g-8rjx |      |           |         |         |               |                                              |
+-------------------------------------+------+-----------+---------+---------+---------------+----------------------------------------------+
❌ REPOSITORY / trivy - 8 errors

No output available

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Morty Proxy This is a proxified and sanitized view of the page, visit original site.