# MegaLinter, by [](https://www.ox.security/?ref=megalinter)
[](https://megalinter.io/flavors/)
[](https://npmjs.org/package/mega-linter-runner)
[](https://megalinter.io/latest/coding-agents/)
[](https://github.com/oxsecurity/megalinter/stargazers/)
[](https://github.com/oxsecurity/megalinter/actions?query=workflow%3AMegaLinter+branch%3Amain)
[](https://codecov.io/gh/oxsecurity/megalinter)
[](https://github.com/oxsecurity/megalinter/blob/main/./docs/used-by-stats.md)
[](https://github.com/aquasecurity/trivy)
[](https://github.com/oxsecurity/megalinter/graphs/contributors/)
[](https://github.com/sponsors/nvuillam)
[](https://github.com/oxsecurity/megalinter/blob/main/.github/CONTRIBUTING.md)
[](https://twitter.com/intent/tweet?text=Check+MegaLinter+to+say+goodbye+to+dirty+code+in+your+projects+%3A%29+100%25+free+and+open+source+for+all+uses&url=https://megalinter.io/&via=NicolasVuillamy&hashtags=linters,code,quality,ci,python,java,golang,c,dotnet,kotlin,rust,scala,salesforce,terraform)
MegaLinter is an **open-source** tool for **CI/CD workflows** that analyzes the **consistency of your code**, **IaC**, **configuration**, and **scripts** in your repository to **ensure all your project sources are clean and formatted**, no matter which IDE or toolbox is used by your developers. Powered by [**OX Security**](https://www.ox.security/?ref=megalinter).
Supports [**67** languages](#languages), [**23** formats](#formats), [**22** tooling formats](#tooling-formats), and is **ready to use out of the box** as a GitHub Action or with any CI system. It is **highly configurable** and **free for all uses**.
MegaLinter has **native integrations** with popular CI/CD tools and is compliant with most [**Coding Agents**](https://megalinter.io/latest/coding-agents/).
- Use the new [LLM Advisor](https://megalinter.io/latest/llm-advisor/) that will tell you how to fix linters issues
- Create your own [MegaLinter Custom Flavors](https://megalinter.io/latest/custom-flavors/) to improve performance
Before you go further, see the [**online documentation website, which offers much easier navigation than this README**](https://megalinter.io/)
## Table of Contents
- [Why MegaLinter](#why-megalinter)
- [Quick Start](#quick-start)
- [Coding Agents](#coding-agents)
- [Supported Linters](#supported-linters)
- [Languages](#languages)
- [Formats](#formats)
- [Tooling formats](#tooling-formats)
- [Other](#other)
- [Installation](#installation)
- [Coding agents (skills)](#coding-agents-skills)
- [Coding Agents (Plugins)](#coding-agents-plugins)
- [Assisted installation](#assisted-installation)
- [Which version to use ?](#which-version-to-use-)
- [GitHub Action](#github-action)
- [GitLab CI](#gitlab-ci)
- [Azure Pipelines](#azure-pipelines)
- [Single Repository](#single-repository)
- [Central Repository](#central-repository)
- [Pull Request Comments](#pull-request-comments)
- [Detailed Tutorial](#detailed-tutorial)
- [Bitbucket Pipelines](#bitbucket-pipelines)
- [Jenkins](#jenkins)
- [Concourse](#concourse)
- [Pipeline step](#pipeline-step)
- [Use it as a reusable task](#use-it-as-a-reusable-task)
- [Drone CI](#drone-ci)
- [(Optional) Adjusting trigger rules](#optional-adjusting-trigger-rules)
- [Docker container](#docker-container)
- [Run MegaLinter locally](#run-megalinter-locally)
- [Configuration](#configuration)
- [.mega-linter.yml file](#mega-linteryml-file)
- [Common variables](#common-variables)
- [Activation and deactivation](#activation-and-deactivation)
- [Filter linted files](#filter-linted-files)
- [Apply fixes](#apply-fixes)
- [Apply fixes issues](#apply-fixes-issues)
- [Notes](#notes)
- [Linter specific variables](#linter-specific-variables)
- [Pre-commands](#pre-commands)
- [Post-commands](#post-commands)
- [Environment variables security](#environment-variables-security)
- [Secured env variables](#secured-env-variables)
- [Secured configuration examples](#secured-configuration-examples)
- [Default secured variables](#default-secured-variables)
- [Unhide variables for linters](#unhide-variables-for-linters)
- [CLI lint mode](#cli-lint-mode)
- [Reporters](#reporters)
- [Flavors](#flavors)
- [Badge](#badge)
- [Markdown](#markdown)
- [reStructuredText](#restructuredtext)
- [Plugins](#plugins)
- [External Plugins Catalog](#external-plugins-catalog)
- [Use external plugins](#use-external-plugins)
- [Example](#example)
- [Create your own plugin](#create-your-own-plugin)
- [Limitations](#limitations)
- [They talk about MegaLinter](#they-talk-about-megalinter)
- [English articles](#english-articles)
- [French articles](#french-articles)
- [Videos](#videos)
- [Web Sites](#web-sites)
- [Linters](#linters)
- [Frequently Asked Questions](#frequently-asked-questions)
- [How to contribute](#how-to-contribute)
- [Special thanks](#special-thanks)
- [Maintainers](#maintainers)
- [Contributors](#contributors)
- [Open-source teams](#open-source-teams)
- [Super-Linter team](#super-linter-team)
- [License](#license)
- [MegaLinter vs Super-Linter](#megalinter-vs-super-linter)
- [Security](#security)
- [Performance](#performance)
- [More languages and formats linted](#more-languages-and-formats-linted)
- [Automatically apply formatting and fixes](#automatically-apply-formatting-and-fixes)
- [Run locally](#run-locally)
- [Reports](#reports)
- [Capabilities](#capabilities)
- [Additional Reporters](#additional-reporters)
- [Enhanced configuration](#enhanced-configuration)
- [Enhanced documentation](#enhanced-documentation)
- [Plugin management](#plugin-management)
- [Simplify architecture and evolutionary maintenance](#simplify-architecture-and-evolutionary-maintenance)
- [Improve robustness \& stability](#improve-robustness--stability)
## Why MegaLinter
Projects need to contain clean code in order to **avoid technical debt**, which makes **ongoing maintenance harder and more time-consuming**.
By using [**code formatters and code linters**](#supported-linters), you ensure that your **codebase is easier to read** and **follows best practices**, from kickoff through each step of the project lifecycle.
Not all developers use linters in their IDEs, which makes code reviews harder and longer to process.
By using **MegaLinter**, you'll enjoy the following benefits for your team:
- At **each pull request**, it **automatically analyzes all updated code across all languages**.
- By reading error logs, **developers learn best practices** for the languages they use.
- The [**MegaLinter documentation**](https://megalinter.io/) provides a **list of IDE plugins for each linter**, so developers know which linter and plugins to install.
- MegaLinter **works out of the box** after a [**quick setup**](#quick-start).
- **Formatting and fixes** can be automatically [**applied directly to the Git branch**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-apply-fixes.md) or [**provided in reports**](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/UpdatedSourcesReporter.md).
- This tool is **100% open source** and **free for all uses** (personal, professional, public, and private repositories).
- MegaLinter can run on [**any CI tool**](https://github.com/oxsecurity/megalinter/tree/main/docs/install-assisted.md) and be [**run locally**](https://megalinter.io/mega-linter-runner/): **no need to authorize an external application**, and **your codebase never leaves your tooling ecosystem**.
Join a **continuously growing community**: MegaLinter Docker images are pulled **hundreds of thousands of times every month**.
[](https://megalinter.io/latest/flavors-stats/)
## Quick Start
- **With a coding agent**: install the [MegaLinter agent skills](https://megalinter.io/latest/install-agent-skills/) with `npx skills add oxsecurity/megalinter/skills`, then ask your agent to _"setup megalinter"_.
- **Or with the interactive wizard**: run `npx mega-linter-runner --install` to generate configuration files (you need [Node.js](https://nodejs.org/en/) installed).
- Commit, push, and create a pull request.
- Watch!
**Notes**:
- This repo is a hard fork of [GitHub Super-Linter](https://github.com/super-linter/super-linter), rewritten in Python to add [many additional features](#mega-linter-vs-super-linter).
- If you are a Super-Linter user, you can transparently **switch to MegaLinter and keep the same configuration** (just replace `super-linter/super-linter@v3` with `oxsecurity/megalinter@v10` in your GitHub Action YAML file, [like on this PR](https://github.com/nvuillam/npm-groovy-lint/pull/109)).
- If you want to use MegaLinter's extra features (recommended), please take 5 minutes to use the [assisted installation](https://github.com/oxsecurity/megalinter/tree/main/docs/install-assisted.md).
- For a beginner-friendly example of getting started with MegaLinter, check out [this blog post](https://ayyjohn.com/posts/linting-a-jekyll-blog-with-mega-linter) by Alec Johnson.
## Coding Agents
MegaLinter is designed to work hand in hand with your coding agent:
[](https://claude.com/product/claude-code)
[](https://cursor.com)
[](https://github.com/features/copilot)
[](https://openai.com/codex/)
[](https://antigravity.google/)
[](https://opencode.ai)
[](https://github.com/google-gemini/gemini-cli)
[](https://windsurf.com)
[](https://cline.bot)
[](https://roocode.com)
[](https://kilocode.ai)
[](https://ampcode.com)
[](https://block.github.io/goose/)
[](https://www.all-hands.dev)
[](https://github.com/QwenLM/qwen-code)
### Get started
Install the [MegaLinter agent skills](https://github.com/oxsecurity/megalinter/tree/main/skills) at the root of your repository:
With **Claude Code** (the skills are copied directly into `.claude/skills/`):
```bash
npx skills add oxsecurity/megalinter/skills -s '*' -a claude-code -y
```
With **another coding agent**, replace `claude-code` with your agent's identifier (`cursor`, `github-copilot`, `codex`, `antigravity`, `opencode`... full list in the [skills CLI documentation](https://github.com/vercel-labs/skills#supported-agents)) — or let the CLI **detect your installed agents** and install the skills for all of them at once:
```bash
npx skills add oxsecurity/megalinter/skills -s '*' -y --copy
```
Then just talk to your agent:
- _"Setup MegaLinter on this repo"_
- _"Run MegaLinter and fix the errors"_
- _"Why is the MegaLinter CI job failing? Fix it"_
### What the skills do
| Skill | Role |
|:---------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **megalinter** | Entry point: detects the repository state and orchestrates the other skills in a check → fix → re-check loop (3 iterations max) |
| **megalinter-setup** | Installs or upgrades MegaLinter using `npx mega-linter-runner --install` (non-interactive), then refines `.mega-linter.yml` |
| **megalinter-check** | Collects errors: watches a MegaLinter CI job (GitHub Actions, GitLab CI, Azure Pipelines, Bitbucket Pipelines) or runs MegaLinter locally with docker/podman |
| **megalinter-fix** | Fixes errors guided by a per-linter fix guide (one for each of the 124 linters, loaded only when its linter has errors), asks you before disabling rules or pushing |
### Sub-agents orchestration
On agents supporting sub-agents (Claude Code, OpenCode, GitHub Copilot custom agents...), `megalinter-setup` installs three sub-agents that keep large CI logs and linter outputs **out of your main agent's context**, and run on low-cost models when possible:
```mermaid
flowchart TD
U(["👤 You: run megalinter and fix the errors"]) --> O["🎯 megalinter (orchestrator skill)"]
O -->|"no config found"| S["🛠️ megalinter-setup"]
S -->|"npx mega-linter-runner --install"| CFG[/".mega-linter.yml + CI workflow"/]
O --> C["🔍 megalinter-check"]
C -->|"watch mode"| W[["👀 megalinter-watcher sub-agent, low-cost model"]]
W --> CI[/"CI job logs GitHub / GitLab / Azure / Bitbucket"/]
C -->|"local mode"| RUN[["🐳 megalinter-runner sub-agent, low-cost model"]]
RUN --> IMG[/"MegaLinter Docker image docker or podman"/]
W --> ERR[/"📋 Compact error list grouped by linter"/]
RUN --> ERR
ERR --> F["🔧 megalinter-fix"]
F -->|"one sub-agent per failing linter, in parallel"| FX1[["🤖 megalinter-fixer + python_ruff fix guide"]]
F --> FX2[["🤖 megalinter-fixer + markdown_markdownlint fix guide"]]
FX1 --> RES[/"✏️ Fixed files + proposed rule disables"/]
FX2 --> RES
RES -->|"you confirm disables"| RC["♻️ Targeted re-check parallel standalone linter images"]
RC -->|"errors remain (max 3 loops)"| F
RC -->|"clean"| DONE(["✅ Commit on a branch (never on main)"])
classDef user fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#1b5e20
classDef skill fill:#ede7f6,stroke:#5e35b1,stroke-width:2px,color:#311b92
classDef subagent fill:#e3f2fd,stroke:#1976d2,stroke-width:2px,color:#0d47a1
classDef artifact fill:#fff8e1,stroke:#f9a825,stroke-width:1px,color:#5d4037
classDef recheck fill:#e0f2f1,stroke:#00897b,stroke-width:2px,color:#004d40
class U,DONE user
class O,S,C,F skill
class W,RUN,FX1,FX2 subagent
class CFG,CI,IMG,ERR,RES artifact
class RC recheck
```
The fix guides combine information generated from the [linter descriptors](https://github.com/oxsecurity/megalinter/tree/main/megalinter/descriptors) (auto-fix support, rules documentation URLs, MegaLinter tuning variables) with curated fix, inline-disable and ignore instructions grounded in each linter's official documentation.
### Safety rules
- Safe fixes are applied automatically; ambiguous ones are asked to you
- Disabling a linter or a rule always requires your confirmation
- Commits are never pushed to the default branch
See also the [installation page for coding agents](https://megalinter.io/latest/install-agent-skills/), or install everything at once as an [agent plugin](https://megalinter.io/latest/agent-plugins/).
## Supported Linters
All linters are integrated into the [MegaLinter Docker image](https://hub.docker.com/r/oxsecurity/megalinter), which is frequently updated with their latest versions.
### Languages
| | Language | Linter | Additional |
|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------:|---------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
| | [**BASH**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash.md) | [**bash-exec**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash_bash_exec.md) [_BASH_EXEC_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash_bash_exec.md) | |
| | [**BASH**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash.md) | [**shellcheck**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash_shellcheck.md) [_BASH_SHELLCHECK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash_shellcheck.md) | [](https://github.com/koalaman/shellcheck)  |
| | [**BASH**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash.md) | [**shfmt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash_shfmt.md) [_BASH_SHFMT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bash_shfmt.md) | [](https://github.com/mvdan/sh)  |
| | [**C**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c.md) | [**cppcheck**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c_cppcheck.md) [_C_CPPCHECK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c_cppcheck.md) |  |
| | [**C**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c.md) | [**cpplint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c_cpplint.md) [_C_CPPLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c_cpplint.md) | [](https://github.com/cpplint/cpplint) |
| | [**C**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c.md) | [**clang-format**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c_clang_format.md) [_C_CLANG_FORMAT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/c_clang_format.md) | [](https://github.com/llvm/llvm-project)  |
| | [**CLOJURE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/clojure.md) | [**clj-kondo**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/clojure_clj_kondo.md) [_CLOJURE_CLJ_KONDO_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/clojure_clj_kondo.md) | [](https://github.com/clj-kondo/clj-kondo)  |
| | [**CLOJURE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/clojure.md) | [**cljstyle**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/clojure_cljstyle.md) [_CLOJURE_CLJSTYLE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/clojure_cljstyle.md) | [](https://github.com/greglook/cljstyle)  |
| | [**COFFEE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/coffee.md) | [**coffeelint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/coffee_coffeelint.md) [_COFFEE_COFFEELINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/coffee_coffeelint.md) | 🚫 [](https://github.com/clutchski/coffeelint) |
| | [**C++** (CPP)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp.md) | [**cppcheck**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp_cppcheck.md) [_CPP_CPPCHECK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp_cppcheck.md) |  |
| | [**C++** (CPP)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp.md) | [**cpplint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp_cpplint.md) [_CPP_CPPLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp_cpplint.md) | [](https://github.com/cpplint/cpplint) |
| | [**C++** (CPP)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp.md) | [**clang-format**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp_clang_format.md) [_CPP_CLANG_FORMAT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cpp_clang_format.md) | [](https://github.com/llvm/llvm-project)  |
| | [**C#** (CSHARP)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp.md) | [**dotnet-format**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp_dotnet_format.md) [_CSHARP_DOTNET_FORMAT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp_dotnet_format.md) | [](https://github.com/dotnet/sdk)  |
| | [**C#** (CSHARP)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp.md) | [**csharpier**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp_csharpier.md) [_CSHARP_CSHARPIER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp_csharpier.md) | [](https://github.com/belav/csharpier)  |
| | [**C#** (CSHARP)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp.md) | [**roslynator**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp_roslynator.md) [_CSHARP_ROSLYNATOR_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/csharp_roslynator.md) | [](https://github.com/dotnet/Roslynator)  |
| | [**DART**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/dart.md) | [**dartanalyzer**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/dart_dartanalyzer.md) [_DART_DARTANALYZER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/dart_dartanalyzer.md) | [](https://github.com/dart-lang/sdk) |
| | [**GO**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/go.md) | [**golangci-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/go_golangci_lint.md) [_GO_GOLANGCI_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/go_golangci_lint.md) | [](https://github.com/golangci/golangci-lint)   |
| | [**GO**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/go.md) | [**revive**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/go_revive.md) [_GO_REVIVE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/go_revive.md) | [](https://github.com/mgechev/revive)  |
| | [**GROOVY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/groovy.md) | [**npm-groovy-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/groovy_npm_groovy_lint.md) [_GROOVY_NPM_GROOVY_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/groovy_npm_groovy_lint.md) | [](https://github.com/nvuillam/npm-groovy-lint)   |
| | [**JAVA**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/java.md) | [**checkstyle**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/java_checkstyle.md) [_JAVA_CHECKSTYLE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/java_checkstyle.md) | [](https://github.com/checkstyle/checkstyle)  |
| | [**JAVA**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/java.md) | [**pmd**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/java_pmd.md) [_JAVA_PMD_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/java_pmd.md) | [](https://github.com/pmd/pmd)  |
| | [**JAVASCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript.md) | [**eslint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_eslint.md) [_JAVASCRIPT_ES_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_eslint.md) | [](https://github.com/eslint/eslint)   |
| | [**JAVASCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript.md) | [**standard**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_standard.md) [_JAVASCRIPT_STANDARD_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_standard.md) | [](https://github.com/standard/standard)  |
| | [**JAVASCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript.md) | [**prettier**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_prettier.md) [_JAVASCRIPT_PRETTIER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_prettier.md) | [](https://github.com/prettier/prettier)  |
| | [**JAVASCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_biome.md) [_JAVASCRIPT_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/javascript_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**JSX**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/jsx.md) | [**eslint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/jsx_eslint.md) [_JSX_ESLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/jsx_eslint.md) | [](https://github.com/Rel1cx/eslint-react)   |
| | [**JSX**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/jsx.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/jsx_biome.md) [_JSX_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/jsx_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**KOTLIN**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kotlin.md) | [**ktlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kotlin_ktlint.md) [_KOTLIN_KTLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kotlin_ktlint.md) | [](https://github.com/pinterest/ktlint)   |
| | [**KOTLIN**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kotlin.md) | [**detekt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kotlin_detekt.md) [_KOTLIN_DETEKT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kotlin_detekt.md) | [](https://github.com/detekt/detekt)  |
| | [**LUA**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/lua.md) | [**luacheck**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/lua_luacheck.md) [_LUA_LUACHECK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/lua_luacheck.md) | [](https://github.com/lunarmodules/luacheck) |
| | [**LUA**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/lua.md) | [**stylua**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/lua_stylua.md) [_LUA_STYLUA_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/lua_stylua.md) | [](https://github.com/JohnnyMorganz/StyLua) |
| | [**PERL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/perl.md) | [**perlcritic**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/perl_perlcritic.md) [_PERL_PERLCRITIC_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/perl_perlcritic.md) | [](https://github.com/Perl-Critic/Perl-Critic) |
| | [**PHP**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php.md) | [**phpcs**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_phpcs.md) [_PHP_PHPCS_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_phpcs.md) | [](https://github.com/PHPCSStandards/PHP_CodeSniffer)  |
| | [**PHP**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php.md) | [**phpstan**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_phpstan.md) [_PHP_PHPSTAN_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_phpstan.md) | [](https://github.com/phpstan/phpstan)  |
| | [**PHP**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php.md) | [**psalm**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_psalm.md) [_PHP_PSALM_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_psalm.md) | [](https://github.com/vimeo/psalm)  |
| | [**PHP**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php.md) | [**phplint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_phplint.md) [_PHP_PHPLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_phplint.md) | [](https://github.com/overtrue/phplint)  |
| | [**PHP**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php.md) | [**php-cs-fixer**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_php_cs_fixer.md) [_PHP_PHPCSFIXER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/php_php_cs_fixer.md) | [](https://github.com/PHP-CS-Fixer/PHP-CS-Fixer) |
| | [**POWERSHELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/powershell.md) | [**powershell**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/powershell_powershell.md) [_POWERSHELL_POWERSHELL_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/powershell_powershell.md) | [](https://github.com/PowerShell/PSScriptAnalyzer)  |
| | [**POWERSHELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/powershell.md) | [**powershell_formatter**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/powershell_powershell_formatter.md) [_POWERSHELL_POWERSHELL_FORMATTER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/powershell_powershell_formatter.md) | [](https://github.com/PowerShell/PSScriptAnalyzer)  |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**pylint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_pylint.md) [_PYTHON_PYLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_pylint.md) | [](https://github.com/pylint-dev/pylint) |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**black**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_black.md) [_PYTHON_BLACK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_black.md) | [](https://github.com/psf/black)  |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**flake8**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_flake8.md) [_PYTHON_FLAKE8_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_flake8.md) | [](https://github.com/PyCQA/flake8) |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**isort**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_isort.md) [_PYTHON_ISORT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_isort.md) | [](https://github.com/PyCQA/isort)  |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**bandit**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_bandit.md) [_PYTHON_BANDIT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_bandit.md) | [](https://github.com/PyCQA/bandit)  |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**mypy**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_mypy.md) [_PYTHON_MYPY_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_mypy.md) | [](https://github.com/python/mypy) |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**nbqa**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_nbqa.md) [_PYTHON_NBQA_MYPY_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_nbqa.md) | [](https://github.com/nbQA-dev/nbQA) |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**pyright**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_pyright.md) [_PYTHON_PYRIGHT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_pyright.md) | [](https://github.com/microsoft/pyright) |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**ruff**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_ruff.md) [_PYTHON_RUFF_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_ruff.md) | [](https://github.com/astral-sh/ruff)   |
| | [**PYTHON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python.md) | [**ruff-format**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_ruff_format.md) [_PYTHON_RUFF_FORMAT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/python_ruff_format.md) | [](https://github.com/astral-sh/ruff)  |
| | [**R**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/r.md) | [**lintr**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/r_lintr.md) [_R_LINTR_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/r_lintr.md) | [](https://github.com/r-lib/lintr)  |
| | [**RAKU**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/raku.md) | [**raku**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/raku_raku.md) [_RAKU_RAKU_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/raku_raku.md) | [](https://github.com/rakudo/rakudo) |
| | [**RUBY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/ruby.md) | [**rubocop**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/ruby_rubocop.md) [_RUBY_RUBOCOP_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/ruby_rubocop.md) | [](https://github.com/rubocop-hq/rubocop)  |
| | [**RUST**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rust.md) | [**clippy**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rust_clippy.md) [_RUST_CLIPPY_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rust_clippy.md) | [](https://github.com/rust-lang/rust-clippy) |
| | [**SALESFORCE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce.md) | [**code-analyzer-apex**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_apex.md) [_SALESFORCE_CODE_ANALYZER_APEX_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_apex.md) | [](https://github.com/forcedotcom/code-analyzer)  |
| | [**SALESFORCE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce.md) | [**code-analyzer-apexguru**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_apexguru.md) [_SALESFORCE_CODE_ANALYZER_APEXGURU_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_apexguru.md) | [](https://github.com/forcedotcom/code-analyzer)  |
| | [**SALESFORCE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce.md) | [**code-analyzer-aura**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_aura.md) [_SALESFORCE_CODE_ANALYZER_AURA_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_aura.md) | [](https://github.com/forcedotcom/code-analyzer)  |
| | [**SALESFORCE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce.md) | [**code-analyzer-lwc**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_lwc.md) [_SALESFORCE_CODE_ANALYZER_LWC_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_lwc.md) | [](https://github.com/forcedotcom/code-analyzer)  |
| | [**SALESFORCE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce.md) | [**code-analyzer-flow**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_flow.md) [_SALESFORCE_CODE_ANALYZER_FLOW_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/salesforce_code_analyzer_flow.md) | [](https://github.com/forcedotcom/code-analyzer)  |
| | [**SCALA**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/scala.md) | [**scalafix**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/scala_scalafix.md) [_SCALA_SCALAFIX_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/scala_scalafix.md) | [](https://github.com/scalacenter/scalafix) |
| | [**SQL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/sql.md) | [**sqlfluff**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/sql_sqlfluff.md) [_SQL_SQLFLUFF_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/sql_sqlfluff.md) | [](https://github.com/sqlfluff/sqlfluff)   |
| | [**SWIFT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/swift.md) | [**swiftlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/swift_swiftlint.md) [_SWIFT_SWIFTLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/swift_swiftlint.md) | [](https://github.com/realm/SwiftLint)   |
| | [**TSX**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tsx.md) | [**eslint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tsx_eslint.md) [_TSX_ESLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tsx_eslint.md) | [](https://github.com/Rel1cx/eslint-react)   |
| | [**TSX**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tsx.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tsx_biome.md) [_TSX_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tsx_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**TYPESCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript.md) | [**eslint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_eslint.md) [_TYPESCRIPT_ES_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_eslint.md) | [](https://github.com/typescript-eslint/typescript-eslint)   |
| | [**TYPESCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript.md) | [**ts-standard**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_ts_standard.md) [_TYPESCRIPT_STANDARD_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_ts_standard.md) | [](https://github.com/standard/ts-standard)  |
| | [**TYPESCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript.md) | [**prettier**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_prettier.md) [_TYPESCRIPT_PRETTIER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_prettier.md) | [](https://github.com/prettier/prettier)  |
| | [**TYPESCRIPT**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_biome.md) [_TYPESCRIPT_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/typescript_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**Visual Basic .NET** (VBDOTNET)](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/vbdotnet.md) | [**dotnet-format**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/vbdotnet_dotnet_format.md) [_VBDOTNET_DOTNET_FORMAT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/vbdotnet_dotnet_format.md) | [](https://github.com/dotnet/sdk)  |
### Formats
| | Format | Linter | Additional |
|:-------------------------------------------------------------------------------------------------------------------------------------------------------------:|---------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
| | [**CSS**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/css.md) | [**stylelint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/css_stylelint.md) [_CSS_STYLELINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/css_stylelint.md) | [](https://github.com/stylelint/stylelint)  |
| | [**CSS**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/css.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/css_biome.md) [_CSS_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/css_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**ENV**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/env.md) | [**dotenv-linter**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/env_dotenv_linter.md) [_ENV_DOTENV_LINTER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/env_dotenv_linter.md) | [](https://github.com/dotenv-linter/dotenv-linter)  |
| | [**GRAPHQL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/graphql.md) | [**graphql-schema-linter**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/graphql_graphql_schema_linter.md) [_GRAPHQL_GRAPHQL_SCHEMA_LINTER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/graphql_graphql_schema_linter.md) | 🚫 [](https://github.com/cjoudrey/graphql-schema-linter) |
| | [**GRAPHQL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/graphql.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/graphql_biome.md) [_GRAPHQL_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/graphql_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**HTML**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/html.md) | [**djlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/html_djlint.md) [_HTML_DJLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/html_djlint.md) | [](https://github.com/Riverside-Healthcare/djlint) |
| | [**HTML**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/html.md) | [**htmlhint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/html_htmlhint.md) [_HTML_HTMLHINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/html_htmlhint.md) | [](https://github.com/htmlhint/HTMLHint)  |
| | [**JSON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json.md) | [**jsonlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_jsonlint.md) [_JSON_JSONLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_jsonlint.md) | [](https://github.com/prantlf/jsonlint) |
| | [**JSON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json.md) | [**v8r**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_v8r.md) [_JSON_V8R_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_v8r.md) | [](https://github.com/chris48s/v8r) |
| | [**JSON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json.md) | [**prettier**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_prettier.md) [_JSON_PRETTIER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_prettier.md) | [](https://github.com/prettier/prettier)  |
| | [**JSON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json.md) | [**npm-package-json-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_npm_package_json_lint.md) [_JSON_NPM_PACKAGE_JSON_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_npm_package_json_lint.md) | [](https://github.com/tclindner/npm-package-json-lint) |
| | [**JSON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json.md) | [**biome**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_biome.md) [_JSON_BIOME_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/json_biome.md) | [](https://github.com/biomejs/biome)   |
| | [**LATEX**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/latex.md) | [**chktex**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/latex_chktex.md) [_LATEX_CHKTEX_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/latex_chktex.md) | |
| | [**MARKDOWN**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown.md) | [**markdownlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown_markdownlint.md) [_MARKDOWN_MARKDOWNLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown_markdownlint.md) | [](https://github.com/DavidAnson/markdownlint)  |
| | [**MARKDOWN**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown.md) | [**markdown-table-formatter**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown_markdown_table_formatter.md) [_MARKDOWN_MARKDOWN_TABLE_FORMATTER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown_markdown_table_formatter.md) | [](https://github.com/nvuillam/markdown-table-formatter)  |
| | [**MARKDOWN**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown.md) | [**rumdl**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown_rumdl.md) [_MARKDOWN_RUMDL_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/markdown_rumdl.md) | [](https://github.com/rvben/rumdl)   |
| | [**PROTOBUF**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/protobuf.md) | [**protolint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/protobuf_protolint.md) [_PROTOBUF_PROTOLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/protobuf_protolint.md) | [](https://github.com/yoheimuta/protolint)   |
| | [**RST**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst.md) | [**rst-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst_rst_lint.md) [_RST_RST_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst_rst_lint.md) | [](https://github.com/twolfson/restructuredtext-lint) |
| | [**RST**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst.md) | [**rstcheck**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst_rstcheck.md) [_RST_RSTCHECK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst_rstcheck.md) | [](https://github.com/myint/rstcheck) |
| | [**RST**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst.md) | [**rstfmt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst_rstfmt.md) [_RST_RSTFMT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/rst_rstfmt.md) |  |
| | [**XML**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/xml.md) | [**xmllint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/xml_xmllint.md) [_XML_XMLLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/xml_xmllint.md) |  |
| | [**YAML**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml.md) | [**prettier**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml_prettier.md) [_YAML_PRETTIER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml_prettier.md) | [](https://github.com/prettier/prettier)  |
| | [**YAML**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml.md) | [**yamllint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml_yamllint.md) [_YAML_YAMLLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml_yamllint.md) | [](https://github.com/adrienverge/yamllint) |
| | [**YAML**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml.md) | [**v8r**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml_v8r.md) [_YAML_V8R_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/yaml_v8r.md) | [](https://github.com/chris48s/v8r) |
### Tooling formats
| | Tooling format | Linter | Additional |
|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|-------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
| | [**ACTION**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/action.md) | [**actionlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/action_actionlint.md) [_ACTION_ACTIONLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/action_actionlint.md) | [](https://github.com/rhysd/actionlint) |
| | [**ACTION**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/action.md) | [**zizmor**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/action_zizmor.md) [_ACTION_ZIZMOR_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/action_zizmor.md) | [](https://github.com/zizmorcore/zizmor)   |
| | [**ANSIBLE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/ansible.md) | [**ansible-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/ansible_ansible_lint.md) [_ANSIBLE_ANSIBLE_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/ansible_ansible_lint.md) | [](https://github.com/ansible/ansible-lint)  |
| | [**API**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/api.md) | [**spectral**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/api_spectral.md) [_API_SPECTRAL_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/api_spectral.md) | [](https://github.com/stoplightio/spectral)  |
| | [**ARM**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/arm.md) | [**arm-ttk**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/arm_arm_ttk.md) [_ARM_ARM_TTK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/arm_arm_ttk.md) | [](https://github.com/Azure/arm-ttk) |
| | [**BICEP**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bicep.md) | [**bicep_linter**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bicep_bicep_linter.md) [_BICEP_BICEP_LINTER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/bicep_bicep_linter.md) | [](https://github.com/Azure/bicep)  |
| | [**CLOUDFORMATION**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cloudformation.md) | [**cfn-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cloudformation_cfn_lint.md) [_CLOUDFORMATION_CFN_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/cloudformation_cfn_lint.md) | [](https://github.com/aws-cloudformation/cfn-lint)  |
| | [**DOCKERFILE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/dockerfile.md) | [**hadolint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/dockerfile_hadolint.md) [_DOCKERFILE_HADOLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/dockerfile_hadolint.md) | [](https://github.com/hadolint/hadolint)  |
| | [**EDITORCONFIG**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/editorconfig.md) | [**editorconfig-checker**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/editorconfig_editorconfig_checker.md) [_EDITORCONFIG_EDITORCONFIG_CHECKER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/editorconfig_editorconfig_checker.md) | [](https://github.com/editorconfig-checker/editorconfig-checker) |
| | [**GHERKIN**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/gherkin.md) | [**gherkin-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/gherkin_gherkin_lint.md) [_GHERKIN_GHERKIN_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/gherkin_gherkin_lint.md) | [](https://github.com/gherkin-lint/gherkin-lint) |
| | [**KUBERNETES**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes.md) | [**kubeconform**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes_kubeconform.md) [_KUBERNETES_KUBECONFORM_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes_kubeconform.md) | [](https://github.com/yannh/kubeconform) |
| | [**KUBERNETES**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes.md) | [**helm**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes_helm.md) [_KUBERNETES_HELM_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes_helm.md) | [](https://github.com/helm/helm) |
| | [**KUBERNETES**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes.md) | [**kubescape**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes_kubescape.md) [_KUBERNETES_KUBESCAPE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/kubernetes_kubescape.md) | [](https://github.com/kubescape/kubescape)  |
| | [**ROBOTFRAMEWORK**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/robotframework.md) | [**robocop**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/robotframework_robocop.md) [_ROBOTFRAMEWORK_ROBOCOP_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/robotframework_robocop.md) | [](https://github.com/MarketSquare/robotframework-robocop)   |
| | [**SNAKEMAKE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/snakemake.md) | [**snakemake**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/snakemake_snakemake.md) [_SNAKEMAKE_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/snakemake_snakemake.md) | [](https://github.com/snakemake/snakemake) |
| | [**SNAKEMAKE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/snakemake.md) | [**snakefmt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/snakemake_snakefmt.md) [_SNAKEMAKE_SNAKEFMT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/snakemake_snakefmt.md) | [](https://github.com/snakemake/snakefmt)  |
| | [**TEKTON**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tekton.md) | [**tekton-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tekton_tekton_lint.md) [_TEKTON_TEKTON_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/tekton_tekton_lint.md) | [](https://github.com/IBM/tekton-lint) |
| | [**TERRAFORM**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform.md) | [**tflint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_tflint.md) [_TERRAFORM_TFLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_tflint.md) | [](https://github.com/terraform-linters/tflint)  |
| | [**TERRAFORM**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform.md) | [**terragrunt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_terragrunt.md) [_TERRAFORM_TERRAGRUNT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_terragrunt.md) | [](https://github.com/gruntwork-io/terragrunt)  |
| | [**TERRAFORM**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform.md) | [**terraform-fmt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_terraform_fmt.md) [_TERRAFORM_TERRAFORM_FMT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_terraform_fmt.md) | [](https://github.com/hashicorp/terraform)  |
| | [**TERRAFORM**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform.md) | [**tofu-fmt**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_tofu_fmt.md) [_TERRAFORM_TOFU_FMT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_tofu_fmt.md) | [](https://github.com/opentofu/opentofu)  |
| | [**TERRAFORM**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform.md) | [**tofu-validate**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_tofu_validate.md) [_TERRAFORM_TOFU_VALIDATE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/terraform_tofu_validate.md) | [](https://github.com/opentofu/opentofu) |
### Other
| | Code quality checker | Linter | Additional |
|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------:|-----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
| | [**COPYPASTE**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/copypaste.md) | [**jscpd**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/copypaste_jscpd.md) [_COPYPASTE_JSCPD_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/copypaste_jscpd.md) | [](https://github.com/kucherenko/jscpd)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**checkov**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_checkov.md) [_REPOSITORY_CHECKOV_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_checkov.md) | [](https://github.com/bridgecrewio/checkov)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**devskim**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_devskim.md) [_REPOSITORY_DEVSKIM_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_devskim.md) | [](https://github.com/microsoft/DevSkim)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**dustilock**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_dustilock.md) [_REPOSITORY_DUSTILOCK_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_dustilock.md) | [](https://github.com/Checkmarx/dustilock)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**git_diff**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_git_diff.md) [_REPOSITORY_GIT_DIFF_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_git_diff.md) | [](https://github.com/git/git) |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**betterleaks**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_betterleaks.md) [_REPOSITORY_BETTERLEAKS_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_betterleaks.md) | [](https://github.com/betterleaks/betterleaks)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**grype**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_grype.md) [_REPOSITORY_GRYPE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_grype.md) | [](https://github.com/anchore/grype)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**ls-lint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_ls_lint.md) [_REPOSITORY_LS_LINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_ls_lint.md) | [](https://github.com/loeffel-io/ls-lint) |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**osv-scanner**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_osv_scanner.md) [_REPOSITORY_OSV_SCANNER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_osv_scanner.md) | [](https://github.com/google/osv-scanner)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**secretlint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_secretlint.md) [_REPOSITORY_SECRETLINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_secretlint.md) | [](https://github.com/secretlint/secretlint)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**semgrep**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_semgrep.md) [_REPOSITORY_SEMGREP_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_semgrep.md) | [](https://github.com/returntocorp/semgrep)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**syft**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_syft.md) [_REPOSITORY_SYFT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_syft.md) | [](https://github.com/anchore/syft)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**trivy**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_trivy.md) [_REPOSITORY_TRIVY_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_trivy.md) | [](https://github.com/aquasecurity/trivy)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**trivy-sbom**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_trivy_sbom.md) [_REPOSITORY_TRIVY_SBOM_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_trivy_sbom.md) | [](https://github.com/aquasecurity/trivy)  |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**trufflehog**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_trufflehog.md) [_REPOSITORY_TRUFFLEHOG_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_trufflehog.md) | [](https://github.com/trufflesecurity/trufflehog) |
| | [**REPOSITORY**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository.md) | [**kingfisher**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_kingfisher.md) [_REPOSITORY_KINGFISHER_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/repository_kingfisher.md) | [](https://github.com/mongodb/kingfisher)  |
| | [**SPELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell.md) | [**cspell**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_cspell.md) [_SPELL_CSPELL_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_cspell.md) | [](https://github.com/streetsidesoftware/cspell) |
| | [**SPELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell.md) | [**proselint**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_proselint.md) [_SPELL_PROSELINT_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_proselint.md) | [](https://github.com/amperser/proselint) |
| | [**SPELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell.md) | [**vale**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_vale.md) [_SPELL_VALE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_vale.md) | [](https://github.com/errata-ai/vale) |
| | [**SPELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell.md) | [**lychee**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_lychee.md) [_SPELL_LYCHEE_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_lychee.md) | [](https://github.com/lycheeverse/lychee) |
| | [**SPELL**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell.md) | [**codespell**](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_codespell.md) [_SPELL_CODESPELL_](https://github.com/oxsecurity/megalinter/tree/main/docs/descriptors/spell_codespell.md) | [](https://github.com/codespell-project/codespell)  |
## Installation
### Coding agents (skills)
MegaLinter ships [**agent skills**](https://github.com/oxsecurity/megalinter/tree/main/skills) making it easy to drive from coding agents like **Claude Code, Cursor CLI, GitHub Copilot CLI, Codex, Antigravity or OpenCode**:
With **Claude Code** (the skills are copied directly into `.claude/skills/`):
```bash
npx skills add oxsecurity/megalinter/skills -s '*' -a claude-code -y
```
With **another coding agent**, replace `claude-code` with your agent's identifier (`cursor`, `github-copilot`, `codex`, `antigravity`, `opencode`... full list in the [skills CLI documentation](https://github.com/vercel-labs/skills#supported-agents)) — or let the CLI **detect your installed agents** and install the skills for all of them at once:
```bash
npx skills add oxsecurity/megalinter/skills -s '*' -y --copy
```
Then just ask your agent to _"setup megalinter"_ or _"run megalinter and fix the errors"_. The skills handle:
- **megalinter-setup**: install or upgrade MegaLinter on the repository (non-interactive `npx mega-linter-runner --install`)
- **megalinter-check**: watch MegaLinter CI jobs (GitHub Actions, GitLab CI, Azure Pipelines, Bitbucket Pipelines) or run locally with Docker
- **megalinter-fix**: apply fixes guided by per-linter fix guides, with user confirmation before disabling anything or pushing
- **megalinter**: orchestrate the whole check → fix → re-check loop
On coding agents supporting sub-agents (Claude Code, OpenCode, GitHub Copilot custom agents...), dedicated MegaLinter sub-agents (running on low-cost models) watch CI jobs and digest linter outputs to keep large logs out of your agent's context, and fix several linters in parallel.
## Coding Agents (Plugins)
The MegaLinter [agent skills](https://megalinter.io/latest/install-agent-skills/) are also published as an **agent plugin**, so a single command installs all four skills at once, and keeps them updated.
### Claude Code
```bash
/plugin marketplace add oxsecurity/megalinter
/plugin install megalinter@megalinter
```
The three MegaLinter sub-agents are installed with the plugin, so there is nothing else to set up.
### Cursor
Add `https://github.com/oxsecurity/megalinter` as a plugin source from **Customize → Plugins**, then install **MegaLinter**. The sub-agents ship with the plugin.
### GitHub Copilot
```bash
copilot plugin marketplace add oxsecurity/megalinter
copilot plugin install megalinter@megalinter
```
### Codex
```bash
codex plugin marketplace add oxsecurity/megalinter
```
Then install **MegaLinter** from the `/plugins` browser.
### Gemini CLI and Antigravity
```bash
gemini extensions install https://github.com/oxsecurity/megalinter
```
### Other coding agents
Every other agent (Windsurf, Cline, Roo Code, Amp, OpenCode, Goose, OpenHands...) is covered by the [skills installation](https://megalinter.io/latest/install-agent-skills/) with `npx skills add oxsecurity/megalinter/skills`.
Once installed, just ask your agent to _"setup megalinter"_ or _"run megalinter and fix the errors"_.
### Assisted installation
Two assisted ways to setup MegaLinter on your repository:
- **With a coding agent**: install the [MegaLinter agent skills](https://megalinter.io/latest/install-agent-skills/) with `npx skills add oxsecurity/megalinter/skills`, then ask your agent to _"setup megalinter"_.
- **With the interactive wizard**: run `npx mega-linter-runner --install` at the root of your repository and answer questions, it will generate ready to use configuration files for MegaLinter :)
### Which version to use ?
> **Docker registry change (since v9.5.0)**: MegaLinter Docker images are **published only to GitHub Container Registry (`ghcr.io`)**. The Docker Hub registry (`docker.io/oxsecurity/megalinter`, formerly `oxsecurity/megalinter:*`) is **frozen at v9.4.0** until we implement OIDC-based publishing to Docker Hub.
> Docker Hub does not have v10 images: if you pull `oxsecurity/megalinter` from Docker Hub you will stay on v9.4.0. To get v10, switch your `image:` / `docker pull` references to `ghcr.io/oxsecurity/megalinter:v10` (same applies to `:beta` and all [flavor](#flavors) tags like `ghcr.io/oxsecurity/megalinter-python:v10`).
> GitHub Action users (`uses: oxsecurity/megalinter@v10`) are not affected, as the action already pulls from `ghcr.io`.
The following instructions examples are using latest MegaLinter stable version (**v10** , always corresponding to the [latest release](https://github.com/oxsecurity/megalinter/releases))
- Docker image: `ghcr.io/oxsecurity/megalinter:v10`
- GitHub Action: `oxsecurity/megalinter@v10`
You can also use **beta** version (corresponding to the content of main branch)
- Docker image: `ghcr.io/oxsecurity/megalinter:beta`
- GitHub Action: `oxsecurity/megalinter@beta`
### GitHub Action
1. Create a new file in your repository called `.github/workflows/mega-linter.yml`
2. Copy the [example workflow from below](https://raw.githubusercontent.com/oxsecurity/megalinter/main/TEMPLATES/mega-linter.yml) into that new file, no extra configuration required
3. Commit that file to a new branch
4. Open up a pull request and observe the action working
5. Enjoy your more _stable_, and _cleaner_ code base
**NOTES:**
- If you pass the _Environment_ variable `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` in your workflow, then the **MegaLinter** will mark the status of each individual linter run in the Checks section of a pull request. Without this you will only see the overall status of the full run. There is no need to set the **GitHub** Secret as it's automatically set by GitHub, it only needs to be passed to the action.
- You can also **use it outside of GitHub Actions** (CircleCI, Azure Pipelines, Jenkins, GitLab, or even locally with a docker run) , and have status on Github Pull Request if `GITHUB_TARGET_URL` environment variable exists.
In your repository you should have a `.github/workflows` folder with **GitHub** Action similar to below:
- `.github/workflows/mega-linter.yml`
This file should have this code
```yml
---
# MegaLinter GitHub Action configuration file
# More info at https://megalinter.io
name: MegaLinter
on:
# Trigger mega-linter at every push. Action will also be visible from Pull Requests to main
push: # Comment this line to trigger action only on pull-requests (not recommended if you don't pay for GH Actions)
pull_request:
branches: [master, main]
env: # Comment env block if you don't want to apply fixes
# Apply linter fixes configuration
APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool)
APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all)
APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request)
concurrency:
group: ${{ github.ref }}-${{ github.workflow }}
cancel-in-progress: true
permissions: {}
jobs:
megalinter:
name: MegaLinter
runs-on: ubuntu-latest
permissions:
# Give the default GITHUB_TOKEN write permission to commit and push, comment issues & post new PR
# Remove the ones you do not need
contents: write
issues: write
pull-requests: write
steps:
# Git Checkout
- name: Checkout Code
uses: actions/checkout@v6
with:
# SECURITY NOTE: Using a Personal Access Token (PAT) is NOT
# recommended. Open-source projects have been heavily targeted by
# supply-chain attacks in recent months, and a leaked PAT can give
# attackers broad write access to your repository: better safe
# than sorry! If you only need workflows to re-trigger after
# MegaLinter applies fixes, prefer one of these safer alternatives:
# - Manually re-run the workflow from the GitHub Actions tab, or
# - Push another commit on the branch to trigger workflows again.
# Only define `secrets.PAT` if you fully understand the trade-off.
token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
persist-credentials: false # Comment this line and uncomment the next one if you use APPLY_FIXES
# persist-credentials: true # zizmor: ignore[artipacked]
fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances
# MegaLinter
- name: MegaLinter
id: ml
# You can override MegaLinter flavor used to have faster performances
# More info at https://megalinter.io/flavors/
# MAJOR-RELEASE-IMPACTED
uses: oxsecurity/megalinter@v10
env:
# All available variables are described in documentation
# https://megalinter.io/configuration/
VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# ADD YOUR CUSTOM ENV VARIABLES HERE OR DEFINE THEM IN A FILE .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY
# DISABLE: COPYPASTE,SPELL # Uncomment to disable copy-paste and spell checks
# Upload MegaLinter artifacts
- name: Archive production artifacts
if: success() || failure()
uses: actions/upload-artifact@v7
with:
name: MegaLinter reports
include-hidden-files: "true"
path: |
megalinter-reports
mega-linter.log
# Create pull request if applicable (for now works only on PR from same repository, not from forks)
- name: Create Pull Request with applied fixes
id: cpr
if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
uses: peter-evans/create-pull-request@v8
with:
# SECURITY NOTE: see the warning on the checkout step above —
# using `secrets.PAT` is NOT recommended for security reasons.
# Prefer manually re-running the workflow or pushing another
# commit on the branch to trigger workflows again.
token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
commit-message: "[MegaLinter] Apply linters automatic fixes"
title: "[MegaLinter] Apply linters automatic fixes"
labels: bot
- name: Create PR output
if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
env:
PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
run: |
echo "Pull Request Number - ${PR_NUMBER}"
echo "Pull Request URL - ${PR_URL}"
# Push new commit if applicable (for now works only on PR from same repository, not from forks)
- name: Prepare commit
if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
run: sudo chown -Rc $UID .git/
- name: Commit and push applied linter fixes
if: steps.ml.outputs.has_updated_sources == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
uses: stefanzweifel/git-auto-commit-action@v7
with:
branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
commit_message: "[MegaLinter] Apply linters fixes"
commit_user_name: megalinter-bot
commit_user_email: 129584137+megalinter-bot@users.noreply.github.com
```
### GitLab CI
Create or update `.gitlab-ci.yml` file at the root of your repository
```yaml
# MegaLinter GitLab CI job configuration file
# More info at https://megalinter.io/
mega-linter:
stage: test
# You can override MegaLinter flavor used to have faster performances
# More info at https://megalinter.io/flavors/
image: ghcr.io/oxsecurity/megalinter:v10
script: [ "true" ] # if script: ["true"] doesn't work, you may try -> script: [ "/bin/bash /entrypoint.sh" ]
variables:
# All available variables are described in documentation
# https://megalinter.io/configuration/
DEFAULT_WORKSPACE: $CI_PROJECT_DIR
# ADD YOUR CUSTOM ENV VARIABLES HERE TO OVERRIDE VALUES OF .mega-linter.yml AT THE ROOT OF YOUR REPOSITORY
artifacts:
when: always
paths:
- megalinter-reports
expire_in: 1 week
```
Create a Gitlab access token and define it in a variable **GITLAB_ACCESS_TOKEN_MEGALINTER** in the project CI/CD masked variables. Make sure your token (e.g. if a project token) as the appropriate [role](https://docs.gitlab.com/ee/user/permissions.html) for commenting a merge request (at least developer).
### Azure Pipelines
Use the following Azure Pipelines [YAML template](https://docs.microsoft.com/en-us/azure/devops/pipelines/yaml-schema)
You can configure a [build validation](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser#build-validation) branch policy against a single repository or across all repositories. If you configure across all repositories then your pipeline is stored in a central repository.
#### Single Repository
Add the following to an `azure-pipelines.yaml` file within your code repository:
```yaml
# Run MegaLinter to detect linting and security issues
- job: MegaLinter
pool:
vmImage: ubuntu-latest
steps:
# Checkout repo
- checkout: self
# Pull MegaLinter docker image
- script: docker pull ghcr.io/oxsecurity/megalinter:v10
displayName: Pull MegaLinter
# Run MegaLinter
- script: |
docker run -v $(System.DefaultWorkingDirectory):/tmp/lint \
--env-file <(env | grep -e SYSTEM_ -e BUILD_ -e TF_ -e AGENT_) \
-e SYSTEM_ACCESSTOKEN=$(System.AccessToken) \
-e GIT_AUTHORIZATION_BEARER=$(System.AccessToken) \
ghcr.io/oxsecurity/megalinter:v10
displayName: Run MegaLinter
# Upload MegaLinter reports
- task: PublishPipelineArtifact@1
condition: succeededOrFailed()
displayName: Upload MegaLinter reports
inputs:
targetPath: "$(System.DefaultWorkingDirectory)/megalinter-reports/"
artifactName: MegaLinterReport
```
#### Central Repository
Add the following to an `azure-pipelines.yaml` file within a separate repository, for example a 'MegaLinter' repository:
```yaml
# Run MegaLinter to detect linting and security issues
trigger: none
pool:
vmImage: ubuntu-latest
variables:
repoName: $[ replace(split(variables['System.PullRequest.SourceRepositoryURI'], '/')[6], '%20', ' ') ]
steps:
# Checkout triggering repo
- checkout: git://$(System.TeamProject)/$(repoName)@$(System.PullRequest.SourceBranch)
displayName: Checkout Triggering Repository
# Pull MegaLinter docker image
- script: docker pull ghcr.io/oxsecurity/megalinter:v10
displayName: Pull MegaLinter
# Run MegaLinter
- script: |
docker run -v $(System.DefaultWorkingDirectory):/tmp/lint \
--env-file <(env | grep -e SYSTEM_ -e BUILD_ -e TF_ -e AGENT_) \
-e SYSTEM_ACCESSTOKEN=$(System.AccessToken) \
-e GIT_AUTHORIZATION_BEARER=$(System.AccessToken) \
ghcr.io/oxsecurity/megalinter:v10
displayName: Run MegaLinter
# Upload MegaLinter reports
- task: PublishPipelineArtifact@1
condition: succeededOrFailed()
displayName: MegaLinter Report
inputs:
targetPath: $(System.DefaultWorkingDirectory)/megalinter-reports/
artifactName: MegaLinterReport
```
#### Pull Request Comments
To enable Pull Request comments, follow the [configuration instructions](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/AzureCommentReporter.md).
Note: If your pipelines run on Azure DevOps but your source code is hosted on GitHub, and you want status reports to appear on GitHub, you must provide additional repository information to the pipeline. See this [example](https://github.com/firedigger/megalinter-azure-pipelines-with-github-repository) for guidance.
#### Detailed Tutorial
You can also follow this [detailed tutorial](https://github.com/DonKoning/megaLinter) by [DonKoning](https://github.com/DonKoning).
#### Alternative: Azure DevOps Extension (Community)
> **Note:** This is a community-maintained extension and is **not** affiliated with or maintained by the MegaLinter team.
As an alternative to the manual Docker configuration above, the community-maintained [megalinter-ado](https://marketplace.visualstudio.com/items?itemName=DownAtTheBottomOfTheMoleHole.megalinter-ado) Azure DevOps extension provides a native Azure Pipelines task for running MegaLinter.
Install from the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=DownAtTheBottomOfTheMoleHole.megalinter-ado), then add the task to your pipeline:
```yaml
- task: MegaLinter@1
displayName: Run MegaLinter
inputs:
flavor: all
fix: true
createFixPR: true
env:
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
```
See the [extension repository](https://github.com/DownAtTheBottomOfTheMoleHole/megalinter-ado) for full configuration options.
### Bitbucket Pipelines
1. Create a `bitbucket-pipelines.yml` file at the root of your repository.
2. Copy and paste the following template or add the step to your existing pipeline.
```yaml
image: atlassian/default-image:3
pipelines:
default:
- parallel:
- step:
name: Run MegaLinter
image: ghcr.io/oxsecurity/megalinter:v10
script:
- export DEFAULT_WORKSPACE=$BITBUCKET_CLONE_DIR && bash /entrypoint.sh
artifacts:
- megalinter-reports/**
```
### Jenkins
Add the following stage to your Jenkinsfile.
You may activate the [File.io reporter](https://megalinter.io/reporters/FileIoReporter/) or [Email reporter](https://megalinter.io/reporters/EmailReporter/) to access detailed logs and fixed sources.
```groovy
// Lint with MegaLinter: https://megalinter.io/
stage('MegaLinter') {
agent {
docker {
image 'ghcr.io/oxsecurity/megalinter:v10'
args "-u root -e VALIDATE_ALL_CODEBASE=true -v ${WORKSPACE}:/tmp/lint --entrypoint=''"
reuseNode true
}
}
steps {
sh '/entrypoint.sh'
}
post {
always {
archiveArtifacts allowEmptyArchive: true, artifacts: 'mega-linter.log,megalinter-reports/**/*', defaultExcludes: false, followSymlinks: false
}
}
}
```
CloudBees has a helpful tutorial about how to use MegaLinter with Jenkins!
### PR Comment Reporting from Jenkins
When MegaLinter runs from a **Jenkins Multibranch Pipeline**, it can automatically post results as comments on pull requests / merge requests hosted on GitHub, GitLab, Azure DevOps, or Bitbucket.
MegaLinter auto-detects the git hosting platform by inspecting the `GIT_URL` environment variable (provided by Jenkins Git plugin). It then maps Jenkins environment variables (`CHANGE_ID`, `GIT_COMMIT`, `BUILD_URL`, etc.) to the native CI variables each comment reporter expects.
#### Requirements
- **Jenkins Multibranch Pipeline** with the appropriate Branch Source plugin (GitHub Branch Source, GitLab Branch Source, or Bitbucket Branch Source)
- The pipeline must be triggered by a **pull request / merge request** (so `CHANGE_ID` is set by Jenkins)
- An **authentication token** for the target platform, stored as a Jenkins credential
#### Platform Configuration
| Platform | Required Token Variable | Notes |
|--------------|----------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| GitHub | `GITHUB_TOKEN` (recommended) — `PAT` only if strictly required | Prefer `GITHUB_TOKEN`. Personal Access Tokens (PAT) are **not recommended** due to recent supply-chain attacks on open-source projects; a leaked PAT can give attackers broad write access to your repository. Token needs `repo` scope (or `issues:write` + `pull-requests:write` for fine-grained tokens). |
| GitLab | `GITLAB_ACCESS_TOKEN_MEGALINTER` | Personal access token with `api` scope |
| Azure DevOps | `SYSTEM_ACCESSTOKEN` | Personal access token with **Code (Read & Write)** permission |
| Bitbucket | `BITBUCKET_REPO_ACCESS_TOKEN` | Repository access token with **Pull-requests: Write** scope |
#### Jenkinsfile Example with GitHub PR Comments
```groovy
// Lint with MegaLinter: https://megalinter.io/
stage('MegaLinter') {
agent {
docker {
image 'ghcr.io/oxsecurity/megalinter:v10'
args "-u root -e VALIDATE_ALL_CODEBASE=true -v ${WORKSPACE}:/tmp/lint --entrypoint=''"
reuseNode true
}
}
environment {
GITHUB_TOKEN = credentials('github-token')
}
steps {
sh '/entrypoint.sh'
}
post {
always {
archiveArtifacts allowEmptyArchive: true, artifacts: 'mega-linter.log,megalinter-reports/**/*', defaultExcludes: false, followSymlinks: false
}
}
}
```
#### Self-hosted / On-premise Platforms
MegaLinter detects the platform by looking for keywords in the `GIT_URL` hostname (e.g., `gitlab.mycompany.com` is detected as GitLab, `github.internal.corp.com` as GitHub).
If your self-hosted instance uses a hostname without the platform name (e.g., `git.mycompany.com`), set the `JENKINS_REPO_PLATFORM` environment variable to explicitly tell MegaLinter which platform to use:
```groovy
environment {
JENKINS_REPO_PLATFORM = 'gitlab' // or 'github', 'azure', 'bitbucket'
GITLAB_ACCESS_TOKEN_MEGALINTER = credentials('gitlab-token')
}
```
#### Additional Variables
For most setups, MegaLinter derives all needed variables automatically. In rare cases, you may need to set additional platform-specific variables:
- **GitLab**: Set `CI_PROJECT_ID` if the project path cannot be parsed from `GIT_URL`
- **Azure DevOps**: Set `SYSTEM_ACCESSTOKEN` as a Jenkins credential
### Concourse
#### Pipeline step
Use the following job step in your pipeline template.
Note: Make sure you have a `job.plan.get` step that retrieves the `repo` containing your repository, as shown in the example.
```yaml
---
- name: linting
plan:
- get: repo
- task: linting
config:
platform: linux
image_resource:
type: docker-image
source:
repository: oxsecurity/megalinter
tag: v10
inputs:
- name: repo
run:
path: bash
args:
- -cxe
- |
cd repo
export DEFAULT_WORKSPACE=$(pwd)
bash -ex /entrypoint.sh
## doing this because concourse doesn't work as other CI systems
# params:
# PARALLEL: true
# DISABLE: SPELL
# APPLY_FIXES: all
# DISABLE_ERRORS: true
# VALIDATE_ALL_CODEBASE: true
```
OR
#### Use it as a reusable task
Create a reusable Concourse task that can be used with multiple pipelines.
1. Create task file `task-linting.yaml`
```yaml
---
platform: linux
image_resource:
type: docker-image
source:
repository: oxsecurity/megalinter
tag: v10
inputs:
- name: repo
## uncomment this if you want reports as task output
# output:
# - name: reports
# path: repo/megalinter-reports
run:
path: bash
args:
- -cxe
- |
cd repo
export DEFAULT_WORKSPACE=$(pwd)
bash -ex /entrypoint.sh
```
2. Use that `task-linting.yaml` task in your pipeline.
Note:
1. Make sure `task-linting.yaml` is available in the `repo` input at the repository root.
2. Task `output` is **not** shown here.
```yaml
resources:
- name: linting
plan:
- get: repo
- task: linting
file: repo/task-linting.yaml
# params:
# PARALLEL: true
# DISABLE: SPELL
# APPLY_FIXES: all
# DISABLE_ERRORS: true
# VALIDATE_ALL_CODEBASE: true
```
### Drone CI
Warning: Drone CI support is experimental and is undergoing significant modifications (see issue [#2047](https://github.com/oxsecurity/megalinter/issues/2047)).
1. Create a `.drone.yml` file on the root directory of your repository
2. Copy and paste the following template:
```yaml
kind: pipeline
type: docker
name: MegaLinter
workspace:
path: /tmp/lint
steps:
- name: megalinter
image: ghcr.io/oxsecurity/megalinter:v10
environment:
DEFAULT_WORKSPACE: /tmp/lint
```
This uses the [Drone CI Docker runner](https://docs.drone.io/pipeline/docker/overview/), so you need to install and configure it beforehand on your Drone CI server.
#### (Optional) Adjusting trigger rules
The Drone CI workflow should trigger automatically for most scenarios (push, pull request, sync…). However, you can optionally change this behavior by modifying the trigger. For example:
```yaml
kind: pipeline
type: docker
name: MegaLinter
workspace:
path: /tmp/lint
steps:
- name: megalinter
image: ghcr.io/oxsecurity/megalinter:v10
environment:
DEFAULT_WORKSPACE: /tmp/lint
trigger:
event:
- push
```
The workflow above triggers only on push, and not in other situations. For more information about configuring Drone CI trigger rules, see the [documentation](https://docs.drone.io/pipeline/triggers/).
### Docker container
You can also run MegaLinter with its Docker container. Execute this command:
`docker run --rm -v /var/run/docker.sock:/var/run/docker.sock:rw -v $(pwd):/tmp/lint:rw ghcr.io/oxsecurity/megalinter:v10`
No extra arguments are needed; however, MegaLinter will lint all files inside the `/tmp/lint` folder. You may need to configure your tool of choice to use `/tmp/lint` as its workspace.
This can be changed:
_Example:_
`docker run --rm -v /var/run/docker.sock:/var/run/docker.sock:rw -v $(pwd):/example/folder:rw ghcr.io/oxsecurity/megalinter:v10`
### Run MegaLinter locally
[](https://npmjs.org/package/mega-linter-runner)
[](https://npmjs.org/package/mega-linter-runner)
[](https://npmjs.org/package/mega-linter-runner)
Use [mega-linter-runner](https://megalinter.io/mega-linter-runner/) to run MegaLinter locally with the same configuration defined in your [.mega-linter.yml](https://github.com/oxsecurity/megalinter/tree/main/docs/config-file.md) file.
See the [mega-linter-runner installation instructions](https://megalinter.io/mega-linter-runner/#installation).
Example:
```shell
npx mega-linter-runner --flavor salesforce -e "'ENABLE=DOCKERFILE,MARKDOWN,YAML'" -e 'SHOW_ELAPSED_TIME=true'
```
Note: You can also use this command line in your custom CI/CD pipelines.
## Configuration
### .mega-linter.yml file
MegaLinter configuration variables are defined in a **.mega-linter.yml** file at the root of the repository or with **environment variables**.
You can see an example config file in this repo: [**.mega-linter.yml**](https://github.com/oxsecurity/megalinter/blob/main/.mega-linter.yml).
Configuration is assisted with autocompletion and validation in most commonly used IDEs, thanks to the [JSON schema](https://megalinter.io/json-schemas/configuration.html) stored on [schemastore.org](https://www.schemastore.org/).
- VS Code: You need an extension like [Red Hat YAML](https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml).
- IntelliJ IDEA family: Autocompletion is supported natively.
You can also define variables as environment variables.
- If a variable exists in both ENV and the `.mega-linter.yml` file, priority is given to the ENV variable.
### Common variables
| **ENV VAR** | **Default Value** | **Notes** |
|---------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **ADDITIONAL_EXCLUDED_DIRECTORIES** | \[\] | List of additional excluded directory basenames. They're excluded at any nested level. |
| [**APPLY_FIXES**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-apply-fixes.md) | `none` | Activates formatting and autofix [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-apply-fixes.md) |
| **CLEAR_REPORT_FOLDER** | `false` | Flag to clear files from report folder (usually megalinter-reports) before starting the linting process |
| **CONFIG_PROPERTIES_TO_APPEND** | \[\] | List of configuration properties to append their values (instead of replacing them) in case of using EXTENDS. |
| **DEFAULT_BRANCH** | `HEAD` | The name of the repository's default branch, useful if you use VALIDATE_ALL_CODEBASE=false |
| **DEFAULT_WORKSPACE** | `/tmp/lint` | The location containing files to lint if you are running locally. |
| **DISABLE_ERRORS** | `false` | Flag to have the linter complete with exit code 0 even if errors were detected. |
| [**DISABLE**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) | | List of disabled descriptors keys [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) |
| [**DISABLE_LINTERS**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) | | List of disabled linters keys [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) |
| [**DISABLE_ERRORS_LINTERS**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) | | List of enabled but not blocking linters keys. All linters not in this list will be not blocking [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) |
| [**ENABLE_ERRORS_LINTERS**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) | | List of enabled and blocking linters keys [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) |
| [**ENABLE**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) | | List of enabled descriptors keys [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) |
| [**ENABLE_LINTERS**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) | | List of enabled linters keys [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-activation.md) |
| **EXCLUDED_DIRECTORIES** | \[…many values…\] | List of excluded directory basenames. They're excluded at any nested level. |
| **EXTENDS** | | Base `mega-linter.yml` config file(s) to extend local configuration from. Can be a single URL or a list of `.mega-linter.yml` config files URLs. Later files take precedence. |
| **FAIL_IF_MISSING_LINTER_IN_FLAVOR** | `false` | If set to `true`, MegaLinter fails if a linter is missing in the selected flavor |
| **FAIL_IF_UPDATED_SOURCES** | `false` | If set to `true`, MegaLinter fails if a linter or formatter has autofixed sources, even if there are no errors |
| [**FILTER_REGEX_EXCLUDE**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-filtering.md) | `none` | Regular expression defining which files will be excluded from linting [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-filtering.md) .ex: `.*src/test.*`) |
| [**FILTER_REGEX_INCLUDE**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-filtering.md) | `all` | Regular expression defining which files will be processed by linters [(more info)](https://github.com/oxsecurity/megalinter/tree/main/docs/config-filtering.md) .ex: `.*src/.*`) |
| **FLAVOR_SUGGESTIONS** | `true` | Provides suggestions about different MegaLinter flavors to use to improve runtime performances |
| **FORMATTERS_DISABLE_ERRORS** | `true` | Formatter errors will be reported as errors (not warnings) if this variable is set to `false`. |
| **GIT_AUTHORIZATION_BEARER** | | If set, calls git with **`Authorization: Bearer`+value** |
| **GITHUB_WORKSPACE** | | Base directory for `REPORT_OUTPUT_FOLDER`, for user-defined linter rules location, for location of linted files if `DEFAULT_WORKSPACE` isn't set |
| **IGNORE_GENERATED_FILES** | `false` | If set to `true`, MegaLinter will skip files containing `@generated` marker but without `@not-generated` marker (more info at [https://generated.at](https://generated.at/)) |
| **IGNORE_GITIGNORED_FILES** | `true` | If set to `true`, MegaLinter will skip files ignored by Git using the `.gitignore` file. |
| **JAVASCRIPT_DEFAULT_STYLE** | `standard` | Javascript default style to check/apply. `standard`,`prettier` |
| **LINTER_RULES_PATH** | `.github/linters` | Directory for all linter configuration rules. Can be a local folder or a remote URL (e.g., `https://raw.githubusercontent.com/some_org/some_repo/mega-linter-rules`). |
| **LINTER_TIMEOUT_SECONDS** | `300` | Maximum duration in seconds of each linter run. When elapsed, the linter process and its child processes are killed and reported as an error (exit code 124), and the other linters keep running. Override for a single linter with `_TIMEOUT_SECONDS` (ex: `REPOSITORY_CHECKOV_TIMEOUT_SECONDS`). Set `0` to disable the timeout. |
| **LOG_FILE** | `mega-linter.log` | The file name for outputting logs. All output is sent to the log file regardless of `LOG_LEVEL`. Use `none` to not generate this file. |
| **LOG_LEVEL** | `INFO` | How much output the script will generate to the console. One of `INFO`, `DEBUG`, `WARNING` or `ERROR`. |
| **MARKDOWN_DEFAULT_STYLE** | `markdownlint` | Markdown default style to check/apply. `markdownlint`, `rumdl` |
| **MEGALINTER_CONFIG** | `.mega-linter.yml` | Name of MegaLinter configuration file. Can be defined remotely, in that case set this environment variable with the remote URL of `.mega-linter.yml` config file |
| **MEGALINTER_FILES_TO_LINT** | \[\] | Comma-separated list of files to analyze. Using this variable will bypass other file listing methods |
| **PARALLEL** | `true` | Process linters in parallel to improve overall MegaLinter performance. If true, linters of same language or formats are grouped in the same parallel process to avoid lock issues if fixing the same files |
| **PARALLEL_PROCESS_NUMBER** | | All available cores are used by default. If there are too many, decrease the number of used cores to enhance performance (example: `4`). |
| [**PLUGINS**](#plugins) | \[\] | List of plugin urls to install and run during MegaLinter run |
| [**POST_COMMANDS**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-postcommands.md) | \[\] | Custom bash commands to run after linters |
| [**PRE_COMMANDS**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-precommands.md) | \[\] | Custom bash commands to run before linters |
| **PRINT_ALPACA** | `true` | Enable printing alpaca image to console |
| **PRINT_ALL_FILES** | `false` | Display all files analyzed by the linter instead of only the number. |
| **PYTHON_DEFAULT_STYLE** | `black` | Python default style to check/apply. `black`,`ruff` |
| **REPORT_OUTPUT_FOLDER** | `${GITHUB_WORKSPACE}/megalinter-reports` | Directory for generating report files. Set to `none` to skip generating reports. |
| [**SECURED_ENV_VARIABLES**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-variables-security.md) | \[\] | Additional list of secured environment variables to hide when calling linters. |
| [**SECURED_ENV_VARIABLES_DEFAULT**](https://github.com/oxsecurity/megalinter/tree/main/docs/config-variables-security.md) | MegaLinter & CI platforms sensitive variables | List of secured environment variables to hide when calling linters. [Default list](https://github.com/oxsecurity/megalinter/tree/main/docs/config-variables-security.md). This is not recommended to override this variable, use SECURED_ENV_VARIABLES |
| **SHOW_ELAPSED_TIME** | `false` | Displays elapsed time in reports |
| **SHOW_SKIPPED_LINTERS** | `true` | Displays all disabled linters MegaLinter could have run. |
| **SKIP_CLI_LINT_MODES** | \[\] | Comma-separated list of cli_lint_modes. To use if you want to skip linters with some CLI lint modes (ex: `file,project`). Available values: `file`,`cli_lint_mode`,`project`. |
| **SKIP_LINTER_OUTPUT_SANITIZATION** | `false` | By default, MegaLinter sanitizes the output of every external command using betterleaks public rules. If you are on a private and secured repo, you can improve performances by setting this variable to `true`, but it will mean that if a linter output contains a secret, it will be visible in log files |
| **TYPESCRIPT_DEFAULT_STYLE** | `standard` | Typescript default style to check/apply. `standard`,`prettier` |
| **VALIDATE_ALL_CODEBASE** | `true` | Will parse the entire repository and find all files to validate across all types. **NOTE:** When set to `false`, only **new** or **edited** files will be parsed for validation. |
#### Linters timeout
By default, a linter still running after **5 minutes** (`LINTER_TIMEOUT_SECONDS: 300`) is killed with all its child processes and reported as an error (exit code 124), while the other linters keep running. Raise the limit, override it per linter, or disable it with `0`:
```yaml
LINTER_TIMEOUT_SECONDS: 3600 # Kill any linter still running after 1 hour
REPOSITORY_CHECKOV_TIMEOUT_SECONDS: 900 # Per-linter override
SPELL_LYCHEE_TIMEOUT_SECONDS: 0 # No timeout for this linter
```
A timeout hit with very low CPU usage usually means an I/O stall (for example a workspace bind-mounted from Windows into a WSL2-backed container engine), not a repository that really needs more time.
### Activation and deactivation
MegaLinter has all linters enabled by default, but allows enabling or disabling specific ones.
- If `ENABLE` isn't set, all descriptors are activated by default. If set, all linters of listed descriptors are activated by default.
- If `ENABLE_LINTERS` is set, only the listed linters are processed.
- If `DISABLE` is set, the linters in the listed descriptors are skipped.
- If `DISABLE_LINTERS` is set, the listed linters are skipped.
- If a linter is in both `ENABLE_LINTERS` and `DISABLE_LINTERS`, `ENABLE_LINTERS` wins by default. Set `ENABLE_DISABLE_LINTERS_PRIORITY: DISABLE` to make `DISABLE_LINTERS` override `ENABLE_LINTERS` instead (useful to trim an inherited `ENABLE_LINTERS` list when using `EXTENDS`).
- If `DISABLE_ERRORS_LINTERS` is set, the listed linters will run, but if errors are found, they will be considered non-blocking.
- If `ENABLE_ERRORS_LINTERS` is set, only the linters in this list will be considered blocking.
Examples:
- Run all javascript and groovy linters except STANDARD javascript linter. DevSkim errors will be non-blocking
```yaml
ENABLE: JAVASCRIPT,GROOVY
DISABLE_LINTERS: JAVASCRIPT_STANDARD
DISABLE_ERRORS_LINTERS: REPOSITORY_DEVSKIM
```
- Run all matching linters but only trivy is blocking
```yaml
ENABLE_ERRORS_LINTERS: REPOSITORY_TRIVY
```
- Run all linters except PHP linters (PHP_BUILTIN, PHP_PHPCS, PHP_PHPSTAN, PHP_PSALM)
```yaml
DISABLE: PHP
```
- Run all linters except PHP_PHPSTAN and PHP_PSALM linters
```yaml
DISABLE_LINTERS:
- PHP_PHPSTAN
- PHP_PSALM
```
- Inherit a shared `ENABLE_LINTERS` list via `EXTENDS` but skip one of the inherited linters locally
```yaml
EXTENDS: https://example.com/shared/.mega-linter.yml
ENABLE_DISABLE_LINTERS_PRIORITY: DISABLE
DISABLE_LINTERS:
- PYTHON_PYLINT
```
### Filter linted files
If you need to lint only a folder or exclude some files from linting, you can use the optional environment parameters `FILTER_REGEX_INCLUDE` and `FILTER_REGEX_EXCLUDE`.
You can apply filters to a single linter by defining the variables `_FILTER_REGEX_INCLUDE` and `_FILTER_REGEX_EXCLUDE`.
Examples:
- Lint only src folder: `FILTER_REGEX_INCLUDE: (src/)`
- Don't lint files inside test and example folders: `FILTER_REGEX_EXCLUDE: (test/|examples/)`
- Don't lint javascript files inside test folder: `FILTER_REGEX_EXCLUDE: (test/.*\.js)`
Warning: Not applicable with linters using CLI lint mode `project` ([see details](https://github.com/oxsecurity/megalinter/tree/main/docs/config-cli-lint-mode.md)).
You can also use variable **ADDITIONAL_EXCLUDED_DIRECTORIES** to add more excluded directories
Example:
```yaml
ADDITIONAL_EXCLUDED_DIRECTORIES:
- .wireit
- dist
- build
- vendor
```
### Apply fixes
MegaLinter can apply fixes provided by linters. To use this capability, you need three environment variables defined at the top level.
- **APPLY_FIXES**: `all` to apply fixes of all linters, or a list of linter keys (ex: `JAVASCRIPT_ES`,`MARKDOWN_MARKDOWNLINT`)
Only for the GitHub Actions workflow file, if you use it:
- **APPLY_FIXES_EVENT**: `all`, `push`, `pull_request`, `none` _(use none in case of use of [Updated sources reporter](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/UpdatedSourcesReporter.md))_
- **APPLY_FIXES_MODE**: `commit` to create a new commit and push it on the same branch, or `pull_request` to create a new PR targeting the branch.
#### Apply fixes issues
You may see GitHub permission errors, or workflows not running on the new commit.
> **Security warning — Personal Access Tokens (PAT) are NOT recommended.**
> Open-source projects have been heavily targeted by supply-chain attacks in recent months, and a leaked or compromised PAT can give attackers broad write access to your repository — better safe than sorry!
> Before adding a `PAT` secret, ask yourself if you really need workflows to re-trigger automatically after MegaLinter pushes a fix commit. In most cases the simpler and safer workaround is enough:
>
> - **Manually re-run the failed workflow** from the GitHub Actions tab, or
> - **Push another commit** on the branch (even an empty one: `git commit --allow-empty -m "trigger CI"`) so GitHub re-runs the workflows.
>
> Only set up a PAT if you fully understand the trade-off. If you do, use a **fine-grained token scoped to a single repository** with the **minimum required permissions**, and rotate it regularly.
To solve these issues, apply one of the following solutions.
- Method 1: The most secured (still discouraged — read the warning above)
- [Create a Fine-Grained Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-fine-grained-personal-access-token), scoped only to your repository and with **Contents: Read/Write**, then copy the PAT value
- [Define environment secret variable](https://docs.github.com/en/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-an-environment) named **PAT** on your repository, and paste the PAT value
- Update your GitHub Actions workflow to add the environment name
-- Method 2: Easier, but **strongly discouraged** — any contributor with write access can see your Personal Access Token, so use it only on private repositories.
- [Create a Classic Personal Access Token](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token#creating-a-token), then copy the PAT value
- [Define secret variable](https://docs.github.com/en/free-pro-team@latest/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository) named **PAT** on your repository, and paste the PAT value
#### Notes
- You can use the [Updated sources reporter](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/UpdatedSourcesReporter.md) if you don't want fixes to be automatically applied on the Git branch. Instead, download them in a ZIP file and manually extract them into your project.
- If used, `APPLY_FIXES_EVENT` and `APPLY_FIXES_MODE` cannot be defined in the `.mega-linter.yml` config file; they must be set as environment variables.
- If you use `APPLY_FIXES`, add the following line to your `.gitignore` file:
```shell
megalinter-reports/
```
### Linter specific variables
See variables related to a single linter behavior in [linters documentations](#supported-linters)
### Pre-commands
MegaLinter can run custom commands before running linters (for example, installing a plugin required by one of the linters you use).
Example in `.mega-linter.yml` config file
```yaml
PRE_COMMANDS:
- command: npm install eslint-plugin-whatever
cwd: root # Will be run at the root of the MegaLinter Docker image
secured_env: true # True by default. If set to false, no global variables will be hidden (for example, if you need GITHUB_TOKEN)
run_before_linters: True # Will be run before the execution of the linters themselves; required for npm/pip commands that cannot be run in parallel
- command: echo "pre-test command has been called"
cwd: workspace # Will be run at the root of the workspace (usually your repository root)
continue_if_failed: False # Will stop the process if the command fails (return code > 0)
- command: pip install flake8-cognitive-complexity
venv: flake8 # Will be run within the flake8 Python virtualenv. There is one virtualenv per Python-based linter, with the same name
- command: export MY_OUTPUT_VAR="my output var" && export MY_OUTPUT_VAR2="my output var2"
output_variables: ["MY_OUTPUT_VAR","MY_OUTPUT_VAR2"] # Will collect the values of output variables and update MegaLinter's own ENV context
- command: echo "Command using another ENV variable value"
replacement_env_vars: # Copies the value of MY_SECRET_VAR into GITHUB_TOKEN, for this command only
- var_src: MY_SECRET_VAR
var_dest: GITHUB_TOKEN
- command: echo "Some command called before loading MegaLinter plugins"
cwd: workspace # Will be run at the root of the workspace (usually your repository root)
continue_if_failed: False # Will stop the process if the command fails (return code > 0)
tag: before_plugins # Tag indicating that the command will be run before loading plugins
- command: echo "Some command called after running MegaLinter linters"
run_after_linters: True # Will be run after the execution of the linters themselves
```
> **Note**: to keep them lightweight, MegaLinter images do not embed a compilation toolchain. If a pre-command needs to compile native code (e.g. a pip package distributed only as source), install the toolchain first within your pre-command: `apk add --no-cache gcc make musl-dev`.
| Property | Description | Default value |
|--------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|
| **command** | Command line to run | Mandatory |
| **cwd** | Directory where to run the command (`workspace` or `root`) | `root` |
| **run_before_linters** | If set to `true`, runs the command before the execution of the linters themselves, required for npm/pip commands that cannot be run in parallel | `false` |
| **run_after_linters** | If set to `true`, runs the command after the execution of the linters themselves | `false` |
| **secured_env** | Apply filtering of secured environment variables before calling the command (default true). Be careful if you disable it! | `true` |
| **continue_if_failed** | If set to `false`, stop the MegaLinter process in case of command failure | `true` |
| **venv** | If set, runs the command in the related Python venv | |
| **output_variables** | ENV variables to read from output after running the commands, and store in MegaLinter's ENV context so they can be reused in subsequent commands | `[]` |
| **replacement_env_vars** | ENV variables to copy into other ENV variables, for the scope of this command only. Each item contains `var_src` and `var_dest`. Values are read from MegaLinter configuration, so secured env variables are sent to the command | `[]` |
| **tag** | Tag defining at which command entry point the command will be run (available tags: `before_plugins`) | |
### Post-commands
MegaLinter can run custom commands after running linters (for example, running additional tests).
Example in `.mega-linter.yml` config file
```yaml
POST_COMMANDS:
- command: npm run test
cwd: "workspace" # Will be run at the root of the workspace (usually your repository root)
continue_if_failed: False # Will stop the process if the command fails (return code > 0)
```
### Environment variables security
#### Secured env variables
MegaLinter runs in a Docker image and calls the linters via the command line to gather their results.
If you run it from your **CI/CD pipelines**, the Docker image may have **access to your environment variables, which can contain secrets** defined in CI/CD variables.
As it can be complicated to fully trust the authors of all open-source linters, **MegaLinter removes variables from the environment used to call linters**.
Thanks to this feature, you only need to [trust MegaLinter and its internal Python dependencies](https://github.com/oxsecurity/megalinter/blob/main/pyproject.toml); there is no need to trust all the linters that are used.
You can add secured variables to the default list using the configuration property `SECURED_ENV_VARIABLES` in `.mega-linter.yml` or as an environment variable (priority is given to ENV variables over the `.mega-linter.yml` property).
Values can be:
- String (ex: `MY_SECRET_VAR`)
- Regular Expression (ex: `(MY.*VAR)`)
Environment variables are secured for each command line called (linters, plugins, SARIF formatter, etc.) except for [PRE_COMMANDS](https://github.com/oxsecurity/megalinter/tree/main/docs/config-precommands.md), and only if you define `secured_env: false` in the command.
#### Secured configuration examples
- Example of adding extra secured variables in `.mega-linter.yml`:
```yaml
SECURED_ENV_VARIABLES:
- MY_SECRET_TOKEN
- ANOTHER_VAR_CONTAINING_SENSITIVE_DATA
- OX_API_KEY
- (MY.*VAR) # Regex format
```
- Example of adding extra secured variables in CI variables, so they cannot be overridden in `.mega-linter.yml`:
```shell
SECURED_ENV_VARIABLES=MY_SECRET_TOKEN,ANOTHER_VAR_CONTAINING_SENSITIVE_DATA,OX_API_KEY
```
#### Default secured variables
If you override `SECURED_ENV_VARIABLES_DEFAULT`, it replaces the default list, so it's better to only define `SECURED_ENV_VARIABLES` to add items to the default list.
SECURED_ENV_VARIABLES_DEFAULT contains exact names and (regular expressions) matching patterns for commonly used sensitive environment variables:
- (^|_)(PAT)($|_)
- SYSTEM_ACCESSTOKEN
- (^|_)(USERNAME)($|_)
- (^|_)(PASSWORD|PASSWD|PASS|PWD)($|_)
- (^|_)(TOKEN|ID_TOKEN|ACCESS_TOKEN|REFRESH_TOKEN|BEARER)($|_)
- (^|_)(SECRET|SECRETS)($|_)
- (^|_)(API_KEY|APP_KEY|CLIENT_ID|CLIENT_SECRET|CLIENT_KEY|SECRET_KEY|ACCESS_KEY|ACCESS_KEY_ID|PRIVATE_KEY|SSH_KEY|SIGNING_KEY|ENCRYPTION_KEY|LICENSE_KEY)($|_)
- (^|_)(AUTH|AUTHORIZATION)($|_)
- (^|_)(CERT|CERTIFICATE|CA_BUNDLE|KUBECONFIG)($|_)
- (^|_)(CONNECTION_STRING|DATABASE_URL|DB_URL|DSN)($|_)
- (GOOGLE_APPLICATION_CREDENTIALS)
- (GCP_SERVICE_ACCOUNT.*)
- (SFDX_CLIENT_ID_.*)
- (SFDX_CLIENT_KEY_.*)
- (^|_)(SLACK|DISCORD|TEAMS|WEBHOOK)_URL($|_)
This compact list is intentionally pattern-based: variables such as `GITHUB_TOKEN`, `CI_JOB_TOKEN`, `NPM_TOKEN`, `GIT_AUTHORIZATION_BEARER`, `AWS_SECRET_ACCESS_KEY`, `AZURE_CLIENT_SECRET`, `OPENAI_API_KEY`, `DOCKER_PASSWORD`, `SMTP_PASSWORD`, `AZURE_PAT`, and `PAT_GITHUB_COM` are hidden through these broader matchers.
#### Security boundaries and threat model
When a linter or plugin command is executed, MegaLinter builds a child-process environment where matched sensitive variables are replaced with `HIDDEN_BY_MEGALINTER`.
This means:
- The original value of a matched environment variable is not accessible from that environment variable entry in the child process.
This does not mean full sandboxing. A malicious dependency can still attempt to collect secrets from other channels, such as:
- Unmatched variables (for example after custom overrides of `SECURED_ENV_VARIABLES_DEFAULT`)
- Variables explicitly unhidden with `(linter-key)_UNSECURED_ENV_VARIABLES`
- Files mounted in the workspace, command arguments, or generated config files
- External credential sources (cloud metadata services, secret managers, network endpoints)
To maximize protection:
- Keep `SECURED_ENV_VARIABLES_DEFAULT` unchanged when possible
- Add your project-specific patterns with `SECURED_ENV_VARIABLES`
- Minimize extra credentials exposed to the MegaLinter runtime
Example (compromised dependency scenario):
- If a linter dependency (for example `axios`) is compromised and executes malicious code, it can read the environment passed to that linter process.
- In that environment, matched variables are already replaced by `HIDDEN_BY_MEGALINTER`.
- So reading `GITHUB_TOKEN`, `NPM_TOKEN`, `OPENAI_API_KEY`, or `AWS_SECRET_ACCESS_KEY` from the process environment returns `HIDDEN_BY_MEGALINTER`, not the original secret value.
- The same attack could still try to obtain secrets from other channels listed above (files, arguments, external services, etc.).
#### Unhide variables for linters
You can configure exceptions for a specific linter by defining `(linter-key)_UNSECURED_ENV_VARIABLES`.
Variable names in this list won't be hidden from the linter commands.
```yaml
TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES:
- GITHUB_TOKEN # Can contain string only, not regex
```
### CLI lint mode
Each linter is preconfigured to use a default lint mode, which is visible in the MegaLinter documentation ([example](https://megalinter.io/latest/descriptors/repository_trivy/#how-the-linting-is-performed)). The possible values are:
- `list_of_files`: The linter is called only once, and passed a list of all the files to be processed
- `project`: The linter is called only once, from the root folder of the repository, and it scans for the files to process, as no file names are provided to it
- `file`: The linter is called once per file, which hurts performance
You can override the CLI_LINT_MODE by using a configuration variable for each linter (see the [linters documentation](https://megalinter.io/supported-linters/)).
- Linters that default to the `file` lint mode cannot be overridden to use the `list_of_files` lint mode.
- Linters that default to the `project` lint mode cannot be overridden to use either the `list_of_files` or `file` lint modes.
Allowing `file` or `list_of_files` to be overridden to `project` is mostly for workarounds. For example, some linters have a problem finding their config file when the current folder isn't the repository root.
Special considerations:
- Linters that are configured to use the `project` lint mode ignore variables like `FILTER_REGEX_INCLUDE` and `FILTER_REGEX_EXCLUDE`, as they are not passed a list of files to lint. For those linters, you must check their documentation to see if a linter can be configured to ignore specific files. For example, the [Secretlint](https://megalinter.io/latest/descriptors/repository_secretlint/) linter ignores files listed in `~/.secretlintignore` by default, or it can be configured to instead ignore files listed in `~/.gitignore` by setting `REPOSITORY_SECRETLINT_ARGUMENTS` to `--secretlintignore .gitignore.`
## Reporters
MegaLinter can generate various reports that you can activate or deactivate and customize.
| Reporter | Description | Default |
|------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------|------------------------------|
| [Text files](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/TextReporter.md) | Generates **One log file by linter** + suggestions for fixes that can not be automated | Active |
| [SARIF (beta)](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/SarifReporter.md) | Generates an aggregated SARIF output file | Inactive |
| [GitHub Pull Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/GitHubCommentReporter.md) | MegaLinter posts a comment on the PR with a summary of lint results, and links to detailed logs | Active if GitHub Action |
| [Gitlab Merge Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/GitlabCommentReporter.md) | Mega-Linter posts a comment on the MR with a summary of lint results, and links to detailed logs | Active if in Gitlab CI |
| [Azure Pipelines Pull Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/AzureCommentReporter.md) | Mega-Linter posts a comment on the PR with a summary of lint results, and links to detailed logs | Active if in Azure Pipelines |
| [Bitbucket Pull Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/BitbucketCommentReporter.md) | Mega-Linter posts a comment on the PR with a summary of lint results, and links to detailed logs | Active if in Bitbucket CI |
| [API (Grafana)](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/ApiReporter.md) | Sends logs and metrics to Grafana endpoint (Loki / Prometheus) | Inactive |
| [Updated sources](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/UpdatedSourcesReporter.md) | Zip containing **all formatted and autofixed sources** so you can extract them in your repository | Active |
| [IDE Configuration](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/ConfigReporter.md) | Apply MegaLinter configuration in your local IDE with linter config files and IDE extensions | Active |
| [GitHub Status](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/GitHubStatusReporter.md) | One GitHub status by linter on the PR, with links to detailed logs | Active if GitHub Action |
| [File.io](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/FileIoReporter.md) | **Send reports on file.io** so you can access them with a simple hyperlink provided at the end of console log | Inactive |
| [JSON](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/JsonReporter.md) | Generates a JSON output report file | Inactive |
| [Email](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/EmailReporter.md) | Receive **all reports on your e-mail**, if you can not use artifacts | Active |
| [TAP files](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/TapReporter.md) | One file by linter following [**Test Anything Protocol**](https://testanything.org/) format | Active |
| [Console](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/ConsoleReporter.md) | **Execution logs** visible in **console** with **summary table** and **links to other reports** at the end | Active |
| [Markdown Summary](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/MarkdownSummaryReporter.md) | Generates a Markdown summary report file | Inactive |
## Flavors
To improve run performance, we provide **flavored MegaLinter images** containing only the linters related to a project type.
- When using the default MegaLinter, if a MegaLinter flavor would cover all your project requirements, a message is added in the logs.
- If your project uses a MegaLinter flavor that doesn't cover linter requirements, an error message will be thrown with instructions on how to solve the issue.
_The following table doesn't display docker pulls from [MegaLinter v4 & v5 images](https://hub.docker.com/r/nvuillam/mega-linter)._
| | Flavor | Description | Embedded linters | Info |
|:--------------------------------------------------------------------------------------------------------------------------------------------------------:|:--------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------|:----------------:|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
| | [all](https://megalinter.io/beta/supported-linters/) | Default MegaLinter Flavor | 133 |   |
| | [c_cpp](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/c_cpp.md) | Optimized for pure C/C++ projects | 59 |   |
| | [ci_light](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/ci_light.md) | Optimized for CI items (Dockerfile, Jenkinsfile, JSON/YAML schemas,XML | 23 |   |
| | [cupcake](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/cupcake.md) | MegaLinter for the most commonly used languages | 99 |   |
| | [documentation](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/documentation.md) | MegaLinter for documentation projects | 52 |   |
| | [dotnet](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/dotnet.md) | Optimized for C, C++, C# or VB based projects | 66 |   |
| | [dotnetweb](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/dotnetweb.md) | Optimized for C, C++, C# or VB based projects with JS/TS | 81 |   |
| | [formatters](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/formatters.md) | Contains only formatters | 20 |   |
| | [go](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/go.md) | Optimized for GO based projects | 54 |   |
| | [java](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/java.md) | Optimized for JAVA based projects | 57 |   |
| | [javascript](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/javascript.md) | Optimized for JAVASCRIPT or TYPESCRIPT based projects | 68 |   |
| | [php](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/php.md) | Optimized for PHP based projects | 57 |   |
| | [python](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/python.md) | Optimized for PYTHON based projects | 69 |   |
| | [ruby](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/ruby.md) | Optimized for RUBY based projects | 53 |   |
| | [rust](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/rust.md) | Optimized for RUST based projects | 53 |   |
| | [salesforce](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/salesforce.md) | Optimized for Salesforce based projects | 58 |   |
| | [security](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/security.md) | Optimized for security | 24 |   |
| | [swift](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/swift.md) | Optimized for SWIFT based projects | 53 |   |
| | [terraform](https://github.com/oxsecurity/megalinter/tree/main/docs/flavors/terraform.md) | Optimized for TERRAFORM based projects | 57 |   |
If you need a new flavor, [post an issue](https://github.com/oxsecurity/megalinter/issues) :wink:
You can also generate your own [custom flavors](https://megalinter.io/beta/custom-flavors/) to include exactly the linters you need in your MegaLinter Docker image.
## Badge
You can show the MegaLinter status with a badge in your repository README.
[](https://github.com/oxsecurity/megalinter/actions?query=workflow%3AMegaLinter+branch%3Amain)
If your main branch is named `master`, replace `main` with `master` in the URLs.
### Markdown
- Format
```markdown
[](https://github.com///actions?query=workflow%3AMegaLinter+branch%3Amain)
```
- Example
```markdown
[](https://github.com/nvuillam/npm-groovy-lint/actions?query=workflow%3AMegaLinter+branch%3Amain)
```
### reStructuredText
- Format
```markdown
.. |MegaLinter yes| image:: https://github.com///workflows/MegaLinter/badge.svg?branch=main
:target: https://github.com///actions?query=workflow%3AMegaLinter+branch%3Amain
```
- Example
```markdown
.. |MegaLinter yes| image:: https://github.com/nvuillam/npm-groovy-lint/workflows/MegaLinter/badge.svg?branch=main
:target: https://github.com/nvuillam/npm-groovy-lint/actions?query=workflow%3AMegaLinter+branch%3Amain
```
_Note:_ IF you did not use `MegaLinter` as GitHub Action name, please read [GitHub Actions Badges documentation](https://docs.github.com/en/actions/monitoring-and-troubleshooting-workflows/monitoring-workflows/adding-a-workflow-status-badge){target=_blank}
## Plugins
For performance and security reasons, we cannot embed every linter in MegaLinter.
But our core architecture allows building and publishing MegaLinter plugins!
### External Plugins Catalog
| Name | Description | Author | Raw URL |
|:-----------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------:|:--------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [**jupyfmt**](https://github.com/kpj/jupyfmt#mega-linter-integration) | The uncompromising Jupyter notebook formatter | [Kim Philipp Jablonski](https://github.com/kpj) | [Descriptor](https://raw.githubusercontent.com/kpj/jupyfmt/master/mega-linter-plugin-jupyfmt/jupyfmt.megalinter-descriptor.yml) |
| [**linkcheck**](https://github.com/shiranr/linkcheck) | Plugin to check and validate markdown links exist and working | [Shiran Rubin](https://github.com/shiranr) | [Descriptor](https://raw.githubusercontent.com/shiranr/linkcheck/main/mega-linter-plugin-linkcheck/linkcheck.megalinter-descriptor.yml) |
| [**nitpick**](https://github.com/andreoliwa/nitpick#run-as-a-megalinter-plugin) | Command-line tool and flake8 plugin to enforce the same settings across multiple language-independent projects | [W. Augusto Andreoli](https://github.com/andreoliwa) | [Descriptor](https://raw.githubusercontent.com/andreoliwa/nitpick/master/mega-linter-plugin-nitpick/nitpick.megalinter-descriptor.yml) |
| [**mustache**](https://github.com/one-acre-fund/mega-linter-plugin-logstash) | Plugin to validate [Logstash](https://www.elastic.co/guide/en/logstash/current/configuration.html) pipeline definition files using [mustache](https://github.com/breml/logstash-config) | [Yann Jouanique](https://github.com/Yann-J) | [Descriptor](https://raw.githubusercontent.com/one-acre-fund/mega-linter-plugin-logstash/main/mega-linter-plugin-logstash/logstash.megalinter-descriptor.yml) |
| [**salt-lint**](https://github.com/ssc-services/mega-linter-plugin-salt) | Checks Salt State files (SLS) for best practices and behavior that could potentially be improved. | [Joachim Grimm](https://github.com/grimmjo) | [Descriptor](https://raw.githubusercontent.com/ssc-services/mega-linter-plugin-salt/main/mega-linter-plugin-salt/salt.megalinter-descriptor.yml) |
| [**docker-compose-linter**](https://github.com/wesley-dean/mega-linter-plugin-dclint/blob/main/README.md) | Plugin to lint docker-compose files | [Wesley Dean](https://github.com/wesley-dean) | [Descriptor](https://github.com/wesley-dean/mega-linter-plugin-dclint/blob/main/mega-linter-plugin-dclint/dclint.megalinter-descriptor.yml) |
| [**repolinter**](https://github.com/wesley-dean/mega-linter-plugin-repolinter/blob/main/README.md) | Plugin to run TODO Group's repolinter to look for repository best practices | [Wesley Dean](https://github.com/wesley-dean) | [Descriptor](https://github.com/wesley-dean/mega-linter-plugin-repolinter/blob/main/mega-linter-plugin-repolinter/repolinter.megalinter-descriptor.yml) |
| [**j2lint**](https://github.com/wesley-dean/mega-linter-plugin-j2lint/blob/main/README.md) | Plugin to lint Jinja2 files | [Wesley Dean](https://github.com/wesley-dean) | [Descriptor](https://github.com/wesley-dean/mega-linter-plugin-j2lint/blob/main/mega-linter-plugin-j2lint/j2lint.megalinter-descriptor.yml) |
| [**fmlint**](https://github.com/wesley-dean/mega-linter-plugin-fmlint/blob/main/README.md) | Plugin to lint YAML frontmatter in Markdown documents | [Wesley Dean](https://github.com/wesley-dean) | [Descriptor](https://github.com/wesley-dean/mega-linter-plugin-fmlint/blob/main/mega-linter-plugin-fmlint/fmlint.megalinter-descriptor.yml) |
| [**lintlang**](https://github.com/hermes-labs-ai/lintlang/blob/main/mega-linter-plugin-lintlang/README.md) | Deterministic offline linter for AI agent instructions, tool definitions and prompt files (AI_LINTLANG) | [Rolando Bosch](https://github.com/roli-lpci) | [Descriptor](https://raw.githubusercontent.com/hermes-labs-ai/lintlang/main/mega-linter-plugin-lintlang/lintlang.megalinter-descriptor.yml) |
> Note: Using an external plugin means you trust its author.
Submit a Pull Request if you want your plugin to appear here :)
### Use external plugins
Add plugin URLs in the `PLUGINS` property of `.mega-linter.yml`. URLs must either begin with "https://" or take the form of "file://\", where \ points to a valid plugin descriptor file.
> Note: Both \ and the default mount directory (/tmp/lint/\) will be checked for a valid descriptor.
#### Example
```yaml
PLUGINS:
- https://raw.githubusercontent.com/kpj/jupyfmt/master/mega-linter-plugin-jupyfmt/jupyfmt.megalinter-descriptor.yml
- file://.automation/test/mega-linter-plugin-test/test.megalinter-descriptor.yml
```
### Create your own plugin
You can implement your own descriptors and load them as plugins during MegaLinter runtime.
- Descriptor format is exactly the same as [MegaLinter embedded ones](https://github.com/oxsecurity/megalinter/tree/main/megalinter/descriptors) ([see JSON schema documentation](https://megalinter.io/json-schemas/descriptor.html))
- Plugin descriptor files must be named **\*\*.megalinter-descriptor.yml** and conform to the [MegaLinter JSON Schema](https://github.com/oxsecurity/megalinter/blob/main/megalinter/descriptors/schemas/megalinter-descriptor.jsonschema.json)
- Plugins must be hosted in a URL containing **\*\*/mega-linter-plugin-\*\*/**
- File URLs must conform to the same directory and file naming criteria as defined above.
#### Limitations
- For now, the only `install` attributes managed are `dockerfile` instructions starting by `RUN`
### Community Tools
Beyond plugins, the community has built additional tools that integrate with MegaLinter. These are independently maintained and **not** affiliated with the MegaLinter team.
| Name | Description | Author |
|:--------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------:|
| [**megalinter-mcp-server**](https://github.com/DownAtTheBottomOfTheMoleHole/megalinter-mcp) | An MCP server for running MegaLinter via [mega-linter-runner](https://megalinter.io/mega-linter-runner/). Provides 15 MCP tools for execution, discovery, and analysis. Works with GitHub Copilot Chat in VS Code and other MCP-compatible clients. Available on [npm](https://www.npmjs.com/package/@downatthebottomofthemolehole/megalinter-mcp-server). | [DownAtTheBottomOfTheMoleHole](https://github.com/DownAtTheBottomOfTheMoleHole) |
| [**megalinter-ado**](https://github.com/DownAtTheBottomOfTheMoleHole/megalinter-ado) | Azure DevOps extension providing a native pipeline task for running MegaLinter. Supports flavor selection, auto-fix PRs, and PR comments. Available on the [Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=DownAtTheBottomOfTheMoleHole.megalinter-ado). | [DownAtTheBottomOfTheMoleHole](https://github.com/DownAtTheBottomOfTheMoleHole) |
## They talk about MegaLinter
### English articles
| Article | Author |
|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Looking for the best CI/CD Pipeline Linting Tool? Try MegaLinter!](https://medium.com/@SeasonedDeveloper/looking-for-the-best-ci-cd-pipeline-linting-tool-try-megalinter-d89c9eba850d){target=_blank} | [Seasoned Developer](https://medium.com/@SeasonedDeveloper){target=_blank} |
| [Integrating MegaLinter to Automate Linting Across Multiple Codebases. A Technical Description](https://medium.com/datamindedbe/integrating-megalinter-to-automate-linting-across-multiple-codebases-a-technical-description-a200bb235b71){target=_blank} | [Thorsten Foltz](https://www.linkedin.com/in/thorstenfoltz/){target=_blank} |
| [MegaLinter Performance Tuning for Maximum Efficiency](https://flexion.us/blog/megalinter-performance-tuning/){target=_blank} | [Wes Dean](https://github.com/wesley-dean){target=_blank} |
| [10 MegaLinter Tips and Tricks Unlock its Full Potential](https://flexion.us/blog/megalinter-tips-and-tricks/){target=_blank} | [Wes Dean](https://github.com/wesley-dean){target=_blank} |
| [30 Seconds to Setup MegaLinter: Your Go-To Tool for Automated Code Quality](https://medium.com/@caodanju/30-seconds-to-setup-megalinter-your-go-to-tool-for-automated-code-quality-and-iac-security-969d90a5a99c){target=_blank} | [Peng Cao](https://www.linkedin.com/in/peng-cao-83b6a2103/) |
| [Introducing MegaLinter: Streamlining Code Quality Checks Across Multiple Languages](https://cloudtuned.hashnode.dev/introducing-megalinter-streamlining-code-quality-checks-across-multiple-languages){target=_blank} | [Cloud Tuned](https://cloudtuned.hashnode.dev/){target=_blank} |
| [Infrastructure as Code GitHub Codespace Template](https://luke.geek.nz/azure/iac-github-codespace/){target=_blank} | [Luke Murray](https://www.linkedin.com/in/ljmurray/){target=_blank} |
| [5 ways MegaLinter upped our DevSecOps game](https://flexion.us/blog/5-ways-megalinter-upped-our-devsecops-game/){target=_blank} | [Wes Dean](https://github.com/wesley-dean){target=_blank} |
| [Achieve Code Consistency: MegaLinter Integration in Azure DevOps](https://techcommunity.microsoft.com/t5/azure-devops-blog/achieve-code-consistency-megalinter-integration-in-azure-devops/ba-p/3939448){target=_blank} | [Don Koning](https://techcommunity.microsoft.com/t5/user/viewprofilepage/user-id/2039143#profile){target=_blank} on [Microsoft Tech Community](https://techcommunity.microsoft.com/){target=_blank} |
| [MegaLinter in Azure DevOps](https://jamescook.dev/megalinter-in-azure-devops){target=_blank} | [James Cook](https://www.linkedin.com/in/cookjames/){target=_blank} |
| [Maximize your code consistency with Megalinter](https://codewithme.cloud/posts/2023/08/maximize-your-code-consistency-with-megalinter/){target=_blank} | [Tor Ivar Asbølmo](https://www.linkedin.com/in/torivara/){target=_blank} on [codewithme.cloud](https://codewithme.cloud){target=_blank} |
| [8 Tools to Scan Node.js Applications for Security Vulnerability](https://geekflare.com/nodejs-security-scanner/){target=_blank} | [Chandan Kumar](https://www.linkedin.com/in/chandank){target=_blank} on [GeekFlare.com](https://geekflare.com/){target=_blank} |
| [Use the Workflows JSON schema in your IDE](https://cloud.google.com/workflows/docs/use-workflows-json-schema-with-ide){target=_blank} | [Google Cloud](https://cloud.google.com/){target=_blank} |
| [Level up your Unity Packages with CI/CD](https://medium.com/@RunningMattress/level-up-your-unity-packages-with-ci-cd-9498d2791211){target=_blank} | [RunningMattress](https://medium.com/@RunningMattress){target=_blank} |
| [GitHub Actions: sharing your secrets with third-party actions](https://secure-git.guide/013_Sharing-GitHub-secrets-with-third-party-actions){target=_blank} | [Constantin Bosse](https://github.com/cgbosse){target=_blank} and [Stephen Hosom](https://github.com/hosom){target=_blank} |
| [Talk about the Kotlin plugins Kover, Ktlint and Detekt. Made for the AmsterdamJUG meetup.](https://www.slideshare.net/SimonedeGijt/pluginandplayv4amsterdamjugpptx-251796070){target=_blank} | [Simone de Gijt](https://github.com/SimonedeGijt){target=_blank} |
| [Linting - What is all the fluff about?](https://rse.shef.ac.uk/blog/2022-04-19-linting/){target=_blank} | [Neil Shepard](https://www.linkedin.com/in/neil-shephard-a43a83211/?originalSubdomain=uk){target=_blank}, University Of Sheffield |
| [How to apply security at the source using GitOps](https://dev.to/minwi/how-to-apply-security-at-the-source-using-gitops-21bk){target=_blank} | [Edu Minguez](https://dev.to/minwi){target=_blank} |
| [How to linter basic things like trailing whitespaces and newlines](https://nklya.medium.com/hot-to-linter-basic-things-like-trailing-whitespaces-and-newlines-7b40da8f688d){target=_blank} | [Nicolai Antiferov](https://nklya.medium.com/){target=_blank} |
| [Node.js Coding Standard Tools with MegaLinter on Gitlab CI](https://javascript.plainenglish.io/node-js-coding-standard-tools-with-megalinter-on-gitlab-ci-a43b55915811){target=_blank} | [Albion Bame](https://www.linkedin.com/in/albion-bame/){target=_blank} |
| [Linting a Jekyll blog with MegaLinter](https://www.ayyjohn.com/posts/linting-a-jekyll-blog-with-mega-linter){target=_blank} | [Alec Johnson](https://www.linkedin.com/in/ayyjohn/){target=_blank} |
| [MegaLinter sells his soul and joins OX Security](https://nicolas.vuillamy.fr/megalinter-sells-his-soul-and-joins-ox-security-2a91a0027628){target=_blank} | [Nicolas Vuillamy](https://nvuillam.github.io){target=_blank} |
| [Limit your technical debt and secure your code base using MegaLinter](https://nicolas.vuillamy.fr/improve-uniformize-and-secure-your-code-base-with-megalinter-62ebab422c1){target=_blank} | [Nicolas Vuillamy](https://nvuillam.github.io){target=_blank} |
### French articles
| Article | Author |
|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------------|
| [MegaLinter](https://blog.stephane-robert.info/docs/developper/autres-outils/linters/megalinter/){target=_blank} | [Stéphane Robert](https://www.linkedin.com/in/stephanerobert1/), [3DS OutScale](https://fr.outscale.com/){target=_blank} |
| [MegaLinter: un linter pour les gouverner tous](https://blog.wescale.fr/megalinter-un-linter-pour-les-gouverner-tous){target=_blank} | [Guillaume Arnaud](https://www.linkedin.com/in/guillaume-arnaud/), [WeScale](https://www.wescale.fr/){target=_blank} |
| [MegaLinter, votre meilleur ami pour un code de qualité](https://www.neosoft.fr/nos-publications/blog-tech/mega-linter-votre-meilleur-ami-pour-un-code-de-qualite/?utm_source=twitter&utm_medium=organic&utm_campaign=article-mega-linter){target=_blank} | [Thomas Sanson](https://github.com/ThomasSanson){target=_blank} |
### Japanese articles
| Article | Author |
|:---------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------------------|
| [Try using MegaLinter](https://future-architect.github.io/articles/20231129a/?s=03){target=_blank} | [Takashi Minayaga](https://future-architect.github.io/authors/%E5%AE%AE%E6%B0%B8%E5%B4%87%E5%8F%B2){target=_blank} |
### Videos
- [(Brazilian) Qualidade e Segurança em Código com MegaLinter: automatizando análises em MAUI com GitHub Actions](https://www.youtube.com/watch?v=0JGusPYE4zc), by [Canal dotNET](https://www.youtube.com/@CanaldotNET)
- [(Brazilian) MegaLinter: Como Automatizar a Qualidade do Código para Todas Plataformas](https://www.youtube.com/watch?v=YSdZ3atC2j4), by [Codando TV](https://www.youtube.com/@hackitectsplayground)
- [How to: Secrets scanning](https://youtu.be/iBMWAk5QIfM?si=EVcJilkz7Y2jdn6e&t=649), by [Hackitect's playground](https://www.youtube.com/@hackitectsplayground)
- [How to use MegaLinter with Jenkins](https://www.youtube.com/watch?v=KhkNf2tQ3hM), by [Darin Pope](https://www.linkedin.com/in/darinpope/) / [Cloudbees](https://www.cloudbees.com/)
- (FR) MegaLinter presentation at [DevCon 20 / Programmez Magazine](https://www.programmez.com/page-devcon/devcon-20-100-securite-qualite-du-code), by [Nicolas Vuillamy](https://github.com/nvuillam)
- Code quality - Ep01 - MegaLinter, one linter to rule them all, by [Bertrand Thomas](https://github.com/devpro)
- DevSecOps Webinar using MegaLinter, by [5.15 Technologies](https://www.515tech.com/){target=_blank}
- Ortelius Architecture Meeting, with a review of MegaLinter, by [Steve Taylor](https://github.com/sbtaylor15){target=_blank} from [Ortelius](https://ortelius.io/)
### Web Sites
- [analysis-tools.dev](https://analysis-tools.dev/tool/mega-linter){target=_blank}
- [awesome-linters](https://github.com/caramelomartins/awesome-linters#language-agnostic){target=_blank}
- [schemastore.org](https://www.schemastore.org/){target=_blank}
- [abhith.net](https://www.abhith.net/recommended/){target=_blank}
- [my-devops-lab.com](https://www.my-devops-lab.com/tools){target=_blank}
### Linters
- [bicep_linter](https://github.com/Azure/bicep#community-bicep-projects){target=_blank}
- [checkstyle](https://checkstyle.org/index.html#Related_Tools_Active_Tools){target=_blank}
- [clj-kondo](https://github.com/clj-kondo/clj-kondo/blob/master/doc/ci-integration.md#github){target=_blank}
- [cpplint](https://github.com/cpplint/cpplint#installation){target=_blank}
- [csharpier](https://csharpier.com/docs/Pre-commit#megalinter){target=_blank}
- [cspell](https://github.com/streetsidesoftware/cspell/tree/master/packages/cspell#mega-linter){target=_blank}
- [djlint](https://djlint.com/docs/integrations/#megalinter){target=_blank}
- [dotenv-linter](https://dotenv-linter.github.io/#/integrations/mega_linter){target=_blank}
- [editorconfig-checker](https://github.com/editorconfig-checker/editorconfig-checker#mega-linter){target=_blank}
- [eslint](https://eslint.org/docs/latest/use/integrations#source-control){target=_blank}
- [hadolint](https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#mega-linter){target=_blank}
- [htmlhint](https://htmlhint.com/integrations/task-runner/){target=_blank}
- [jscpd](https://github.com/kucherenko/jscpd#who-uses-jscpd){target=_blank}
- [kingfisher](https://github.com/mongodb/kingfisher#installation){target=_blank}
- [ktlint](https://ktlint.github.io/ktlint/latest/install/integrations/){target=_blank}
- [kubescape](https://github.com/kubescape/kubescape#cicd){target=_blank}
- [lintr](https://lintr.r-lib.org/articles/continuous-integration.html){target=_blank}
- [lychee](https://github.com/lycheeverse/lychee#users){target=_blank}
- [markdown-table-formatter](https://github.com/nvuillam/markdown-table-formatter#readme){target=_blank}
- [nbqa](https://github.com/nbQA-dev/nbQA#-used-by){target=_blank}
- [npm-groovy-lint](https://nvuillam.github.io/npm-groovy-lint/#mega-linter){target=_blank}
- [npm-package-json-lint](https://npmpackagejsonlint.org/docs/integrations#megalinter){target=_blank}
- [phplint](https://github.com/overtrue/phplint#run-it-with-megalinter){target=_blank}
- [pmd](https://pmd.sourceforge.io/pmd-6.55.0/pmd_userdocs_tools_ci.html){target=_blank}
- [prettier](https://prettier.io/docs/related-projects){target=_blank}
- [proselint](https://github.com/amperser/proselint#readme){target=_blank}
- [protolint](https://github.com/yoheimuta/protolint#ci-integration){target=_blank}
- [pyright](https://microsoft.github.io/pyright/#/ci-integration){target=_blank}
- [revive](https://github.com/mgechev/revive#megalinter){target=_blank}
- [robocop](https://robocop.dev/stable/integrations/megalinter/){target=_blank}
- [roslynator](https://github.com/dotnet/roslynator#command-line-tool){target=_blank}
- [rst-lint](https://github.com/twolfson/restructuredtext-lint/wiki/Integration-in-other-tools#integration-in-other-tools){target=_blank}
- [rstcheck](https://rstcheck.readthedocs.io/en/latest/usage/integration/#use-with-mega-linter){target=_blank}
- [rubocop](https://docs.rubocop.org/rubocop/integration_with_other_tools.html#mega-linter-integration){target=_blank}
- [ruff](https://github.com/astral-sh/ruff#whos-using-ruff){target=_blank}
- [ruff-format](https://github.com/astral-sh/ruff#whos-using-ruff){target=_blank}
- [rumdl](https://github.com/rvben/rumdl#megalinter){target=_blank}
- [scalafix](https://scalacenter.github.io/scalafix/docs/users/installation.html#plugins-for-other-build-tools){target=_blank}
- [secretlint](https://github.com/secretlint/secretlint#mega-linter){target=_blank}
- [semgrep](https://semgrep.dev/docs/extensions/overview){target=_blank}
- [snakefmt](https://github.com/snakemake/snakefmt#github-actions){target=_blank}
- [swiftlint](https://github.com/realm/SwiftLint#megalinter){target=_blank}
- [vale](https://vale.sh/docs){target=_blank}
- [zizmor](https://docs.zizmor.sh/integrations/){target=_blank}
## Frequently Asked Questions
> My repo CI already has linters and they're working perfectly, so why do I need MegaLinter?
You can continue using your installed linters and deactivate them in `.mega-linter.yml`. For example, in a JavaScript project using ESLint, configure MegaLinter with `DISABLE: JAVASCRIPT`. That way, you will benefit from both your installed linters and other MegaLinter linters checking JSON, YAML, Markdown, Dockerfile, Bash, spelling mistakes, dead URLs…
> OK but… how does it work?
MegaLinter is based on Docker images containing either all linters, or a selection of linters if you use a MegaLinter flavor for a project with a specific language or format.
The core architecture does the following:
- **Initialization**
- **List all project files**:
- except files in ignored folders (`node_modules`, etc…)
- except files not matching `FILTER_REGEX_INCLUDE` (if defined by user)
- except files matching `FILTER_REGEX_EXCLUDE` (if defined by user)
- **Collect files for each activated linter**, matching their **own filtering criteria**:
- file extensions
- file names
- file content
- `_FILTER_REGEX_INCLUDE` (if defined by user)
- `_FILTER_REGEX_EXCLUDE` (if defined by user)
- **Linting**
- **Parallelly**, for **each linter** with matching files:
- **Call the linter** on matching files (or the whole project for some linters like copy-paste detector)
- Call activated **linter-level reporters** (GitHub Status Reporter…)
- **Finalization**
- Call activated **global level reporters** (GitHub Pull Request Comment Reporter, File.io Reporter, Email Reporter…)
- Manage return code:
- **0** if no error (or only non blocking errors if user defined `DISABLE_ERRORS` or `_DISABLE_ERRORS`)
- **1** if errors
> I run MegaLinter on an ARM machine (Apple Silicon, ARM CI runner) and linters crash randomly
MegaLinter Docker images are published for **linux/amd64 only**, and `mega-linter-runner` explicitly requests that platform, so on an ARM host the whole container runs through **emulation** (QEMU or Rosetta).
Emulation is a known source of random crashes that are **not** MegaLinter bugs: linters exit with `Segmentation fault`, `Killed`, or `qemu: uncaught target signal 11`, often on a different linter at each run.
If you hit this:
- Prefer running MegaLinter in your **CI** (GitHub Actions, GitLab CI…) on an amd64 runner, where no emulation happens
- Reduce parallelism with `PARALLEL_PROCESS_NUMBER: 1` in `.mega-linter.yml`, which makes some emulation issues disappear
- Build a [custom flavor](https://megalinter.io/latest/custom-flavors/) for `linux/arm64` if you need a native local image
## How to contribute
Contributions to MegaLinter are very welcome: the more we are, the stronger MegaLinter becomes!
Please follow [Contributing Guide](https://megalinter.io/contributing/)
To help, you can also:
- [:star: Star the repository](https://github.com/oxsecurity/megalinter/stargazers)
- [:beer: Offer a beer!](https://github.com/sponsors/nvuillam)
- [report problems and request new features](https://github.com/oxsecurity/megalinter/issues)
- [share on twitter](https://twitter.com/intent/tweet/?text=MegaLinter:%2070%20linters%20aggregator%20easy%20to%20use%20for%20all%20your%20projects&url=http://megalinter.io/&via=nvuillam){target=_blank}
## Special thanks
### Maintainers
MegaLinter wouldn't be what it is without its great team of maintainers!
- [Kurt Von Laven](https://github.com/Kurt-von-Laven)
- [Borja Dominguez](https://github.com/bdovaz)
- [Edouard Choiniere](https://github.com/echoix)
- [Nicolas Vuillamy](https://github.com/nvuillam) (Creator)
### Contributors
Among them, special thanks to the contributors whose merged pull requests had a significant and lasting impact on MegaLinter sources (list built from the analysis of all merged pull requests since the beginning of the project — apologies to anyone we may have missed!):
| Contributor | Merged PRs | Main contributions |
|:------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------:|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Laurent Laville](https://github.com/llaville) | [48](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Allaville) | Overhaul of the [PHP linters](https://megalinter.io/latest/descriptors/php/) (PHPStan, Psalm, PHP_CodeSniffer), `list_of_files` lint mode performances, and many core and documentation fixes |
| [Tom](https://github.com/TommyE123) | [20](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3ATommyE123) | Fixes and enhancements on many linters ([TFLint](https://megalinter.io/latest/descriptors/terraform_tflint/), [xmllint](https://megalinter.io/latest/descriptors/xml_xmllint/) XSD support, [PowerShell](https://megalinter.io/latest/descriptors/powershell/), [CSharpier](https://megalinter.io/latest/descriptors/csharp_csharpier/)…) and configuration schemas |
| [Wes Dean](https://github.com/wesley-dean) | [13](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Awesley-dean+author%3Awesley-dean-flexion) | [Vale](https://megalinter.io/latest/descriptors/spell_vale/) linter, SARIF reporter fixes, and curation of the [plugins catalog](https://megalinter.io/latest/plugins/) |
| [Stefan Kuhn](https://github.com/Wuodan) | [12](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3AWuodan) | Running MegaLinter as **non-root** in containers, runtime and CI hardening |
| [Luke Lloyd](https://github.com/lukelloyd1985) | [11](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Alukelloyd1985) | [Azure comments reporter](https://megalinter.io/latest/reporters/AzureCommentReporter/) and [updated sources reporter](https://megalinter.io/latest/reporters/UpdatedSourcesReporter/) fixes, Azure pipelines documentation |
| [Ross Smith II](https://github.com/rasa) | [9](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Arasa) | Workflow templates and documentation improvements |
| [Tom Pansino](https://github.com/tpansino) | [8](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Atpansino) | New linters: [terraform fmt](https://megalinter.io/latest/descriptors/terraform_terraform_fmt/), Checkov and [bandit](https://megalinter.io/latest/descriptors/python_bandit/) |
| [Lars Reimann](https://github.com/lars-reimann) | [7](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Alars-reimann) | [ruff](https://megalinter.io/latest/descriptors/python_ruff/) linter, Docker images deployment to GitHub Container Registry |
| [Dariusz Porowski](https://github.com/DariuszPorowski) | [6](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3ADariuszPorowski) | [lychee](https://megalinter.io/latest/descriptors/spell_lychee/) linter, secrets scanning improvements, SARIF fixes |
| [Sergey Kolomenkin](https://github.com/kolomenkin) | [6](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Akolomenkin) | Early core features: `EXCLUDED_DIRECTORIES`, file name regex matching, Docker image optimizations |
| [Tom Klingenberg](https://github.com/ktomk) | [6](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aktomk) | Build and documentation fixes |
| [Patrick Jungermann](https://github.com/pjungermann) | [6](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Apjungermann) | OpenAPI/AsyncAPI linting with Spectral, [trivy](https://megalinter.io/latest/descriptors/repository_trivy/) fixes |
| [Yann Jouanique](https://github.com/Yann-J) | [5](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3AYann-J) | [kubeconform](https://megalinter.io/latest/descriptors/kubernetes_kubeconform/) linter, [ktlint](https://megalinter.io/latest/descriptors/kotlin_ktlint/) improvements |
| [Dalton Verhagen](https://github.com/daltonv) | [5](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Adaltonv) | [C/C++ flavor](https://megalinter.io/latest/flavors/), [clang-format](https://megalinter.io/latest/descriptors/c_clang_format/) linter |
| [Omeed Musavi](https://github.com/omusavi) | [5](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aomusavi) | [Prettier](https://megalinter.io/latest/descriptors/json_prettier/) as JSON formatter, [Bicep](https://megalinter.io/latest/descriptors/bicep_bicep_linter/) linter |
| [Ashok](https://github.com/ashokm) | [5](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aashokm) | Reporters UX and documentation fixes |
| [Parker Brown](https://github.com/parkerbxyz) | [5](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aparkerbxyz) | GitHub Actions workflows modernization |
| [Inbar](https://github.com/InbarRose) | [4](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3AInbarRose) | Server mode and SSH usage improvements |
| [Thomas Sanson](https://github.com/ThomasSanson) | [4](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3AThomasSanson) | [Helm](https://megalinter.io/latest/descriptors/kubernetes_helm/) linter, Gitpod workspace and Makefile automation |
| [Andrew Vaughan](https://github.com/andrewvaughan) | [4](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aandrewvaughan) | [DevSkim](https://megalinter.io/latest/descriptors/repository_devskim/) default configuration, repository config cleanups |
| [Josef Andersson](https://github.com/janderssonse) | [4](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Ajanderssonse) | SARIF report improvements, [ts-standard](https://megalinter.io/latest/descriptors/typescript_ts_standard/) linter |
| [Saad Yousfi](https://github.com/yousfiSaad) | [4](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3AyousfiSaad) | [nbqa + mypy](https://megalinter.io/latest/descriptors/python_nbqa/) linter to type-check Jupyter notebooks |
| [Alejandro Suero](https://github.com/AlejandroSuero) | [3](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3AAlejandroSuero) | Lua linters: [StyLua](https://megalinter.io/latest/descriptors/lua_stylua/) and Selene |
| [Barry Pollard](https://github.com/tunetheweb) | [3](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Atunetheweb) | [SQLFluff](https://megalinter.io/latest/descriptors/sql_sqlfluff/) configuration support |
| [Saishiva K](https://github.com/saishivarcr) | [2](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Asaishivarcr) | [Markdown summary](https://megalinter.io/latest/reporters/MarkdownSummaryReporter/) and [Bitbucket comment](https://megalinter.io/latest/reporters/BitbucketCommentReporter/) reporters |
| [Trevor Vaughan](https://github.com/trevor-vaughan) | [2](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Atrevor-vaughan) | Linter activation precedence (`ENABLE_DISABLE_LINTERS_PRIORITY`), excluded directories fixes |
| [Jan Opravil](https://github.com/opravil-jan) | [2](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aopravil-jan) | ESLint 9 and 10 upgrades across descriptors |
| [Practicalli Johnny](https://github.com/practicalli-johnny) | [2](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Apracticalli-johnny) | [cljstyle](https://megalinter.io/latest/descriptors/clojure_cljstyle/) linter |
| [ideaship](https://github.com/ideaship) | [2](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aideaship) | [codespell](https://megalinter.io/latest/descriptors/spell_codespell/) linter |
| [Zine Moualhi](https://github.com/muandane) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Amuandane) | [Kubescape](https://megalinter.io/latest/descriptors/kubernetes_kubescape/) linter |
| [Rogerio Peixoto](https://github.com/rogeriopeixotocx) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Arogeriopeixotocx) | KICS linter |
| [Abdeslam](https://github.com/abdeslamads) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aabdeslamads) | [Salesforce Code Analyzer](https://megalinter.io/latest/descriptors/salesforce/) v5 upgrade |
| [Mustafa Kılıç](https://github.com/enciyo) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Aenciyo) | [detekt](https://megalinter.io/latest/descriptors/kotlin_detekt/) linter |
| [Sebastien Colladon](https://github.com/scolladon) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Ascolladon) | [ls-lint](https://megalinter.io/latest/descriptors/repository_ls_lint/) linter |
| [Lance Craig](https://github.com/lancra) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Alancra) | [zizmor](https://megalinter.io/latest/descriptors/action_zizmor/) linter |
| [Aaron Sterren](https://github.com/waterfoul) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Awaterfoul) | IDEA plugins auto-install |
| [jackheuberger](https://github.com/jackheuberger) | [1](https://github.com/oxsecurity/megalinter/pulls?q=is%3Apr+is%3Amerged+author%3Ajackheuberger) | Local [plugins](https://megalinter.io/latest/plugins/) support |
### Open-source teams
MegaLinter obviously would not exist without its linters and libraries: many thanks to all the dedicated open-source teams maintaining these awesome linters!
### Super-Linter team
MegaLinter has been built on the ashes of a [rejected Pull Request](https://github.com/super-linter/super-linter/pull/791){target=_blank} on [GitHub Super-Linter](https://github.com/super-linter/super-linter){target=_blank}.
Even if I disagree with their decision to remain in Bash, the core team has always been nice and supportive [during the time I was a Super-Linter contributor](https://github.com/super-linter/super-linter/pulls?q=is%3Apr+is%3Aclosed+author%3Anvuillam+review%3Aapproved){target=_blank} :)
## License
- [GNU Affero General Public License](https://github.com/oxsecurity/megalinter/blob/main/LICENSE)
## MegaLinter vs Super-Linter
The hard fork of Super-Linter to Python isn't just a language switch: Python's flexibility and libraries enabled many additional features described below.
### Security
MegaLinter [hides many environment variables](https://github.com/oxsecurity/megalinter/tree/main/docs/config-variables-security.md) when calling the linters.
That way you need to trust only MegaLinter core code with your secrets, not the 100+ embedded linters !
### Performance
- [MegaLinter flavors](#flavors) allow using smaller Docker images, reducing pull time.
- Thanks to Python multiprocessing, linters are run in parallel, which is much faster than Super-Linter's Bash script that runs all linters sequentially.
- When the linter allows it, call it once with N files, instead of calling it N times with one file.
### More languages and formats linted
- **C**, **C++**, **Copy-Paste detection**, **Credentials**, **GraphQL**, **JSON & YAML with JSON schemas**, **Markdown tables formatting**, **Puppet**, **reStructuredText**, **Rust**, **Scala**, **Spell checker**, **Swift**, **Visual Basic .NET** …
### Automatically apply formatting and fixes
MegaLinter can [automatically apply fixes performed by linters](https://github.com/oxsecurity/megalinter/tree/main/docs/config-apply-fixes.md) and push them to the same branch, or create a Pull Request that you can validate.
This is pretty handy, especially for linter errors related to formatting (in that case, you don't have any manual update to perform)
### Run locally
MegaLinter can be run locally thanks to [mega-linter-runner](https://megalinter.io/mega-linter-runner/).
### Reports
#### Capabilities
- Accuracy: Count the total number of errors, not only the number of files in error.
- Show linter version and applied filters for each linter processed.
- Reports stored as artifacts on GitHub Actions runs or other remote files
- General log
- One report file by linter
#### Additional Reporters
- [Console](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/ConsoleReporter.md)
- [Text files](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/TextReporter.md)
- [GitHub Pull Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/GitHubCommentReporter.md)
- [Gitlab Merge Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/GitlabCommentReporter.md)
- [Bitbucket Pull Request comments](docs/reporters/BitbucketCommentReporter.md)
- [Azure Pull Request comments](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/AzureCommentReporter.md)
- [Markdown Summary](docs/reporters/MarkdownSummaryReporter.md)
- [Updated sources](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/UpdatedSourcesReporter.md)
- [Email](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/EmailReporter.md)
- [File.io](https://github.com/oxsecurity/megalinter/tree/main/docs/reporters/FileIoReporter.md)
### Enhanced configuration
- Assisted installation and configuration using a Yeoman generator and JSON schemas for the configuration file
- Configure include and exclude regexes for a single language or linter: e.g., `JAVASCRIPT_FILTER_REGEX_INCLUDE (src)`
- Configure additional CLI arguments for a linter: e.g., `JAVASCRIPT_ES_ARGUMENTS "--debug --env-info"`
- Configure non-blocking errors for a single language or linter: e.g., `JAVASCRIPT_DISABLE_ERRORS`
- Simplified languages and linters variables
- ENABLE = list of languages and formats to apply lint on codebase (default: all)
- ENABLE_LINTERS = list of linters to apply lint on codebase (default: all)
- DISABLE = list of languages and formats to skip (default: none)
- DISABLE_LINTERS = list of linters to skip (default: none)
- Variables VALIDATE_XXX are still taken in account (but should not be used in association with ENABLE and DISABLE variables)
### Enhanced documentation
- [HTML documentation](https://megalinter.io/)
- One page per linter documentation:
- **All variables** that can be used with this linter
- List of **file extensions, names and filters** applied by the linter
- Link to MegaLinter default linter configuration
- Link to linter website
- Link to official page explaining **how to customize the linter rules**
- Link to official page explaining **how to disable rules from source comments**
- **Examples** of linter command line calls behind the hood
- Help command text
- Installation commands
- Installation links for related IDEs
- README
- Separate languages, formats, and tooling formats in the linters table
- Add logos for each descriptor
### Plugin management
For less commonly used linters, MegaLinter offers a plugin architecture so anyone can publish plugins.
### Simplify architecture and evolutionary maintenance
- Refactoring runtime in Python, for easier handling than Bash thanks to [classes](https://github.com/oxsecurity/megalinter/tree/main/megalinter) and Python modules
- Everything related to each linter is in a [single descriptor YAML file](https://github.com/oxsecurity/megalinter/tree/main/megalinter/descriptors)
- Easier ongoing maintenance
- Fewer conflicts to manage between PRs
- A few special cases require a [Python linter class](https://github.com/oxsecurity/megalinter/tree/main/megalinter/descriptors))
- [Default behaviors for all linters](https://github.com/oxsecurity/megalinter/blob/main/megalinter/Linter.py), with the possibility to override parts of them for special cases
- Hierarchical architecture: Apply fixes and new behaviors to all linters with a single code update
- Documentation as code
- Generate linters tables (ordered by type: language, format, and tooling format) and include them in the README. [(see result)](https://megalinter.io/supported-linters/)
- Generate one markdown file per linter, containing all configuration variables, information, and examples [(see examples)](https://megalinter.io/descriptors/javascript_eslint/)
- Automatic generation of Dockerfiles using YAML descriptors, always using the linter's latest version
- Dockerfile commands (FROM, ARG, ENV, COPY, RUN)
- APK packages (Linux)
- NPM packages (Node.js)
- PIP packages (Python)
- GEM packages (Ruby)
- Phive packages (PHP)
- Have a centralized exclude list (node_modules, .rbenv, etc.)
### Improve robustness & stability
- Test classes for each capability
- Test classes for each linter: automatic generation of test classes using [.automation/build.py](https://github.com/oxsecurity/megalinter/blob/main/.automation/build.py)
- Set up code coverage [](https://codecov.io/gh/oxsecurity/megalinter)
- Development CI/CD
- Validate multi-status on PR inside each PR (posted from step "Run against all code base")
- Run test classes and code coverage with pytest during validation GitHub Action
- Validate descriptor YML files with json schema during build
- Automated job to upgrade linters to their latest stable version
| [all](https://megalinter.io/beta/supported-linters/) | Default MegaLinter Flavor | 133 |   |
|