mega-linter.yaml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: MegaLinter

on:
  push:
  workflow_dispatch:

jobs:
  build:
    name: MegaLinter
    runs-on: ubuntu-latest
    steps:
      # https://github.com/marketplace/actions/harden-runner
      - name: Harden Runner
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
        with:
          egress-policy: audit

      # https://github.com/marketplace/actions/checkout
      - name: Checkout Repository
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
        with:
          fetch-depth: 0

      # https://github.com/marketplace/actions/create-github-app-token
      - name: Generate Token
        uses: actions/create-github-app-token@7bfa3a4717ef143a604ee0a99d859b8886a96d00 # v1.9.3
        id: app-token
        with:
          app-id: "${{ secrets.BOT_APP_ID }}"
          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"

      # https://github.com/marketplace/actions/megalinter
      - name: MegaLinter
        uses: oxsecurity/megalinter/flavors/terraform@03986e6993ccf699a22451118520680b438e7d2a # v7.11.1
        env:
          VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'workflow_dispatch' }}
          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"
          # GITHUB_STATUS_REPORTER only works if VALIDATE_ALL_CODEBASE is false!
          GITHUB_STATUS_REPORTER: true
          REPORTERS_MARKDOWN_TYPE: simple
          SHOW_ELAPSED_TIME: false
          SHOW_SKIPPED_LINTERS: true