Fix Go linters failing as non-root user (MEGALINTER_UID) because of root-owned GOPATH cache by nvuillam · Pull Request #9326 · oxsecurity/megalinter

nvuillam · 2026-10-26T18:13:46Z

Problem

When MegaLinter runs with MEGALINTER_UID / MEGALINTER_GID, the runtime user only gets a writable $HOME. Go keeps GOPATH=/go, so its default module cache /go/pkg/mod (root-owned) can't be written. golangci-lint then fails with the misleading context loading failed: no go files to analyze error as soon as a module dependency must be downloaded.

Changes

sh/setup-runtime-user.sh: when switching to the runtime user, export GOMODCACHE=$HOME/go/pkg/mod and GOCACHE=$HOME/.cache/go-build, unless the user already set them (the workaround from the issue keeps working). Root runs are unchanged; SSH mode inherits the variables through the saved export -p.
mega-linter-runner/test/runtime-image.test.js: new GO_GOLANGCI_LINT runtime case, run in both root and non-root modes.
.automation/test/golang_runtime_deps/: fixture module with one external dependency (github.com/google/go-cmp), so the module cache is actually exercised (the existing Go fixture has no dependencies, which is why this was not caught).
Go descriptor: the network error resolution tip now points to go env GOMODCACHE instead of $GOPATH/pkg/mod.
.cspell.json: GOMODCACHE and GOCACHE added.
CHANGELOG.md: Fixes + Dev entries.

Testing

bash -n on the script; fixture go.sum generated with go mod tidy; cspell clean on changed files.
The runtime image suite (deploy-DEV.yml) covers the new non-root Go case.

Set GOMODCACHE and GOCACHE under the runtime user home when switching to MEGALINTER_UID/MEGALINTER_GID, unless already defined. Add a runtime test with a Go fixture that has an external dependency. Fixes #9280

github-actions · 2026-10-26T18:34:55Z

✅⚠️MegaLinter analysis: Success with warnings

⚠️ PYTHON / bandit - 199 errors

hell_equals_true] subprocess call - check for execution of untrusted input.
   Severity: Low   Confidence: High
   CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b603_subprocess_without_shell_equals_true.html
   Location: ./megalinter/utils_reporter.py:406:18
405	    try:
406	        process = subprocess.run(
407	            sarif_fmt_command,
408	            stdout=subprocess.PIPE,
409	            stderr=subprocess.STDOUT,
410	            text=True,
411	            input=sarif_in + "\n",
412	            env=config.build_env(request_id),
413	        )
414	        return_code = process.returncode

--------------------------------------------------
>> Issue: [B113:request_without_timeout] Call to requests without timeout
   Severity: Medium   Confidence: Low
   CWE: CWE-400 (https://cwe.mitre.org/data/definitions/400.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b113_request_without_timeout.html
   Location: ./megalinter/utils_reporter.py:572:19
571	    try:
572	        response = requests.post(
573	            hook_url,
574	            headers=build_webhook_headers(reporter.master.request_id),
575	            json=payload,
576	        )
577	        if 200 <= response.status_code < 299:

--------------------------------------------------
>> Issue: [B311:blacklist] Standard pseudo-random generators are not suitable for security/cryptographic purposes.
   Severity: Low   Confidence: High
   CWE: CWE-330 (https://cwe.mitre.org/data/definitions/330.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/blacklists/blacklist_calls.html#b311-random
   Location: ./megalinter/utils_sarif.py:156:61
155	                        rule["id"] = (
156	                            rule["id"] + "_DUPLICATE_" + str(random.randint(1, 99999))
157	                        )

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:127:4
126	    )
127	    assert os.path.isdir(config.get(request_id, "DEFAULT_WORKSPACE")), (
128	        "DEFAULT_WORKSPACE "
129	        + config.get(request_id, "DEFAULT_WORKSPACE")
130	        + " is not a valid folder"
131	    )
132	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:187:4
186	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
187	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
188	    linter_name = linter.linter_name

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:262:4
261	    tmp_report_folder = tempfile.gettempdir() + os.path.sep + str(uuid.uuid4())
262	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
263	    if os.path.isfile(workspace + os.path.sep + "no_test_failure"):

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:512:4
511	    )
512	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
513	    expected_file_name = ""

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:612:4
611	        workspace += os.path.sep + "bad"
612	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
613	    # Call linter

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:713:4
712	        workspace = workspace + os.path.sep + "fix"
713	    assert os.path.isdir(workspace), f"Test folder {workspace} is not existing"
714	

--------------------------------------------------
>> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
   Severity: Low   Confidence: High
   CWE: CWE-703 (https://cwe.mitre.org/data/definitions/703.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b101_assert_used.html
   Location: ./megalinter/utilstest.py:819:12
818	            ]
819	            assert (len(list(diffs))) > 0, f"No changes in the {file} file"
820	

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:81:42
80	    if item.fileUploadId:
81	        uploaded_file_path = os.path.join("/tmp/server-files", item.fileUploadId)
82	        if not os.path.isdir(uploaded_file_path):

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server.py:103:38
102	    file_upload_id = "FILE_" + str(uuid1())
103	    uploaded_file_path = os.path.join("/tmp/server-files", file_upload_id)
104	    os.makedirs(uploaded_file_path)

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.9.4/plugins/b108_hardcoded_tmp_directory.html
   Location: ./server/server_worker.py:102:34
101	        temp_dir = self.create_temp_dir()
102	        upload_dir = os.path.join("/tmp/server-files", file_upload_id)
103	        if os.path.exists(upload_dir):

--------------------------------------------------

Code scanned:
	Total lines of code: 31998
	Total lines skipped (#nosec): 0
	Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 131
		Medium: 60
		High: 8
	Total issues (by confidence):
		Undefined: 0
		Low: 44
		Medium: 41
		High: 114
Files skipped (0):

(Truncated to last 8000 characters out of 137367)

⚠️ SPELL / lychee - 63 errors

megalinter/descriptors/kubernetes.megalinter-descriptor.yml
[404] https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/%7B%7B.Group%7D%7D/%7B%7B.ResourceKind%7D%7D_%7B%7B.ResourceAPIVersion%7D%7D.json (at 72:22) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/latex.megalinter-descriptor.yml
[TIMEOUT] https://www.nongnu.org/chktex (at 26:17) | Request timed out
[TIMEOUT] https://www.nongnu.org/chktex/ (at 29:23) | Request timed out
[TIMEOUT] https://www.nongnu.org/chktex/ (at 31:38) | Request timed out

Errors in megalinter/descriptors/markdown.megalinter-descriptor.yml
[403] https://www.npmjs.com/package/markdown-table-formatter (at 103:17) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/repository.megalinter-descriptor.yml
[404] https://raw.githubusercontent.com/oxsecurity/megalinter/main/docs/assets/icons/linters/betterleaks.png (at 298:26) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/rst.megalinter-descriptor.yml
[403] https://docutils.sourceforge.io/docs/ref/rst/directives.html#raw-data-pass-through (at 36:38) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/salesforce.megalinter-descriptor.yml
[403] https://developer.salesforce.com/docs/platform/salesforce-cli-reference/guide/cli_reference_org_display.html (at 174:185) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config.html (at 188:37) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config.html (at 501:37) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-apexguru.html (at 185:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-apexguru.html (at 187:23) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-flow.html (at 498:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 303:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 403:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/get-started.html (at 74:17) | Rejected status code: 403 Forbidden
[403] https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/rules-flow.html (at 500:23) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/shared/biome.megalinter-linter.yml
[404] https://biomejs.dev/linter/rules/ (at 21:19) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/shared/cppcheck.megalinter-linter.yml
[403] https://cppcheck.sourceforge.io/ (at 3:13) | Rejected status code: 403 Forbidden
[403] https://cppcheck.sourceforge.io/ (at 4:14) | Rejected status code: 403 Forbidden
[403] https://cppcheck.sourceforge.io/manual.html#configuration (at 8:33) | Rejected status code: 403 Forbidden

Errors in megalinter/descriptors/spell.megalinter-descriptor.yml
[404] https://vale.sh/docs/topics/vocab/ (at 192:38) | Rejected status code: 404 Not Found | Followed 2 redirects. Redirects: https://vale.sh/docs/topics/vocab/ --[301]--> https://docs.vale.sh/topics/vocab/ --[302]--> https://docs.vale.sh/topics/vocab
[404] https://vale.sh/docs/vale-cli/structure/ (at 185:95) | Rejected status code: 404 Not Found | Followed 2 redirects. Redirects: https://vale.sh/docs/vale-cli/structure/ --[301]--> https://docs.vale.sh/vale-cli/structure/ --[302]--> https://docs.vale.sh/vale-cli/structure

Errors in megalinter/descriptors/sql.megalinter-descriptor.yml
[404] https://docs.sqlfluff.com/en/stable/_static/images/sqlfluff-lrg.png (at 32:23) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/terraform.megalinter-descriptor.yml
[404] https://github.com/gruntwork-io/terragrunt/blob/master/docs/assets/img/favicon/ms-icon-310x310.png (at 124:23) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://github.com/gruntwork-io/terragrunt/blob/master/docs/assets/img/favicon/ms-icon-310x310.png --[302]--> https://github.com/gruntwork-io/terragrunt/blob/main/docs/assets/img/favicon/ms-icon-310x310.png

Errors in megalinter/descriptors/tsx.megalinter-descriptor.yml
[404] https://eslint-react.xyz/docs/getting-started/installation (at 81:37) | Rejected status code: 404 Not Found

Errors in megalinter/descriptors/xml.megalinter-descriptor.yml
[406] https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home (at 38:17) | Rejected status code: 406 Not Acceptable

Errors in README.md
[301] https://future-architect.github.io/authors/%E5%AE%AE%E6%B0%B8%E5%B4%87%E5%8F%B2 (at 2048:104) | Rejected status code: 301 Moved Permanently
[TIMEOUT] https://generated.at/ (at 1371:301) | Request timed out
[404] https://github.com/oxsecurity/megalinter/stargazers (at 2214:3) | Rejected status code: 404 Not Found
[404] https://github.com/oxsecurity/megalinter/stargazers/ (at 23:1) | Error (cached)
[403] https://javascript.plainenglish.io/node-js-coding-standard-tools-with-megalinter-on-gitlab-ci-a43b55915811 (at 2031:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@caodanju/30-seconds-to-setup-megalinter-your-go-to-tool-for-automated-code-quality-and-iac-security-969d90a5a99c (at 2016:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@RunningMattress (at 2025:255) | Rejected status code: 403 Forbidden
[403] https://medium.com/@RunningMattress/level-up-your-unity-packages-with-ci-cd-9498d2791211 (at 2025:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper (at 2012:255) | Rejected status code: 403 Forbidden
[403] https://medium.com/@SeasonedDeveloper/looking-for-the-best-ci-cd-pipeline-linting-tool-try-megalinter-d89c9eba850d (at 2012:3) | Rejected status code: 403 Forbidden
[403] https://medium.com/datamindedbe/integrating-megalinter-to-automate-linting-across-multiple-codebases-a-technical-description-a200bb235b71 (at 2013:3) | Rejected status code: 403 Forbidden
[403] https://nicolas.vuillamy.fr/improve-uniformize-and-secure-your-code-base-with-megalinter-62ebab422c1 (at 2034:3) | Rejected status code: 403 Forbidden
[403] https://nicolas.vuillamy.fr/megalinter-sells-his-soul-and-joins-ox-security-2a91a0027628 (at 2033:3) | Rejected status code: 403 Forbidden
[403] https://nklya.medium.com/ (at 2030:255) | Rejected status code: 403 Forbidden
[403] https://nklya.medium.com/hot-to-linter-basic-things-like-trailing-whitespaces-and-newlines-7b40da8f688d (at 2030:3) | Rejected status code: 403 Forbidden
[403] https://npmjs.org/package/mega-linter-runner (at 1286:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1287:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 1288:1) | Error (cached)
[403] https://npmjs.org/package/mega-linter-runner (at 21:1) | Error (cached)
[403] https://openai.com/codex/ (at 240:1) | Rejected status code: 403 Forbidden
[403] https://pmd.sourceforge.io/pmd-6.55.0/pmd_userdocs_tools_ci.html (at 2119:3) | Rejected status code: 403 Forbidden
[403] https://www.npmjs.com/package/@downatthebottomofthemolehole/megalinter-mcp-server (at 1990:354) | Rejected status code: 403 Forbidden
[404] https://www.programmez.com/page-devcon/devcon-20-100-securite-qualite-du-code (at 2068:35) | Rejected status code: 404 Not Found

Hint: Followed 797 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: Rejected redirectional status codes. This means some redirects were not followed. You might want to increase the limit for `-m`/`--max-redirects`.

(Truncated to last 8000 characters out of 34542)

⚠️ MARKDOWN / markdownlint - 358 errors

in the same document [Context: "Docker container"]
docs/install-drone.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Drone CI"]
docs/install-github.md:10 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Action"]
docs/install-gitlab.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitLab CI"]
docs/install-jenkins.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Jenkins"]
docs/install-jenkins.md:40 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "PR Comment Reporting from Jenk..."]
docs/install-locally.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Run MegaLinter locally"]
docs/install-version.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Which version to use ?"]
docs/license-explanations.md:7 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Why AGPL V3 License ?"]
docs/mega-linter-vs-super-linter.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "MegaLinter vs Super-Linter"]
docs/plugins.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Plugins"]
docs/quick-start.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Quick Start"]
docs/removed-linters.md:9 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Removed linters"]
docs/reporters.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Reporters"]
docs/reporters/AzureCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Azure Comment Reporter"]
docs/reporters/BitbucketCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Bitbucket Comment Reporter"]
docs/reporters/ConfigReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "IDE Configuration Reporter"]
docs/reporters/ConsoleReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Console Reporter"]
docs/reporters/EmailReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "E-mail Reporter"]
docs/reporters/FileIoReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "File.io Reporter"]
docs/reporters/GitHubCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Comment Reporter"]
docs/reporters/GitHubCommentReporter.md:27:196 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:27:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:27:174 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:27:196 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:28:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:160 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:28:179 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:29:48 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:143 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:29:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD056/table-column-count Table column count [Expected: 4; Actual: 3; Too few cells, row will be missing data]
docs/reporters/GitHubCommentReporter.md:30:46 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:152 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubCommentReporter.md:30:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/reporters/GitHubStatusReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "GitHub Status Reporter"]
docs/reporters/GitlabCommentReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Gitlab Comment Reporter"]
docs/reporters/JsonReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "JSON Reporter"]
docs/reporters/MarkdownSummaryReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Markdown Summary Reporter"]
docs/reporters/SarifReporter.md:6 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "SARIF Reporter (beta)"]
docs/reporters/TapReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "TAP Reporter"]
docs/reporters/TextReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Text Reporter"]
docs/reporters/UpdatedSourcesReporter.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Updated Sources Reporter"]
docs/special-thanks.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Special thanks"]
docs/special-thanks.md:23:3 error MD045/no-alt-text Images should have alternate text (alt text)
docs/sponsor.md:5 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Sponsoring"]
docs/supported-linters.md:9 error MD025/single-title/single-h1 Multiple top-level headings in the same document [Context: "Supported Linters"]
mega-linter-runner/README.md:27:274 error MD051/link-fragments Link fragments should be valid [Context: "[**apply formatting and auto-fixes**](#apply-fixes)"]
mega-linter-runner/README.md:27:217 error MD051/link-fragments Link fragments should be valid [Context: "[**reports in several formats**](#reports)"]
README.md:220:127 error MD051/link-fragments Link fragments should be valid [Context: "[many additional features](#mega-linter-vs-super-linter)"]
README.md:2241:3 error MD045/no-alt-text Images should have alternate text (alt text)
skills/megalinter-check/performance.md:27:601 error MD013/line-length Line length [Expected: 600; Actual: 713]
skills/megalinter-setup/agents/megalinter-runner.md:33:601 error MD013/line-length Line length [Expected: 600; Actual: 620]

(Truncated to last 8000 characters out of 47333)

⚠️ YAML / prettier - 14 errors

lestyles/proselint/Hedging.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Hyperbole.yml 1ms (unchanged)
.github/linters/valestyles/proselint/Jargon.yml 1ms (unchanged)
.github/linters/valestyles/proselint/LGBTOffensive.yml 1ms (unchanged)
.github/linters/valestyles/proselint/LGBTTerms.yml 1ms (unchanged)
.github/linters/valestyles/proselint/Malapropisms.yml 1ms (unchanged)
.github/linters/valestyles/proselint/Needless.yml 31ms (unchanged)
.github/linters/valestyles/proselint/Nonwords.yml 5ms (unchanged)
.github/linters/valestyles/proselint/Oxymorons.yml 3ms (unchanged)
.github/linters/valestyles/proselint/P-Value.yml 2ms (unchanged)
.github/linters/valestyles/proselint/RASSyndrome.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Skunked.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Spelling.yml 2ms (unchanged)
.github/linters/valestyles/proselint/Typography.yml 3ms (unchanged)
.github/linters/valestyles/proselint/Uncomparables.yml 3ms (unchanged)
.github/linters/valestyles/proselint/Very.yml 1ms (unchanged)
.github/release-drafter.yml 8ms (unchanged)
.grype.yaml 2ms (unchanged)
.mega-linter.yml 8ms (unchanged)
.pre-commit-hooks.yaml 5ms (unchanged)
action.yml 2ms (unchanged)
codecov.yml 1ms (unchanged)
mega-linter-runner/.eslintrc.yml 2ms (unchanged)
mega-linter-runner/.mega-linter.yml 5ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/action.yml 2ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/check-new-megalinter-version.yml 9ms (unchanged)
mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml 13ms (unchanged)
[error] mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml: SyntaxError: Implicit map keys need to be followed by map values (6:1)
[error]   4 | label: <%= CUSTOM_FLAVOR_LABEL %>
[error]   5 | linters:
[error] > 6 | <%= CUSTOM_FLAVOR_LINTERS %>
[error]     | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[error]   7 |
mega-linter-runner/generators/mega-linter-custom-flavor/templates/zizmor.yml 2ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/.drone.yml 2ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/.gitlab-ci.yml 2ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/azure-pipelines.yml 5ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/bitbucket-pipelines.yml 3ms (unchanged)
mega-linter-runner/generators/mega-linter/templates/concourse-task.yml 3ms (unchanged)
[error] mega-linter-runner/generators/mega-linter/templates/mega-linter.yml: SyntaxError: Implicit map keys need to be followed by map values (67:11)
[error]   65 |           # Only define `secrets.PAT` if you fully understand the trade-off.
[error]   66 |           token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
[error] > 67 |           <%- PERSIST_CREDENTIALS %>
[error]      |           ^^^^^^^^^^^^^^^^^^^^^^^^^^
[error]   68 |
[error]   69 |           # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to
[error]   70 |           # improve performance
megalinter/descriptors/action.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/ansible.megalinter-descriptor.yml 12ms (unchanged)
megalinter/descriptors/api.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/arm.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/bash.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/bicep.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/c.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/clojure.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/cloudformation.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/coffee.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/copypaste.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/cpp.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/csharp.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/css.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/dart.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/dockerfile.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/editorconfig.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/env.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/gherkin.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/go.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/graphql.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/groovy.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/html.megalinter-descriptor.yml 9ms (unchanged)
megalinter/descriptors/java.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/javascript.megalinter-descriptor.yml 8ms (unchanged)
megalinter/descriptors/json.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/jsx.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/kotlin.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/kubernetes.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/latex.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/lua.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/markdown.megalinter-descriptor.yml 11ms (unchanged)
megalinter/descriptors/perl.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/php.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/powershell.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/protobuf.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/python.megalinter-descriptor.yml 55ms (unchanged)
megalinter/descriptors/r.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/raku.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/repository.megalinter-descriptor.yml 67ms (unchanged)
megalinter/descriptors/robotframework.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/rst.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/ruby.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/rust.megalinter-descriptor.yml 3ms (unchanged)
megalinter/descriptors/salesforce.megalinter-descriptor.yml 15ms (unchanged)
megalinter/descriptors/scala.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/shared/biome.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/shared/clang-format.megalinter-linter.yml 2ms (unchanged)
megalinter/descriptors/shared/cppcheck.megalinter-linter.yml 2ms (unchanged)
megalinter/descriptors/shared/cpplint.megalinter-linter.yml 2ms (unchanged)
megalinter/descriptors/shared/dotnet-format.megalinter-linter.yml 2ms (unchanged)
megalinter/descriptors/shared/eslint.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/shared/prettier.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/shared/v8r.megalinter-linter.yml 3ms (unchanged)
megalinter/descriptors/snakemake.megalinter-descriptor.yml 6ms (unchanged)
megalinter/descriptors/spell.megalinter-descriptor.yml 17ms (unchanged)
megalinter/descriptors/sql.megalinter-descriptor.yml 5ms (unchanged)
megalinter/descriptors/swift.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/tekton.megalinter-descriptor.yml 4ms (unchanged)
megalinter/descriptors/terraform.megalinter-descriptor.yml 20ms (unchanged)
megalinter/descriptors/tsx.megalinter-descriptor.yml 10ms (unchanged)
megalinter/descriptors/typescript.megalinter-descriptor.yml 7ms (unchanged)
megalinter/descriptors/vbdotnet.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/xml.megalinter-descriptor.yml 2ms (unchanged)
megalinter/descriptors/yaml.megalinter-descriptor.yml 5ms (unchanged)
server/docker-compose-dev.yml 2ms (unchanged)
server/docker-compose.yml 2ms (unchanged)
trivy-secret.yaml 1ms (unchanged)
zizmor.yml 2ms (unchanged)

(Truncated to last 8000 characters out of 12544)

⚠️ YAML / yamllint - 51 errors

.grype.yaml
  6:1       warning  missing document start "---"  (document-start)

mega-linter-runner/.eslintrc.yml
  11:9      warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor-builder.yml
  48:15     warning  too few spaces inside empty braces  (braces)

mega-linter-runner/generators/mega-linter-custom-flavor/templates/megalinter-custom-flavor.yml
  7:1       error    syntax error: could not find expected ':' (syntax)

mega-linter-runner/generators/mega-linter/templates/mega-linter.yml
  38:15     warning  too few spaces inside empty braces  (braces)
  69:11     error    syntax error: could not find expected ':' (syntax)

megalinter/descriptors/copypaste.megalinter-descriptor.yml
  19:301    warning  line too long (313 > 300 characters)  (line-length)
  25:301    warning  line too long (384 > 300 characters)  (line-length)

megalinter/descriptors/javascript.megalinter-descriptor.yml
  52:301    warning  line too long (475 > 300 characters)  (line-length)
  326:301   warning  line too long (307 > 300 characters)  (line-length)
  352:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/json.megalinter-descriptor.yml
  115:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/jsx.megalinter-descriptor.yml
  29:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/perl.megalinter-descriptor.yml
  25:301    warning  line too long (310 > 300 characters)  (line-length)

megalinter/descriptors/php.megalinter-descriptor.yml
  202:301   warning  line too long (389 > 300 characters)  (line-length)
  216:301   warning  line too long (302 > 300 characters)  (line-length)

megalinter/descriptors/repository.megalinter-descriptor.yml
  27:301    warning  line too long (666 > 300 characters)  (line-length)
  194:301   warning  line too long (408 > 300 characters)  (line-length)
  300:301   warning  line too long (345 > 300 characters)  (line-length)
  538:301   warning  line too long (306 > 300 characters)  (line-length)
  616:301   warning  line too long (374 > 300 characters)  (line-length)
  701:301   warning  line too long (316 > 300 characters)  (line-length)
  1163:301  warning  line too long (358 > 300 characters)  (line-length)
  1226:301  warning  line too long (346 > 300 characters)  (line-length)
  1233:301  warning  line too long (307 > 300 characters)  (line-length)

megalinter/descriptors/salesforce.megalinter-descriptor.yml
  54:301    warning  line too long (359 > 300 characters)  (line-length)
  158:301   warning  line too long (390 > 300 characters)  (line-length)
  170:301   warning  line too long (408 > 300 characters)  (line-length)
  174:301   warning  line too long (413 > 300 characters)  (line-length)

megalinter/descriptors/spell.megalinter-descriptor.yml
  183:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/sql.megalinter-descriptor.yml
  27:301    warning  line too long (403 > 300 characters)  (line-length)

megalinter/descriptors/terraform.megalinter-descriptor.yml
  28:301    warning  line too long (330 > 300 characters)  (line-length)
  43:301    warning  line too long (330 > 300 characters)  (line-length)
  97:301    warning  line too long (346 > 300 characters)  (line-length)
  164:301   warning  line too long (328 > 300 characters)  (line-length)
  239:301   warning  line too long (307 > 300 characters)  (line-length)
  250:301   warning  line too long (386 > 300 characters)  (line-length)
  304:301   warning  line too long (302 > 300 characters)  (line-length)
  319:301   warning  line too long (334 > 300 characters)  (line-length)
  329:301   warning  line too long (525 > 300 characters)  (line-length)
  339:301   warning  line too long (315 > 300 characters)  (line-length)
  343:301   warning  line too long (436 > 300 characters)  (line-length)

megalinter/descriptors/tsx.megalinter-descriptor.yml
  29:301    warning  line too long (475 > 300 characters)  (line-length)

megalinter/descriptors/typescript.megalinter-descriptor.yml
  39:301    warning  line too long (475 > 300 characters)  (line-length)
  318:301   warning  line too long (314 > 300 characters)  (line-length)
  344:301   warning  line too long (315 > 300 characters)  (line-length)

megalinter/descriptors/yaml.megalinter-descriptor.yml
  38:301    warning  line too long (315 > 300 characters)  (line-length)

mkdocs.yml
  8:301     warning  line too long (590 > 300 characters)  (line-length)
  86:5      warning  wrong indentation: expected 6 but found 4  (indentation)
  100:5     warning  wrong indentation: expected 6 but found 4  (indentation)

zizmor.yml
  1:1       warning  missing document start "---"  (document-start)

✅ Linters with no issues

actionlint, bash-exec, betterleaks, black, checkov, cspell, flake8, git_diff, grype, hadolint, isort, jscpd, jsonlint, markdown-table-formatter, mypy, npm-groovy-lint, osv-scanner, pylint, ruff, secretlint, shellcheck, shfmt, spectral, syft, trivy, trivy-sbom, trufflehog, v8r, v8r, xmllint, zizmor

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

nvuillam · 2026-10-26T19:52:24Z

DEV/Linters (powershell_powershell_formatter) fails, but not because of this PR: every test reports The term 'Invoke-Formatter' is not recognized, meaning the PSScriptAnalyzer module is missing from the built powershell_formatter image. This PR does not change that image's install steps, and the failing tests run as root (HOME=/root), where the new setup-runtime-user.sh code is never reached.

Likely cause: RUN pwsh -c 'Install-Module -Name PSScriptAnalyzer ...' exits 0 even when the PowerShell Gallery download fails, so a transient gallery error produces an image without the module. No fix exists yet; a possible hardening is adding -ErrorAction Stop (or $ErrorActionPreference='Stop') to that install line in powershell.megalinter-descriptor.yml. I'll re-run the failed job once when the run completes.

Generated by Claude Code

…magupta-8zlr95 # Conflicts: # CHANGELOG.md

fix: let Go linters write their caches when running as non-root user

a3c4469

Set GOMODCACHE and GOCACHE under the runtime user home when switching to MEGALINTER_UID/MEGALINTER_GID, unless already defined. Add a runtime test with a Go fixture that has an external dependency. Fixes #9280

nvuillam requested review from Kurt-von-Laven, bdovaz and echoix as code owners October 26, 2026 18:13

nvuillam had a problem deploying to dev October 26, 2026 18:13 — with GitHub Actions Failure

nvuillam had a problem deploying to dev October 26, 2026 18:13 — with GitHub Actions Error

Add GOMODCACHE and GOCACHE to cspell dictionary

d72e80d

nvuillam deployed to dev October 26, 2026 18:36 — with GitHub Actions Active

Merge remote-tracking branch 'origin/main' into claude/practical-brah…

f508ab1

…magupta-8zlr95 # Conflicts: # CHANGELOG.md

nvuillam deployed to dev October 27, 2026 00:45 — with GitHub Actions Active

Navigation Menu

Repository navigation

Fix Go linters failing as non-root user (MEGALINTER_UID) because of root-owned GOPATH cache - #9326

Fix Go linters failing as non-root user (MEGALINTER_UID) because of root-owned GOPATH cache#9326
nvuillam wants to merge 3 commits into
mainfrom
claude/practical-brahmagupta-8zlr95

nvuillam commented Oct 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

nvuillam commented Oct 26, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nvuillam commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Changes

Testing

Uh oh!

github-actions Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅⚠️MegaLinter analysis: Success with warnings

✅ Linters with no issues

Uh oh!

nvuillam commented Oct 26, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nvuillam commented Oct 26, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading