MegaLinter Quality

Purpose

MegaLinter bundles 100+ native language linters and formatters across ~50 languages in one image. This is the breadth SonarQube lacks: the real ecosystem tools (eslint, ruff/flake8, golangci-lint, rubocop, hadolint, shellcheck, stylelint, markdownlint, yamllint, …) plus formatting enforcement.

Scoped to avoid double coverage: the script disables MegaLinter's bundled security/SCA/secrets descriptors and the copy-paste detector, because those are handled by the dedicated skills:

• REPOSITORY (trivy, grype, syft, checkov, kics, gitleaks, trufflehog, semgrep, devskim, secretlint, dustilock) → covered by trivy-security, opengrep-sast, secrets-scan.
• COPYPASTE (jscpd) → SonarQube already does duplication.
• SPELL → noisy, off by default here.

What remains is exactly the unique value: native linters + formatters.

Core Workflow (drive to zero)

1. Lint:

   ~/.claude/skills/megalinter-quality/scripts/scan.sh [TARGET_DIR]

   MegaLinter auto-detects the languages present and runs the matching linters. It prints a per-linter summary table and the detailed errors to the console.
2. Fix each reported error (or run the linter's autofix locally). Re-run.
3. Stop when MegaLinter exits 0 (no blocking lint errors).

Low-noise defaults

MegaLinter's stock config is intentionally opinionated and noisy. The script ships two pre-tuned defaults so findings start close to "real issues only":

• Generated/vendored files excluded globally (FILTER_REGEX_EXCLUDE): dist/, build/, out/, vendor/, node_modules/, __pycache__/, .venv/, coverage/, lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, composer.lock) and *.min.js/.css. Override with MEGALINTER_EXCLUDE.
• Convention-imposing style linters off (DISABLE_LINTERS): TYPESCRIPT_STANDARD,JAVASCRIPT_STANDARD. StandardJS/ts-standard force their own style (single quotes, no semicolons) and conflict with a project that has its own Prettier/ESLint convention (and with tsc/SonarQube). Re-enable per project with MEGALINTER_DISABLE_LINTERS=.

Rule of thumb: a linter that fights the project's own formatter should be disabled, not fought — keep one source of truth for style.

Project-specific tuning (.mega-linter.yml at the repo root)

Some noise is genuinely project-dependent and belongs in repo config, not the skill default:

• Indentation formatters — e.g. shfmt defaults to tabs; for a 2-space project set BASH_SHFMT_ARGUMENTS: "-i 2".
• Doc-heavy repos — relax opinionated markdownlint rules in a .markdownlint.json (e.g. MD013 line length, MD040 fenced-code language, MD024 duplicate headings) and fix only the substantive ones.
• Per-linter enable/disable, APPLY_FIXES, and severity also live here.

Caveat (important): a project .mega-linter.yml is schema-validated by MegaLinter (via v8r). If it has any schema error, MegaLinter silently ignores the whole file — so DISABLE_LINTERS/excludes set there won't take effect and the linters you meant to disable keep running. The skill's env-var overrides (MEGALINTER_DISABLE_LINTERS, MEGALINTER_EXCLUDE, …) are not schema-validated and are the robust way to disable linters; prefer them, and keep .mega-linter.yml for things env vars can't express (e.g. per-linter arguments like BASH_SHFMT_ARGUMENTS).

Notes

• The default image is large (multi-GB). For a single-language repo, set a flavor for faster pulls, e.g. MEGALINTER_IMAGE=oxsecurity/megalinter-python:latest.
• To re-enable a disabled descriptor: MEGALINTER_DISABLE=REPOSITORY,SPELL scan.sh [DIR].
• The image is amd64-only; the script pins --platform linux/amd64 (override MEGALINTER_PLATFORM) to silence the arm64 emulation warning.
• Mount note: unlike the other (read-only) scanners, MegaLinter mounts the workspace read-write because some linters require it. It does not modify your sources without APPLY_FIXES; REPORT_OUTPUT_FOLDER=none suppresses report artifacts; and linter caches (ruff/mypy/pylint) are redirected to /tmp with any stragglers (.ruff_cache, .mypy_cache, .pylint.d) removed on exit — so in the default lint-only mode the repo is left unchanged.
• Native Linux caveat: the container runs as root with a read-write mount, so any cache a linter writes is root-owned; the cleanup rm runs as your user and may not remove it (Docker Desktop on macOS/Windows maps ownership, so it is a no-issue there). Add --user "$(id -u):$(id -g)" to the docker run if you hit root-owned leftovers on native Linux.
• MegaLinter's CLI/image is AGPL-3.0; running it locally to scan code imposes no network-service obligations.

Resources

• scripts/scan.sh — runs MegaLinter scoped to native linters/formatters, with low-noise defaults (excludes generated files, disables convention-imposing style linters), reports to console, exit 1 on lint errors. Env: MEGALINTER_DISABLE, MEGALINTER_DISABLE_LINTERS, MEGALINTER_EXCLUDE, MEGALINTER_IMAGE, MEGALINTER_LOG_LEVEL.