ci: add super-linter (soft launch) - #1
Conversation
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter GITHUB_ACTIONS_ZIZMORJSCPD |
5b27f39 to
9acaca3
Compare
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter JSCPD |
9acaca3 to
1a5b4ea
Compare
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter JSCPD |
1a5b4ea to
b4dbf2c
Compare
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
b4dbf2c to
c8b4b9d
Compare
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter JSCPD |
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter JSCPD |
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter JSCPD |
The default 10% threshold catches intentional duplication in test/runbook templates. Raising to 30% with explicit ignore patterns for tests/.
… SHA - Top-level permissions reduced to 'contents: read' (least-privilege). - Job-level adds 'statuses: write' + 'pull-requests: write' for super-linter. - Bumped LukeEvansTech/shared-workflows pin to current v1 SHA. Resolves zizmor excessive-permissions on the lint.yml caller.
The pinned SHA (57fff6de) predates the 2026-05-07 JSCPD decision, so this branch was still running a linter that shared-workflows now sets to VALIDATE_JSCPD: false. JSCPD was the only failing check on the PR. Repointed at 3771e1f9, the SHA already in use across the estate, and removed .github/linters/.jscpd.json — with JSCPD disabled centrally the config file has nothing to configure. Claude-Session: https://claude.ai/code/session_011TnDL1H3UpksfZa17pUukz
4b54d7b to
e9b73c4
Compare
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
Clears the Mend repository problem on this repo: >⚠️ Hidden Unicode characters have been discovered in file(s) in your repository. … Please confirm that they are intended to be there, as they could be an attempt to "smuggle" text into your codebase, or used to confuse tools like Renovate or Large Language Models (LLMs) ## What it was — benign, but worth removing A **single U+200B (zero-width space)** at `test_results.csv:2865`, trailing the end of an Entra recommendation description: ```text …enhancing overall security posture.<U+200B>",High,Maester|Entra|Security|… ``` That is a copy-paste artifact from the Microsoft source text, not anything hostile. A full scan (zero-width, BOM, bidi overrides, soft hyphen, word-joiner ranges) found **no other invisible characters** anywhere in the repository. Renovate's warning is still the right call — an invisible character in a committed file is exactly the shape of a text-smuggling attempt, and it is worth keeping the detector meaningful rather than muting it. ## How Removed **binary-safely** so the file's CRLF line endings survive — a naive text-mode rewrite re-wrote all 4,125 lines. The diff is one line; 340,619 → 340,616 bytes. Worth a separate decision: `test_results.csv` is a 4,127-line Maester **run artifact** committed to the repo (added in #1) and nothing in-repo generates it. If it is meant to be a snapshot, fine; if not, it may belong in `.gitignore` / a workflow artifact instead. Not changed here.
Adds soft-launched super-linter via the shared reusable workflow at
LukeEvansTech/shared-workflows@v1. Lint findings appear in the workflow step summary and as a PR comment; failures do not block merges. See https://github.com/LukeEvansTech/shared-workflows/blob/main/docs/spec.md.