[emsearcy]

Summary

Adds lfx-megalinter, a skill capturing fleet-wide MegaLinter and CI-standardization conventions so repos resolve recurring lint/scan failures the same way.

• Version pinning: standardizes on MegaLinter v10.1.0 — workflow SHA plus per-flavor Makefile image digests (go, python, javascript, cupcake). Upgrades are done by updating and re-testing the skill, then rolling out.
• Makefile targets: megalinter runs the Docker image; lint is reserved for local-toolchain linting.
• Removed-linters sweep when moving a repo to the pinned release (e.g. REPOSITORY_KICS).
• Go toolchain policy (references/go-toolchain.md): latest patch of the previous minor Go release, capped at MegaLinter's bundled minor, applied without user input; dependency CVE fixes that would raise the minor are reverted and recorded as ID-scoped exceptions. Replaces repo-level Go version rules unless the repo explicitly supersedes the skill.
• Always set GOTOOLCHAIN=auto (workflow step env and Makefile docker run -e), with the patch-gap and minor-gap failure signatures documented.
• Stale suppression cleanup for .trivyignore, .grype.yaml, and osv-scanner.toml.
• Linter fixes (references/linter-fixes.md): Trivy rate limits, re-enabling golangci-lint alongside revive, cspell, zizmor online/offline and github-app false positive, ESLint flat config, yamllint.
• Shared cspell flagWords: the org-wide list from lfx-public-workflows/cspell, fetched at a pinned SHA via SPELL_CSPELL_PRE_COMMANDS/POST_COMMANDS, with the rationale for each safeguard.
• gitleaks → betterleaks: gitleaks findings are resolved by upgrading to the pinned release (no gitleaks tuning), followed by explicit migration of gitleaks config, ignore files, annotations, and settings to betterleaks names; betterleaks:allow for localized false positives.
• Adjacent CI fixes (references/adjacent-ci-fixes.md): Goa version sync and jq recipe, ko-build-tag tag stripping, license-header-check exclusion.

Registers the skill in README.md and the lfx router.

Resolves: linuxfoundation/lfx-self-serve-ops#508
Parent epic (Jira): ARCH-408

🤖 Generated with GitHub Copilot (via OpenCode)

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[Copilot]

🟡 Changes recommended

Several instructions can break lint/build workflows, remove active scanner configuration, or unnecessarily disable security audits.

5 open findings

• Go dependency parsing returns the module path instead of its version · New
• npm ci omits devDependencies needed by the lint toolchain · New
• Deleting Betterleaks configuration removes active rules and allowlists · New
• Cover private action targets outside the workflow repository · New
• Disable online audits unnecessarily for public Dependabot targets · New

What changed in this PR

Adds lfx-megalinter to standardize MegaLinter configuration and CI troubleshooting across LFX repositories.

Changes:

• Defines release pins, Go toolchain policy, and suppression cleanup.
• Adds linter-specific and adjacent CI repair guidance.
• Registers the skill in the README and router.

File	Description
skills/​lfx/​SKILL.md	Routes MegaLinter requests to the new skill.
skills/​lfx-megalinter/​SKILL.md	Defines the shared MegaLinter workflow.
skills/​lfx-megalinter/​references/​linter-fixes.md	Documents linter troubleshooting.
skills/​lfx-megalinter/​references/​go-toolchain.md	Defines Go compatibility policy.
skills/​lfx-megalinter/​references/​adjacent-ci-fixes.md	Documents related build and CI fixes.
README.md	Lists the skill and its resources.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The migration instructions can discard active secret-scanner rules and allowlists.

6 open findings

• npm ci omits devDependencies needed by the lint toolchain
• Go dependency parsing returns the module path instead of its version
• Do not delete active .gitleaks.toml configuration · New
• Disable online audits unnecessarily for public Dependabot targets
• Cover private action targets outside the workflow repository
• Deleting Betterleaks configuration removes active rules and allowlists

🧠 Review effort: Balanced

[emsearcy]

Review Feedback Addressed

Commit: 7ad4140

Changes Made

• references/adjacent-ci-fixes.md: derive GOA_VERSION with go list so single-line require works (per copilot-pull-request-reviewer)
• references/linter-fixes.md: npm ci --include=dev for the ESLint pre-command, since the JavaScript image sets NODE_ENV=production (per copilot-pull-request-reviewer)
• references/linter-fixes.md, SKILL.md: explicit gitleaks → betterleaks migration of config, ignore files, inline annotations, and settings instead of deleting them (per copilot-pull-request-reviewer, 2 threads)
• references/linter-fixes.md: zizmor offline mode for any private uses: target other than the workflow's own repo; removed the Dependabot exception (per copilot-pull-request-reviewer, 2 threads)

Threads Resolved

6 of 6 unresolved threads addressed in this iteration.

[Copilot]

🔵 Needs a closer look

The Go downgrade guidance can leave a newer toolchain selected, preserving the incompatibility it aims to resolve.

0 open findings

6 resolved since last review

• npm ci omits devDependencies needed by the lint toolchain
• Go dependency parsing returns the module path instead of its version
• Do not delete active .gitleaks.toml configuration
• Disable online audits unnecessarily for public Dependabot targets
• Cover private action targets outside the workflow repository
• Deleting Betterleaks configuration removes active rules and allowlists

Previously missed (2)

In code that hasn't changed since last review

Align toolchain pins and workspace directives with the Go minor cap

skills/​lfx-megalinter/​references/​go-toolchain.md:15

With GOTOOLCHAIN=auto, lowering only the go directive does not enforce the minor cap. For example, go 1.26.3 together with toolchain go1.27.0 still selects Go 1.27.0. An active go.work can also override the module's selection. Align or remove higher toolchain pins and check workspace directives, including when following the downgrade remedy at lines 163–164; otherwise the documented linter incompatibility can remain.

Avoid removing exceptions whose blockers still apply

skills/​lfx-megalinter/​SKILL.md:202

Make removal conditional on confirming that the exception is stale. This sweep also matches valid exceptions—for example, a fix requiring Go 1.27 while the policy remains capped at 1.26. Steps 1–3 do not exclude those entries, so step 4 instructs agents to delete them despite the retention rule in references/go-toolchain.md:24–30. Keep exceptions whose blocker still applies; remove them from all scanners only after their removal condition is satisfied.

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

Previous feedback is addressed, and no unresolved blocking issues remain.

No open issues 🎉

_{Review effort: Balanced}

[audigregorie]

PR Review — #84: feat(skills): add lfx-megalinter skill

Branch: feat/lfx-megalinter-skill → main
Reviewed commits: 11024a48c7b474df494f0bdc42f4aab92ce6d03e..fe117f326b6646526379d7667d02e350b85ff68f
Commits: 4 | Files changed: 6 | Scope: skill instructions and discovery
Issue counts: Critical: 0 | Major: 1 | Minor: 2

Major Issues 🟡

• skills/lfx-megalinter/references/go-toolchain.md:12–15 — The go directive alone does not cap the toolchain selected by GOTOOLCHAIN=auto; an existing toolchain directive or active go.work can still select the unsupported newer minor. Align those selectors when applying the policy. Check: Step 5 — Correctness / Regression.

Minor Issues 🔵

• skills/lfx-megalinter/references/linter-fixes.md:35–37 — //nolint: does not suppress standalone Revive; document its own rule-scoped //revive: directives separately. Check: CLAUDE.md reference accuracy; repository review lens — actionable instructions.
• skills/lfx-megalinter/references/linter-fixes.md:132 — Host-side migration assumes undeclared gsed, so standard Linux hosts fail after the file renames. Select a suitable executable before making changes. Check: Step 5 — Correctness / Edge cases.

Each retained defect is submitted as its own review thread with detailed evidence and a suggested fix.

What's Done Well ✅

• The workflow SHA and all four image digests match upstream MegaLinter v10.1.0 (checked against the commit API and GHCR manifest metadata).
• The skill is discoverable through both distribution paths; README/router entries are updated, and detailed guidance is split into explicitly linked references.
• Shared cspell setup includes a pinned fetch, bounded timeouts, exact-count placeholder guard, fail-fast pre-command, and restoration of the original local config.

Review coverage and limitations

• Read all six changed files in full at the pinned head, plus applicable root CLAUDE.md/repository review rules, relevant sibling skill patterns, router ownership guidance, plugin manifest, installer, and tool mapping.
• Completed consistency, truthfulness, rules, correctness, edge-case, security, integration/data, and regression passes as applicable to these instructions. Inspected official pinned MegaLinter sources for tool/environment handling, linter configuration, pre/post commands and migration; pinned Revive docs/parser; Go toolchain-selection docs; zizmor source; shared cspell and license-workflow sources. A fresh read-only reviewer independently identified both linter-reference defects.
• Frontend/backend/cross-app checklists do not apply to this Markdown-only scope; root CLAUDE.md and its linked review rules were available.
• Read linked issue linuxfoundation/lfx-self-serve-ops#508. It differs from the PR on some rollout/Go policies; this intent ambiguity is not counted as a defect. The linked Jira epic was not inspected.
• Tests, lint, type checks, builds, runtime behavior and assertion strength were not assessed. This is source inspection, not runtime verification; no PR snippets were executed and no source files were changed.

Rating: ⭐⭐⭐☆☆ — 3/5

Review outcome: COMMENT — one Major and two Minor findings

[audigregorie]

Major — Cap the selected toolchain, not only the go directive

Check: Step 5 — Correctness / Regression.

This policy changes only go.mod's go directive, while the skill requires GOTOOLCHAIN=auto. A module with go 1.26.9 and an existing toolchain go1.27.0 still selects Go 1.27. An active go.work can likewise take precedence over the module's version settings. The prescribed downgrade can therefore leave package analysis using the unsupported newer minor and retain the minor-gap failures described later in this reference.

Go's official toolchain-selection rules explicitly consult the workspace first and prefer a newer toolchain directive. Nothing in this skill reconciles either setting.

Suggested fix: When applying the minor cap, inspect and align/remove an incompatible toolchain directive and reconcile any active go.work version directives as well; do not present changing only the module's go line as sufficient.

[audigregorie]

Minor — Use Revive's own directives for standalone GO_REVIVE

Check: CLAUDE.md — “check that every cross-reference (files, skills, commands, external facts) actually resolves”; repo review lens — reference accuracy and actionable instructions.

This section explicitly requires both GO_GOLANGCI_LINT and standalone GO_REVIVE to remain blocking, but its only false-positive suppression is //nolint:<linter>. That is understood by golangci-lint, not standalone Revive. Revive v1.16.0's directive parser matches only //revive:(enable|disable)..., so applying this advice to a standalone Revive finding leaves it unsuppressed.

Suggested fix: Split the guidance: keep //nolint:<linter> // <reason> for golangci-lint, and use //revive:disable-next-line:<rule> <reason> or //revive:disable-line:<rule> <reason> for standalone Revive, as documented in its comment directives.

[audigregorie]

Minor — Select an available sed executable before starting migration

Check: Step 5 — Correctness / Edge cases; repo review lens — actionable instructions.

This Bash snippet runs on the contributor's host, not inside MegaLinter. It invokes gsed without checking or declaring that prerequisite. Standard Linux installations provide GNU sed as sed, not gsed, so a Linux contributor with matching annotations reaches a command-not-found failure after the two git mv operations have already renamed the configuration files. The documented annotation migration is then incomplete.

Suggested fix: Detect/select sed on Linux and an available GNU sed binary on macOS before any mutations, or use a portable replacement procedure. Document any extra prerequisite rather than assuming the Homebrew-style executable name exists everywhere.