MegaLinter fails on platform's pre-existing baseline, so any PR touching a non-k8s path lands red

🤖 Generated by the Daily AI Engineer

Evidence

#2769 adds exactly one file — a 29-line .coderabbit.yaml at the repository root — and its 🧹 Lint - mega-linter check is red. Not one of the reported errors is in that file:

Linter	Errors	Where
cspell	8051	across 914 files
checkov	287	repository-wide
lychee	166	across 888 files
markdownlint	169	across 90 files (55 auto-fixed)
jscpd	24	repository-wide
gitleaks	2	repository-wide
zizmor	1	of 8 workflows
revive	1	of 6 Go files
trivy	1	repository-wide
v8r (YAML)	1	`k8s/bases/apps/backstage/cluster.yaml`, `k8s/bases/apps/umami/cluster.yaml`

The v8r errors are representative of the rest: it resolves those CNPG Cluster manifests against a schema that rejects apiVersion, kind, metadata and spec — a mis-detected schema, not a defect in the manifests.

Why this has stayed invisible

MegaLinter runs from the Go-project validation path, which is paths-filtered. Almost every PR on this repository changes only k8s/**, so the job is skipped and the red baseline is never surfaced. Comparing check sets makes it plain: #2745 (k8s-only) has no 🧹 Lint - mega-linter check at all, while #2769 (one root-level file) does — and it fails on the first run.

It is not main breakage: the job runs on pull_request, so main itself is green.

Who this affects

Anyone touching a non-k8s/** path — a root config file, a script, a workflow, a Go tool. Their PR lands red on a check that has nothing to do with their change, and the honest options are all bad: merge past a red check, spend a session on 8000 unrelated findings, or avoid touching those paths.

Expected behaviour

A PR that introduces no lint errors gets a green MegaLinter run. Reaching that means deciding, per linter, whether the baseline is a real defect backlog or a misconfiguration — the v8r schema resolution and the cspell dictionary look like configuration; checkov and gitleaks deserve to be read before being tuned.

The likely shape is a repository .mega-linter.yml that (a) fixes the demonstrable misconfigurations, (b) scopes the remaining linters to changed files rather than the whole tree, and (c) keeps every security-relevant linter blocking. Do not silence a linter to get green — a suppressed gitleaks or checkov finding is worse than a red check.

Acceptance criteria

A PR changing only a root-level config file gets a green 🧹 Lint - mega-linter.
Each currently-failing linter is dispositioned explicitly: fixed, correctly scoped, or recorded as a real backlog with its own follow-up.
No security-relevant linter (gitleaks, checkov, trivy, zizmor) is disabled or moved to advisory.
Verified by re-running the job on ci(coderabbit): keep docstring coverage advisory instead of merge-blocking #2769, which changes one file and should have nothing to report.

Rough size: M.

🤖 Generated by the Daily AI Engineer

Noting overlap so this is not done twice. I reached the same symptom independently and filed #2775 about twenty minutes before this one, from a single failing run rather than a full inventory — so it named only the three blocking linters and got the mechanism wrong, calling it main breakage. This issue is the better description and I have closed mine in its favour, moved its two useful children (#2777, #2778) here as sub-issues, and closed a third that was built on my incorrect reading.

Already covered by the open #2776, so it can be treated as done for the first acceptance criterion:

revive — both Go validators were missing a package comment. Fixed; revive is now at zero across the repository, verified locally with revive v1.15.0, the same version the job pins.
jscpd — six of the findings were the same RBAC binding manifest written out six times, differing only in scope and subject. Now rendered from those two fields. Duplication in scripts/validate-eks-ci-role-policy/ drops 19 → 13 locally at the job's own settings. The rest is Duplication scanner still reports clones in the EKS validator tests #2777.

Two things worth carrying into the wider fix here:

The table-driven test boilerplate — a case table's close followed by for _, tt := range tests { t.Run(...) } — is counted as duplication by jscpd but is idiomatic Go. It wants a shared case runner, not suppression and not a clever inline helper. Detail in Duplication scanner still reports clones in the EKS validator tests #2777.
Rendering a fixture from a helper needs a byte-identical proof before the literal is deleted. These tests assert a manifest is rejected, so a helper emitting subtly wrong YAML still produces the expected rejection and the refactor looks correct while testing nothing. fix(lint): scope the lint gate to the paths it actually governs #2776 has the pattern: a scratch test pinning each build against the literal it replaced, itself perturbed to confirm it fails on a wrong build, then removed.

⚠️ Possible Duplicate Issue(s)

Lint gate is red on every pull request, and main never runs it #2775

🔗 Related PRs

#2370 - fix(autoscaling): break the DaemonSet-VPA node ratchet; keep Longhorn storage off autoscale nodes [merged]
#2485 - ci(cluster-policies): flip .policyignore to an allowlist [merged]
#2507 - fix(apps): make actual-budget openid schema offline-resolvable [merged]
#2567 - ci: make CodeRabbit docstring pre-merge check non-blocking [merged]
#2622 - fix(ci): heal cancelled merge-group deploys [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

🤖 Generated by the Daily AI Engineer

This is now the critical path for the repository, not a tidy-up. Two PRs are parked on it and neither can move until it is done:

ci(coderabbit): keep docstring coverage advisory instead of merge-blocking #2769 — the .coderabbit.yaml for this repo.
fix(lint): scope the lint gate to the paths it actually governs #2776 — the revive and duplication fixes described above.

Both are otherwise complete. The local-review-round rule merged today (monorepo#2351) bounds its merge-gate relaxation to a CodeRabbit quota signal and explicitly not to "a red CI check", so a red MegaLinter parks a PR regardless of how clean everything else is. Anything landing here that touches a non-k8s/** path will hit the same wall.

Progress against the first acceptance criterion, measured in CI at #2776's head:

Linter	Before	After #2776
revive	2 errors	✅ clear
jscpd	24 / 2.4%	17 / 1.6%
golangci-lint (errcheck)	1 error	✅ clear

The errcheck one is worth adding to this issue's inventory if it is not already there: 🧹 Lint - golangci-lint is a second paths-filtered job with its own hidden baseline, on the same mechanism as MegaLinter. It was failing on generate-kubescape-exceptions/main.go and nobody had seen it, because the job only runs when a PR touches Go files.

Remaining, in the order they block: the 17 duplication findings (#2777 for the Go ones, #2778 for the Python files), then the cspell/checkov/lychee/v8r dispositions this issue describes.

🤖 Generated by the Daily AI Engineer

Releasing the claim I took on this — I redirected to a higher-priority EKS chain and did not build it, so it should not sit reserved.

Two findings from the investigation, so the next run does not repeat it:

fix(lint): scope the lint gate to the paths it actually governs #2776 already owns this concern (fix(lint): clear the lint defects main was carrying into every PR), and 🧹 Lint - mega-linter is now its only non-green check. Advance that PR rather than opening a second one.
✅ Validate Go Project is an org-ruleset required workflow, not a file in this repo. .github/workflows/validate-go-project.yaml 404s on main here; it is injected by the org ruleset Require workflows to pass before merging for Go, sourced from devantler-tech/actions@refs/heads/main. That is why it does not appear in this repo's workflow list — expect to edit it there, while MegaLinter's own config (.mega-linter.yml) is still read from this repo's root, where none currently exists.

fix(lint): scope MegaLinter to the paths it actually governs

fix(lint): match checkov's leading-slash paths and ignore four unchec…

fix(lint): unanchor checkov's path skips and make the link check resi…

fix(lint): keep the security scanners on k8s, and unblock the auto-fi…

fix(lint): stop CI committing its own report tree and mangling docs t…

fix(lint): keep the auto-fixer off SOPS ciphertext and the repo's she…

fix(lint): keep prettier out of the manifest tree and match the shell…

fix(lint): scope yamllint off the manifest tree too, and stop link ch…

Navigation Menu

Repository navigation

MegaLinter fails on platform's pre-existing baseline, so any PR touching a non-k8s path lands red #2780

Evidence

Why this has stayed invisible

Who this affects

Expected behaviour

Acceptance criteria

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

MegaLinter fails on platform's pre-existing baseline, so any PR touching a non-k8s path lands red #2780

Description

Evidence

Why this has stayed invisible

Who this affects

Expected behaviour

Acceptance criteria

Activity

devantler commented on Jul 21, 2026

coderabbitai commented on Jul 21, 2026

devantler commented on Jul 21, 2026

devantler commented on Jul 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions