Never build a lint command with an empty list of files - #8809
Merged
Conversation
nvuillam
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
August 26, 2026 22:23
Contributor
✅
|
REPOSITORY_CHECKOV failed with "argument -f/--file: expected at least one argument" in a Pull Request where git diff listed no updated file: the checkov class appends "--file" plus the updated files whenever VALIDATE_ALL_CODEBASE is false and the run is a PR, even when that list is empty. - checkov: the "--file" argument is added only when the Pull Request actually contains updated files, and only in project lint mode (in file and list_of_files modes MegaLinter already sends the updated files it kept). When the Pull Request contains no updated file at all, checkov is deactivated instead of scanning the whole project, which the user opted out of with VALIDATE_ALL_CODEBASE=false - Linter: a linter running in list_of_files mode with no file to lint does not run its command anymore. Descriptors declaring lint_all_files (all REPOSITORY linters) keep such linters active with zero file, and the arguments introducing the list of files (--file, --input, --source-code) were left without value, making the linter fail on its own arguments - Linter: build_lint_command does not append cli_lint_mode_list_of_files_extra_args_after when there is no file - test: cover the PR diff scan of checkov and the empty file list guard Fixes: #8802
nvuillam
force-pushed
the
fix/empty-file-list-broken-command
branch
from
August 27, 2026 08:28
176f3d9 to
25e295a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
REPOSITORY_CHECKOVruns inprojectlint mode, and theREPOSITORYdescriptor declareslint_all_files: true, so the linter stays active even when MegaLinter kept 0 files.CheckovLinter.build_lint_command()appends--file+master.all_diff_filesas soon asVALIDATE_ALL_CODEBASE=falseand the run is a Pull Request, without checking that the list contains anything. In a PR wheregit diffreturns no file (Kept [0] files on [0] found files), the built command ends with a dangling--file, and checkov fails on its own arguments:The same weakness exists generically: any linter whose descriptor declares
lint_all_files(allREPOSITORYlinters) and that is set tolist_of_fileslint mode stays active with zero file, andcli_lint_mode_list_of_files_extra_args_after(--filefor checkov,--inputforKOTLIN_KTLINT,-E --source-codeforREPOSITORY_DEVSKIM) is added with no value after it.Note: the lint mode is never silently switched from
projecttolist_of_files. What looked like a mode switch is this checkov-specific "scan only the PR files" behavior (#7119) applying insideprojectmode.Fix
Generic, in
megalinter/Linter.py:run(): a linter inlist_of_filesmode with an empty file list does not run its command at all — it is skipped with a log line instead of producing an invalid command.build_lint_command():cli_lint_mode_list_of_files_extra_args_afteris only appended when there is at least one file to lint.In
megalinter/linters/CheckovLinter.py:--fileis added only when the Pull Request actually contains updated files, and only inprojectlint mode — infile/list_of_filesmodes MegaLinter already passes the updated files it kept, so the extra unfiltered list was redundant (and produced a duplicated--file).VALIDATE_ALL_CODEBASE: false.Verification
Unit tests added to
megalinter/tests/test_megalinter/checkov_linter_test.py(no Docker needed):--file <file>is built as before--fileargument,--directory .keptlist_of_fileslint mode: the PR diff files are not injectedlist_of_fileslint mode with no file:process_linter()is not called, status stayssuccessThe 4 tests covering the new behavior fail on
mainand pass with this change:megalinter/tests/test_megalinter/linter_test.pyandutils_test.pystill pass;black,flake8andisortare clean on the changed files.Not verified
The checkov linter test suite itself (
repository_checkov_test) requires the Docker image and was not run locally.Fixes #8802