Agent skills: handle MegaLinter auto-fix commits when watching CI, and set up custom flavor repositories - #8713
Merged
Conversation
…d set up custom flavor repositories - megalinter-check: detect the [MegaLinter] Apply linters fixes commit pushed by the CI job, amend it with a robot emoji and re-push with --force-with-lease so the checks re-run (providers ignore pushes made with the CI token). Guarded: skipped when a commit landed after it, when already amended, when local commits are pending, when the tree is dirty; user is asked first on the default branch - megalinter-watcher stays read-only and only reports the commit in its output contract; the skill performs the git write - megalinter/megalinter-fix/README: document the single authorized force-push case - megalinter-setup: new custom-flavor.md guide, loaded only on explicit request, covering reuse of a flavor the user owns or administers, repository creation, generator, publishing, AGPL-3.0, consumption and maintenance
nvuillam
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
August 10, 2026 06:56
The skills shipped in skills/ are installed separately from the Docker image (npx skills add oxsecurity/megalinter) and target readers who drive MegaLinter through a coding agent, so they get their own user-facing section next to mega-linter-runner instead of being mixed into Core. Convention recorded in .claude/rules/changelog.md, the single source of truth the implement skill and prepare-release defer to.
Contributor
✅
|
…mode An upgraded repository could still be driven by skills and sub-agent definitions copied at install time for an older MegaLinter version. Upgrade mode now inspects the install with 'npx skills list' (skipping local sources it must not touch), updates the four MegaLinter skills by name so unrelated project skills are left alone, falls back to re-running 'skills add' when the copies are untracked, then re-applies the sub-agent definitions - which 'skills update' never touches, since they live in the platform agents folder - and re-reads its own SKILL.md, which the refresh may have just rewritten.
'unpushed' is not in the project dictionary; 'local commits left to push' says the same thing without extending the word list.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent improvements to the public agent skills in
skills/(installed by users withnpx skills add oxsecurity/megalinter).1. Handle the commit MegaLinter pushes itself
A repository using
APPLY_FIXES_MODE: commitlets the MegaLinter job push[MegaLinter] Apply linters fixesonto the watched branch. CI providers deliberately ignore pushes made with the CI token (loop prevention), so the branch keeps the stale checks of the run that produced the fixes — typically a PR stuck on pending or failed checks that the fixes already resolved.The skills now amend that commit with a 🤖 prefix and re-push it with
--force-with-lease, which produces a genuine push event and re-triggers the checks.Responsibility split —
megalinter-watcher(haiku, contractually read-only) only detects and reports the commit in its JSON output contract;megalinter-checkperforms the rebase, amend and push. No git-write power moves into the low-cost agent.Detection is pure git, so it behaves identically on GitHub, GitLab, Azure and Bitbucket.
Guards — nothing is amended unless all hold:
main/masterThis is documented as the only authorized force-push in these skills (never plain
--force), inmegalinter/SKILL.md,megalinter-check,megalinter-fixand the skills README.2. Custom flavor repositories in
megalinter-setupNew
skills/megalinter-setup/custom-flavor.md, loaded only when the user explicitly asks (same conditional-load pattern asproviders/*.mdandperformance.md), so the main skill's context stays small.SKILL.mdgains a 2-line pointer and a mention in itsdescriptionfor discoverability.It covers the full lifecycle: reuse first (search the user's own account and organizations, verify
permissions.admin— a third party's flavor is explicitly not a reuse candidate since it cannot be rebuilt, updated or audited by the user), repository creation withgh repo create, the generator, the two lint exceptions on the generated files (zizmorref-pinwaiver, checkovCKV_GHA_7), publishing (with thePAT_TOKENpresented as optional and worth declining, per the security warning in the docs), AGPL-3.0 obligations, consuming the image, and maintenance (extend the linter list, follow new MegaLinter releases).Validation
git push --force-with-leasefails on branches with no upstream tracking, so the snippet now names the remote and branch explicitly.ghcommand was executed against the real CLI, and the generated-repo structure andmegalinter-custom-flavor.ymlshape were verified against an existing published flavor.markdownlint-cli@0.49.1(the version pinned by the descriptor) with the repository config is clean on all changed files — including three pre-existing over-long lines in the files touched here, now wrapped.3. New
Agent SkillsCHANGELOG sectionThe skills in
skills/are installed separately from the Docker image (npx skills add oxsecurity/megalinter) and address readers who drive MegaLinter through a coding agent, so they now get their own user-facing CHANGELOG section next tomega-linter-runnerrather than being folded intoCore. The convention is recorded in.claude/rules/changelog.md— the single source of truth that theimplementskill andprepare-releasedefer to — including that refreshes of the generatedgenerated-descriptor-infoblocks inskills/megalinter-fix/linters/*.mdnever get an entry, like linter version bumps.4.
megalinter-setuprefreshes installed skills and sub-agents in upgrade modeThe repository configuration was only half of an upgrade: the skills being executed, and the sub-agent definitions they installed, were copied at install time and never updated — so an upgraded repository could keep being driven by guidance written for an older MegaLinter.
Upgrade mode now inspects the install with
npx skills list(entries whoseSourceislocalare left alone — they are the MegaLinter repository's own files or a manual copy), then runsnpx skills update megalinter megalinter-setup megalinter-check megalinter-fix -y. The skills are named explicitly so a bare update cannot touch unrelated project skills, with a documented fallback to re-runningskills addwhen copies are untracked (--copyinstalls are not always tracked).Two things the CLI does not cover are handled explicitly:
.claude/agents/,.opencode/agent/,.github/agents/) and are never rewritten byskills update, so step 4 is re-applied, preserving user customizations such as a model override or an adaptedtoolslist.SKILL.mdand continue from the updated version.The
skillsCLI surface used here (update, its-p/-g/-yoptions, andlistreporting each skill's source) was verified against the CLI itself rather than assumed.