Awesome Open Source
Awesome Open Source

MegaLinter, by OX Security

GitHub release Docker Pulls Downloads/week GitHub stars MegaLinter codecov Secured with Trivy GitHub contributors GitHub Sponsors PRs Welcome Tweet

MegaLinter is an Open-Source tool for CI/CD workflows that analyzes the consistency of your code, IAC, configuration, and scripts in your repository sources, to ensure all your projects sources are clean and formatted whatever IDE/toolbox is used by their developers, powered by OX security.

Supporting 51 languages, 22 formats, 20 tooling formats and ready to use out of the box, as a GitHub action or any CI system highly configurable and free for all uses.

Upgrade to MegaLinter v6 !

See Online Documentation Web Site which has a much easier user navigation than this README

See Article on Medium



Console reporter


Github PR reporter


Table of Contents

Why MegaLinter

Projects need to contain clean code, in order to avoid technical debt, that makes evolutive maintenance harder and time consuming.

By using code formatters and code linters, you ensure that your code base is easier to read and respects best practices, from the kick-off to each step of the project lifecycle

Not all developers have the good habit to use linters in their IDEs, making code reviews harder and longer to process

By using MegaLinter, you'll enjoy the following benefits for you and your team:

  • At each pull request it will automatically analyze all updated code in all languages
  • Reading error logs, developers learn best practices of the language they are using
  • MegaLinter documentation provides the list of IDE plugins integrating each linter, so developers know which linter and plugins to install
  • MegaLinter is ready out of the box after a quick setup
  • Formatting and fixes can be automatically applied on the git branch or provided in reports
  • This tool is 100% open-source and free for all uses (personal, professional, public and private repositories)
  • MegaLinter can run on any CI tool and be run locally: no need to authorize an external application, and your code base never leaves your tooling ecosystem

Quick Start

  • Run npx mega-linter-runner --install to generate configuration files (you need node.js to be installed)
  • Commit, push, and create a pull request
  • Watch !

Runner Install


Supported Linters

All linters are integrated in the MegaLinter docker image, which is frequently upgraded with their latest versions


Language Linter Configuration key Additional
BASH bash-exec BASH_EXEC
shellcheck BASH_SHELLCHECK GitHub stars sarif
shfmt BASH_SHFMT GitHub stars formatter
C cpplint C_CPPLINT
CLOJURE clj-kondo CLOJURE_CLJ_KONDO GitHub stars
COFFEE coffeelint COFFEE_COFFEELINT GitHub stars
C++ (CPP) cpplint CPP_CPPLINT GitHub stars
C# (CSHARP) dotnet-format CSHARP_DOTNET_FORMAT GitHub stars formatter
DART dartanalyzer DART_DARTANALYZER GitHub stars
GO golangci-lint GO_GOLANGCI_LINT GitHub stars
revive GO_REVIVE GitHub stars sarif
GROOVY npm-groovy-lint GROOVY_NPM_GROOVY_LINT GitHub stars autofix sarif
JAVA checkstyle JAVA_CHECKSTYLE GitHub stars sarif
pmd JAVA_PMD GitHub stars sarif
JAVASCRIPT eslint JAVASCRIPT_ES GitHub stars autofix sarif
standard JAVASCRIPT_STANDARD GitHub stars autofix
prettier JAVASCRIPT_PRETTIER GitHub stars formatter
JSX eslint JSX_ESLINT autofix sarif
KOTLIN ktlint KOTLIN_KTLINT GitHub stars autofix sarif
LUA luacheck LUA_LUACHECK GitHub stars
PERL perlcritic PERL_PERLCRITIC GitHub stars
PHP phpcs PHP_PHPCS GitHub stars
phpstan PHP_PHPSTAN GitHub stars
psalm PHP_PSALM GitHub stars sarif
PYTHON pylint PYTHON_PYLINT GitHub stars
black PYTHON_BLACK GitHub stars formatter
flake8 PYTHON_FLAKE8 GitHub stars
isort PYTHON_ISORT GitHub stars formatter
bandit PYTHON_BANDIT GitHub stars sarif
mypy PYTHON_MYPY GitHub stars
pyright PYTHON_PYRIGHT GitHub stars
R lintr R_LINTR GitHub stars
RAKU raku RAKU_RAKU GitHub stars
RUBY rubocop RUBY_RUBOCOP GitHub stars autofix
RUST clippy RUST_CLIPPY GitHub stars
sfdx-scanner-aura SALESFORCE_SFDX_SCANNER_AURA GitHub stars
sfdx-scanner-lwc SALESFORCE_SFDX_SCANNER_LWC GitHub stars
SCALA scalafix SCALA_SCALAFIX GitHub stars
SQL sql-lint SQL_SQL_LINT GitHub stars
sqlfluff SQL_SQLFLUFF GitHub stars
tsqllint SQL_TSQLLINT GitHub stars
SWIFT swiftlint SWIFT_SWIFTLINT GitHub stars autofix
TSX eslint TSX_ESLINT autofix sarif
TYPESCRIPT eslint TYPESCRIPT_ES GitHub stars autofix sarif
standard TYPESCRIPT_STANDARD GitHub stars autofix
prettier TYPESCRIPT_PRETTIER GitHub stars formatter
Visual Basic .NET (VBDOTNET) dotnet-format VBDOTNET_DOTNET_FORMAT formatter


Format Linter Configuration key Additional
CSS stylelint CSS_STYLELINT GitHub stars autofix
scss-lint CSS_SCSS_LINT GitHub stars
ENV dotenv-linter ENV_DOTENV_LINTER GitHub stars autofix
GRAPHQL graphql-schema-linter GRAPHQL_GRAPHQL_SCHEMA_LINTER GitHub stars
HTML djlint HTML_DJLINT GitHub stars
htmlhint HTML_HTMLHINT GitHub stars
JSON jsonlint JSON_JSONLINT GitHub stars
eslint-plugin-jsonc JSON_ESLINT_PLUGIN_JSONC GitHub stars autofix sarif
v8r JSON_V8R GitHub stars
prettier JSON_PRETTIER GitHub stars formatter
MARKDOWN markdownlint MARKDOWN_MARKDOWNLINT GitHub stars formatter
remark-lint MARKDOWN_REMARK_LINT GitHub stars formatter
markdown-link-check MARKDOWN_MARKDOWN_LINK_CHECK GitHub stars
markdown-table-formatter MARKDOWN_MARKDOWN_TABLE_FORMATTER GitHub stars formatter
PROTOBUF protolint PROTOBUF_PROTOLINT GitHub stars autofix
RST rst-lint RST_RST_LINT GitHub stars
rstcheck RST_RSTCHECK GitHub stars
YAML prettier YAML_PRETTIER GitHub stars formatter
yamllint YAML_YAMLLINT GitHub stars
v8r YAML_V8R GitHub stars

Tooling formats

Tooling format Linter Configuration key Additional
ACTION actionlint ACTION_ACTIONLINT GitHub stars
ANSIBLE ansible-lint ANSIBLE_ANSIBLE_LINT GitHub stars sarif
GHERKIN gherkin-lint GHERKIN_GHERKIN_LINT GitHub stars
kubeconform KUBERNETES_KUBECONFORM GitHub stars
PUPPET puppet-lint PUPPET_PUPPET_LINT GitHub stars autofix
snakefmt SNAKEMAKE_SNAKEFMT GitHub stars formatter
TEKTON tekton-lint TEKTON_TEKTON_LINT GitHub stars
TERRAFORM tflint TERRAFORM_TFLINT GitHub stars sarif
terrascan TERRAFORM_TERRASCAN GitHub stars sarif
terragrunt TERRAFORM_TERRAGRUNT GitHub stars autofix
terraform-fmt TERRAFORM_TERRAFORM_FMT GitHub stars formatter
checkov TERRAFORM_CHECKOV GitHub stars sarif
kics TERRAFORM_KICS GitHub stars


Code quality checker Linter Configuration key Additional
devskim REPOSITORY_DEVSKIM GitHub stars sarif
dustilock REPOSITORY_DUSTILOCK GitHub stars sarif
git_diff REPOSITORY_GIT_DIFF GitHub stars
gitleaks REPOSITORY_GITLEAKS GitHub stars sarif
goodcheck REPOSITORY_GOODCHECK GitHub stars
secretlint REPOSITORY_SECRETLINT GitHub stars sarif
semgrep REPOSITORY_SEMGREP GitHub stars sarif
syft REPOSITORY_SYFT GitHub stars sarif
trivy REPOSITORY_TRIVY GitHub stars sarif
SPELL misspell SPELL_MISSPELL GitHub stars autofix
cspell SPELL_CSPELL GitHub stars
proselint SPELL_PROSELINT GitHub stars


Assisted installation

Just run npx mega-linter-runner --install at the root of your repository and answer questions, it will generate ready to use configuration files for MegaLinter :)

Runner Install

Upgrade to MegaLinter v6

  • Run npx mega-linter-runner --upgrade to automatically upgrade your configuration from v4 or v5 to v6 :)

Manual installation

The following instructions examples are using latest MegaLinter stable version (v6 , always corresponding to the latest release)

You can also use beta version (corresponding to the content of main branch)

GitHub Action

  1. Create a new file in your repository called .github/workflows/mega-linter.yml
  2. Copy the example workflow from below into that new file, no extra configuration required
  3. Commit that file to a new branch
  4. Open up a pull request and observe the action working
  5. Enjoy your more stable, and cleaner code base


  • If you pass the Environment variable GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} in your workflow, then the MegaLinter will mark the status of each individual linter run in the Checks section of a pull request. Without this you will only see the overall status of the full run. There is no need to set the GitHub Secret as it is automatically set by GitHub, it only needs to be passed to the action.
  • You can also use it outside of GitHub Actions (CircleCI, Azure Pipelines, Jenkins, GitLab, or even locally with a docker run) , and have status on Github Pull Request if GITHUB_TARGET_URL environment variable exists.

In your repository you should have a .github/workflows folder with GitHub Action similar to below:

  • .github/workflows/mega-linter.yml
This file should have this code
# MegaLinter GitHub Action configuration file
# More info at
name: MegaLinter

  # Trigger mega-linter at every push. Action will also be visible from Pull Requests to main
  push: # Comment this line to trigger action only on pull-requests (not recommended if you don't pay for GH Actions)
    branches: [master, main]

env: # Comment env block if you do not want to apply fixes
  # Apply linter fixes configuration
  APPLY_FIXES: all # When active, APPLY_FIXES must also be defined as environment variable (in github/workflows/mega-linter.yml or other CI tool)
  APPLY_FIXES_EVENT: pull_request # Decide which event triggers application of fixes in a commit or a PR (pull_request, push, all)
  APPLY_FIXES_MODE: commit # If APPLY_FIXES is used, defines if the fixes are directly committed (commit) or posted in a PR (pull_request)

  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

    name: MegaLinter
    runs-on: ubuntu-latest
      # Git Checkout
      - name: Checkout Code
        uses: actions/[email protected]
          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
          fetch-depth: 0 # If you use VALIDATE_ALL_CODEBASE = true, you can remove this line to improve performances

      # MegaLinter
      - name: MegaLinter
        id: ml
        # You can override MegaLinter flavor used to have faster performances
        # More info at
        uses: oxsecurity/[email protected]
          # All available variables are described in documentation
          VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} # Validates all source when push on main, else just the git diff with main. Override with true if you always want to lint all sources
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # DISABLE: COPYPASTE,SPELL # Uncomment to disable copy-paste and spell checks

      # Upload MegaLinter artifacts
      - name: Archive production artifacts
        if: ${{ success() }} || ${{ failure() }}
        uses: actions/[email protected]
          name: MegaLinter reports
          path: |

      # Create pull request if applicable (for now works only on PR from same repository, not from forks)
      - name: Create Pull Request with applied fixes
        id: cpr
        if: == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
        uses: peter-evans/[email protected]
          token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
          commit-message: "[MegaLinter] Apply linters automatic fixes"
          title: "[MegaLinter] Apply linters automatic fixes"
          labels: bot
      - name: Create PR output
        if: == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'pull_request' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
        run: |
          echo "Pull Request Number - ${{ steps.cpr.outputs.pull-request-number }}"
          echo "Pull Request URL - ${{ steps.cpr.outputs.pull-request-url }}"

      # Push new commit if applicable (for now works only on PR from same repository, not from forks)
      - name: Prepare commit
        if: == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
        run: sudo chown -Rc $UID .git/
      - name: Commit and push applied linter fixes
        if: == 1 && (env.APPLY_FIXES_EVENT == 'all' || env.APPLY_FIXES_EVENT == github.event_name) && env.APPLY_FIXES_MODE == 'commit' && github.ref != 'refs/heads/main' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository) && !contains(github.event.head_commit.message, 'skip fix')
        uses: stefanzweifel/[email protected]
          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
          commit_message: "[MegaLinter] Apply linters fixes"

GitLab CI

Create or update .gitlab-ci.yml file at the root of your repository

# MegaLinter GitLab CI job configuration file
# More info at

  stage: test
  # You can override MegaLinter flavor used to have faster performances
  # More info at
  image: oxsecurity/megalinter:v6
  script: [ "true" ] # if script: ["true"] does not work, you may try ->  script: [ "/bin/bash /" ]
    # All available variables are described in documentation
    when: always
      - megalinter-reports
    expire_in: 1 week

Create a Gitlab access token and define it in a variable GITLAB_ACCESS_TOKEN_MEGALINTER in the project CI/CD masked variables



Azure Pipelines

Use the following Azure Pipelines YAML template

Add the following job in your azure-pipelines.yaml file

  # Run MegaLinter to detect linting and security issues
  - job: MegaLinter
      vmImage: ubuntu-latest
      # Pull MegaLinter docker image
      - script: docker pull oxsecurity/megalinter:v6
        displayName: Pull MegaLinter

      # Run MegaLinter
      - script: |
          docker run -v $(System.DefaultWorkingDirectory):/tmp/lint \
            -e GIT_AUTHORIZATION_BEARER=$(System.AccessToken) \
            -e CI=true \
            -e TF_BUILD=true \
            -e SYSTEM_ACCESSTOKEN=$(System.AccessToken) \
            -e SYSTEM_COLLECTIONURI=$(System.CollectionUri) \
            -e SYSTEM_PULLREQUEST_PULLREQUESTID=$(System.PullRequest.PullRequestId) \
            -e SYSTEM_TEAMPROJECT=$(System.TeamProject) \
            -e BUILD_BUILD_ID=$(Build.BuildId) \
            -e BUILD_REPOSITORY_ID=$(Build.Repository.ID) \
        displayName: Run MegaLinter

      # Upload MegaLinter reports
      - task: [email protected]
        condition: succeededOrFailed()
        displayName: Upload MegaLinter reports
          targetPath: "$(System.DefaultWorkingDirectory)/megalinter-reports/"
          artifactName: MegaLinterReport

To benefit from Pull Request comments, please follow configuration instructions


Add the following stage in your Jenkinsfile

You may activate reporter or E-mail reporter to access detailed logs and fixed source

// Lint with MegaLinter:
stage('MegaLinter') {
    agent {
        docker {
            image 'oxsecurity/megalinter:v6'
            args "-u root -e VALIDATE_ALL_CODEBASE=true -v ${WORKSPACE}:/tmp/lint --entrypoint=''"
            reuseNode true
    steps {
        sh '/'
    post {
        always {
            archiveArtifacts allowEmptyArchive: true, artifacts: 'mega-linter.log,megalinter-reports/**/*', defaultExcludes: false, followSymlinks: false  


Pipeline step

Use the following job.step in your pipeline template

Note: make sure you have job.plan.get step which gets repo containing your repository as shown in example


  - name: linting
      - get: repo
      - task: linting
          platform: linux
            type: docker-image
              repository: oxsecurity/megalinter
              tag: v6
            - name: repo
            path: bash
            - -cxe
            - |
              cd repo
              export DEFAULT_WORKSPACE=$(pwd)
              bash -ex /
              ## doing this because concourse does not work as other CI systems
          # params:
            # PARALLEL: true
            # DISABLE: SPELL
            # APPLY_FIXES: all
            # DISABLE_ERRORS: true
            # VALIDATE_ALL_CODEBASE: true


Use it as reusable task

Create reusable concourse task which can be used with multiple pipelines

  1. Create task file task-linting.yaml
platform: linux
  type: docker-image
    repository: oxsecurity/megalinter
    tag: v6

- name: repo

## uncomment this if you want reports as task output
# output:
# - name: reports
#   path: repo/megalinter-reports

  path: bash
  - -cxe
  - |
    cd repo
    export DEFAULT_WORKSPACE=$(pwd)
    bash -ex /
  1. Use that task-linting.yaml task in pipeline


  1. make sure task-linting.yaml is available in that repo input at root

  2. task output is not shown here


  - name: linting
      - get: repo
      - task: linting
        file: repo/task-linting.yaml
        # params:
        #   PARALLEL: true
        #   DISABLE: SPELL
        #   APPLY_FIXES: all
        #   DISABLE_ERRORS: true
        #   VALIDATE_ALL_CODEBASE: true

Run MegaLinter locally

Version Downloads/week Downloads/total

You can use mega-linter-runner to locally run MegaLinter with the same configuration defined in .mega-linter.yml file

See mega-linter-runner installation instructions


npx mega-linter-runner --flavor salesforce -e 'ENABLE=,DOCKERFILE,MARKDOWN,YAML' -e 'SHOW_ELAPSED_TIME=true'

Note: You can also use such command line in your custom CI/CD pipelines


MegaLinter configuration variables can be defined in a .mega-linter.yml file at the root of the repository or with environment variables. You can see an example config file in this repo: .mega-linter.yml

Configuration is assisted with auto-completion and validation in most commonly used IDEs, thanks to JSON schema stored on

  • VsCode: You need a VsCode extension like Red Hat YAML
  • IDEA family: Auto-completion natively supported

Assisted configuration

Common variables

ENV VAR Default Value Notes
ADDITIONAL_EXCLUDED_DIRECTORIES [] List of additional excluded directory basenames. They are excluded at any nested level.
APPLY_FIXES none Activates formatting and auto-fixing (more info)
CLEAR_REPORT_FOLDER false Flag to clear files from report folder (usually megalinter-reports) before starting the linting process
DEFAULT_BRANCH HEAD Deprecated: The name of the repository's default branch.
DEFAULT_WORKSPACE /tmp/lint The location containing files to lint if you are running locally.
DISABLE_ERRORS false Flag to have the linter complete with exit code 0 even if errors were detected.
DISABLE List of disabled descriptors keys (more info)
DISABLE_LINTERS List of disabled linters keys (more info)
DISABLE_ERRORS_LINTERS List of enabled but not blocking linters keys (more info)
ENABLE List of enabled descriptors keys (more info)
ENABLE_LINTERS List of enabled linters keys (more info)
EXCLUDED_DIRECTORIES [...many values...] List of excluded directory basenames. They are excluded at any nested level.
EXTENDS Base mega-linter.yml config file(s) to extend local configuration from. Can be a single URL or a list of .mega-linter.yml config files URLs
FAIL_IF_MISSING_LINTER_IN_FLAVOR false If set to true, MegaLinter fails if a linter is missing in the selected flavor
FAIL_IF_UPDATED_SOURCES false If set to true, MegaLinter fails if a linter or formatter has auto-fixed sources, even if there are no errors
FILTER_REGEX_EXCLUDE none Regular expression defining which files will be excluded from linting (more info) .ex: .*src/test.*)
FILTER_REGEX_INCLUDE all Regular expression defining which files will be processed by linters (more info) .ex: .*src/.*)
FLAVOR_SUGGESTIONS true Provides suggestions about different MegaLinter flavors to use to improve runtime performances
FORMATTERS_DISABLE_ERRORS true Formatter errors will be reported as errors (and not warnings) if this variable is set to false
GITHUB_WORKSPACE `` Base directory for REPORT_OUTPUT_FOLDER, for user-defined linter rules location, for location of linted files if DEFAULT_WORKSPACE is not set
IGNORE_GENERATED_FILES false If set to true, MegaLinter will skip files containing @generated marker but without @not-generated marker (more info at
IGNORE_GITIGNORED_FILES true If set to true, MegaLinter will skip files ignored by git using .gitignore file
JAVASCRIPT_DEFAULT_STYLE standard Javascript default style to check/apply. standard,prettier
LINTER_RULES_PATH .github/linters Directory for all linter configuration rules.
Can be a local folder or a remote URL (ex: )
LOG_FILE mega-linter.log The file name for outputting logs. All output is sent to the log file regardless of LOG_LEVEL. Use none to not generate this file.
LOG_LEVEL INFO How much output the script will generate to the console. One of INFO, DEBUG, WARNING or ERROR.
MARKDOWN_DEFAULT_STYLE markdownlint Markdown default style to check/apply. markdownlint,remark-lint
MEGALINTER_CONFIG .mega-linter.yml Name of MegaLinter configuration file. Can be defined remotely, in that case set this environment variable with the remote URL of .mega-linter.yml config file
MEGALINTER_FILES_TO_LINT [] Comma-separated list of files to analyze. Using this variable will bypass other file listing methods
PARALLEL true Process linters in parallel to improve overall MegaLinter performance. If true, linters of same language or formats are grouped in the same parallel process to avoid lock issues if fixing the same files
PLUGINS [] List of plugin urls to install and run during MegaLinter run
POST_COMMANDS [] Custom bash commands to run after linters
PRE_COMMANDS [] Custom bash commands to run before linters
PRINT_ALPACA true Enable printing alpaca image to console
PRINT_ALL_FILES false Display all files analyzed by the linter instead of only the number
REPORT_OUTPUT_FOLDER ${GITHUB_WORKSPACE}/megalinter-reports Directory for generating report files. Send none to not generate reports
SHOW_ELAPSED_TIME false Displays elapsed time in reports
SHOW_SKIPPED_LINTERS true Displays all disabled linters mega-linter could have run
SKIP_CLI_LINT_MODES [] Comma-separated list of cli_lint_modes. To use if you want to skip linters with some CLI lint modes (ex: file,project). Available values: file,cli_lint_mode,project.
TYPESCRIPT_DEFAULT_STYLE standard Typescript default style to check/apply. standard,prettier
VALIDATE_ALL_CODEBASE true Will parse the entire repository and find all files to validate across all types. NOTE: When set to false, only new or edited files will be parsed for validation.

Activation and deactivation

MegaLinter have all linters enabled by default, but allows to enable only some, or disable only some

  • If ENABLE is not set, all descriptors are activated by default. If set, all linters of listed descriptors will be activated by default
  • If ENABLE_LINTERS is set, only listed linters will be processed
  • If DISABLE is set, the linters in the listed descriptors will be skipped
  • If DISABLE_LINTERS is set, the listed linters will be skipped
  • If DISABLE_ERRORS_LINTERS is set, the linter linters will be run, but if errors are found, they will be considered as non blocking


  • Run all javascript and groovy linters except STANDARD javascript linter. DevSkim errors will be non-blocking
  • Run all linters except PHP linters (PHP_BUILTIN, PHP_PHPCS, PHP_PHPSTAN, PHP_PSALM)
  • Run all linters except PHP_PHPSTAN and PHP_PSALM linters

Filter linted files

If you need to lint only a folder or exclude some files from linting, you can use optional environment parameters FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE You can apply filters to a single linter by defining variable <LINTER_KEY>_FILTER_REGEX_INCLUDE and <LINTER_KEY>_FILTER_REGEX_EXCLUDE


  • Lint only src folder: FILTER_REGEX_INCLUDE: (src/)
  • Do not lint files inside test and example folders: FILTER_REGEX_EXCLUDE: (test/|examples/)
  • Do not lint javascript files inside test folder: FILTER_REGEX_EXCLUDE: (test/.*\.js)

Warning: not applicable with linters using CLI lint mode project (see details)

Apply fixes

Mega-linter is able to apply fixes provided by linters. To use this capability, you need 3 env variables defined at top level

  • APPLY_FIXES: all to apply fixes of all linters, or a list of linter keys (ex: JAVASCRIPT_ES,MARKDOWN_MARKDOWNLINT)

Only for GitHub Action Workflow file if you use it:

  • APPLY_FIXES_EVENT: all, push, pull_request, none (use none in case of use of Updated sources reporter)
  • APPLY_FIXES_MODE: commit to create a new commit and push it on the same branch, or pull_request to create a new PR targeting the branch.


  • You can use Updated sources reporter if you do not want fixes to be automatically applied on git branch, but download them in a zipped file and manually extract them in your project

  • If used, APPLY_FIXES_EVENT and APPLY_FIXES_MODE can not be defined in .mega-linter.ymlconfig file, they must be set as environment variables

  • If you use APPLY_FIXES, add the following line in your .gitignore file


Linter specific variables

See variables related to a single linter behavior in linters documentations


MegaLinter can run custom commands before running linters (for example, installing an plugin required by one of the linters you use)

Example in .mega-linter.yml config file

  - command: npm install eslint-plugin-whatever
    cwd: "root"        # Will be run at the root of MegaLinter docker image
  - command: echo "pre-test command has been called"
    cwd: "workspace"   # Will be run at the root of the workspace (usually your repository root)


MegaLinter can run custom commands after running linters (for example, running additional tests)

Example in .mega-linter.yml config file

  - command: npm run test
    cwd: "workspace"   # Will be run at the root of the workspace (usually your repository root)

CLI lint mode

Each linter has a lint mode by default, visible in its MegaLinter documentation (example):

  • list_of_files: All files are sent in single call to the linter
  • project: The linter is called from the root of the project, without specifying any file name
  • file: The linter is called once by file (so the performances may not be very good)

You can override the CLI_LINT_MODE by using configuration variable for each linter (see linters documentation)

  • Linters with project default lint mode can not be overridden to list_of_files or file

Special considerations:

  • As list of files is not sent to the linter command, linters using project lint mode do not take in account some variables like FILTER_REGEX_INCLUDE and FILTER_REGEX_EXCLUDE. For those linters, you must check their documentation to define ignore configuration as it is awaited by the linter (for example with a .secretlintignore file for secretlint)


MegaLinter can generate various reports that you can activate / deactivate and customize

Reporter Description Default
Text files Generates One log file by linter + suggestions for fixes that can not be automated Active
GitHub Pull Request comments MegaLinter posts a comment on the PR with a summary of lint results, and links to detailed logs Active if GitHub Action
Gitlab Merge Request comments Mega-Linter posts a comment on the MR with a summary of lint results, and links to detailed logs Active if in Gitlab CI
Azure Pipelines Pull Request comments Mega-Linter posts a comment on the PR with a summary of lint results, and links to detailed logs Active if in Azure Pipelines
Updated sources Zip containing all formatted and auto-fixed sources so you can extract them in your repository Active
IDE Configuration Apply MegaLinter configuration in your local IDE with linter config files and IDE extensions Active
GitHub Status One GitHub status by linter on the PR, with links to detailed logs Active if GitHub Action Send reports on so you can access them with a simple hyperlink provided at the end of console log Inactive
JSON Generates a JSON output report file Inactive
Email Receive all reports on your e-mail, if you can not use artifacts Active
TAP files One file by linter following Test Anything Protocol format Active
Console Execution logs visible in console with summary table and links to other reports at the end Active


To improve run performances, we generate Flavored MegaLinter images containing only the list of linters related to a project type

  • When using default MegaLinter, if a MegaLinter Flavor would cover all your project requirements, a message is added in the logs
  • If your project uses a MegaLinter Flavor not covering linter requirements, an error message will be thrown with instructions about how to solve the issue

The following table does not display docker pulls from MegaLinter v4 & v5 images.

Flavor Description Embedded linters Info
all Default MegaLinter Flavor 107 Docker Image Size (tag) Docker Pulls
ci_light Optimized for CI items (Dockerfile, Jenkinsfile, JSON/YAML schemas,XML 20 Docker Image Size (tag) Docker Pulls
documentation MegaLinter for documentation projects 46 Docker Image Size (tag) Docker Pulls
dotnet Optimized for C, C++, C# or VB based projects 55 Docker Image Size (tag) Docker Pulls
go Optimized for GO based projects 48 Docker Image Size (tag) Docker Pulls
java Optimized for JAVA based projects 50 Docker Image Size (tag) Docker Pulls
javascript Optimized for JAVASCRIPT or TYPESCRIPT based projects 55 Docker Image Size (tag) Docker Pulls
php Optimized for PHP based projects 50 Docker Image Size (tag) Docker Pulls
python Optimized for PYTHON based projects 56 Docker Image Size (tag) Docker Pulls
ruby Optimized for RUBY based projects 47 Docker Image Size (tag) Docker Pulls
rust Optimized for RUST based projects 47 Docker Image Size (tag) Docker Pulls
salesforce Optimized for Salesforce based projects 49 Docker Image Size (tag) Docker Pulls
security Optimized for security 21 Docker Image Size (tag) Docker Pulls
swift Optimized for SWIFT based projects 47 Docker Image Size (tag) Docker Pulls
terraform Optimized for TERRAFORM based projects 52 Docker Image Size (tag) Docker Pulls

If you need a new flavor, post an issue 😉


You can show MegaLinter status with a badge in your repository README


If your main branch is main , replace main by main in URLs


  • Format
  • Example


  • Format
.. |MegaLinter yes| image::<OWNER>/<REPOSITORY>/workflows/MegaLinter/badge.svg?branch=main
  • Example
.. |MegaLinter yes| image::

Note: IF you did not use MegaLinter as GitHub Action name, please read GitHub Actions Badges documentation{target=_blank}


For security reasons, we try to embed in MegaLinter only linters that are widely adopted by open-source community.

But any linter can be callable within MegaLinter thanks to the plugin mechanism !

Use plugins

Add plugin URLs in PLUGINS property of .mega-linter.yml. URLs must either begin with "https://" or take the form of "file://<path>", where <path> points to a valid plugin descriptor file.

Note: Both <path> and the default mount directory (/tmp/lint/<path>) will be checked for a valid descriptor.


  - file://.automation/test/mega-linter-plugin-test/test.megalinter-descriptor.yml

Plugins Catalog

  • jupyfmt: The uncompromising Jupyter notebook formatter (usage)
  • nitpick: Command-line tool and flake8 plugin to enforce the same settings across multiple language-independent projects. (usage)

Submit a PR if you want your plugin to appear here :)

Create plugins

You can implement your own descriptors and load them as plugins during MegaLinter runtime


  • For now, the only install attributes managed are dockerfile instructions starting by RUN


Frequently Asked Questions

My repo CI already have linters and they are perfectly working, so why do I need MegaLinter ?

You can perfectly continue using your installed linters and deactivate them in .mega-linter.yml. For example, in a javascript project using eslint, you can configure MegaLinter with DISABLE: JAVASCRIPT. That way, you will benefit from both your installed linters but also from other MegaLinter linters checking JSON, YAML, Markdown, Dockerfile, Bash, spelling mistakes, dead URLs...

Ok but... how does it work ?

MegaLinter is based on Docker images containing either all linters, or just a selection of linters if you are using a MegaLinter flavor for a project using a specific language / format

The core architecture does the following:

  • Initialization
    • List all project files:
      • except files in ignored folders (node_modules, etc...)
      • except files not matching FILTER_REGEX_INCLUDE (if defined by user)
      • except files matching FILTER_REGEX_EXCLUDE (if defined by user)
    • Collect files for each activated linter, matching their own filtering criteria:
      • file extensions
      • file names
      • file content
      • <descriptor_or_linter_key>_FILTER_REGEX_INCLUDE (if defined by user)
      • <descriptor_or_linter_key>_FILTER_REGEX_EXCLUDE (if defined by user)
  • Linting
    • Parallelly, for each linter with matching files:
      • Call the linter on matching files (or the whole project for some linters like copy-paste detector)
      • Call activated linter-level reporters (GitHub Status Reporter...)
  • Finalization
    • Call activated global level reporters (GitHub Pull Request Comment Reporter, Reporter, Email Reporter...)
    • Manage return code:
      • 0 if no error (or only non blocking errors if user defined DISABLE_ERRORS or <descriptor_or_linter_key>_DISABLE_ERRORS)
      • 1 if errors

How to contribute

Contributions to MegaLinter are very welcome, the more we are, the stronger MegaLinter is ! Please follow Contributing Guide

To help, you can also:

Special thanks


Sites referring to MegaLinter

Web Sites


Open-source teams

MegaLinter obviously would not exist without its linters and libraries, so many thanks to all the dedicated Open-Source teams maintaining all these awesome linters !

Super-Linter team

MegaLinter has been built on the ashes of a rejected Pull Request{target=_blank} on GitHub Super-Linter{target=_blank}.

Even if I disagree with their decision to remain in bash, the core team has always been nice and supporting during the time I was a Super-Linter contributor{target=_blank} :)


MegaLinter vs Super-Linter

The hard-fork of Super-Linter to be rewritten in Python is not just a language switch: use of python flexibility and libraries allowed to define lots of additional functions described below


  • MegaLinter Flavors allow to use smaller docker images, so the pull time is reduced
  • Thanks to python multiprocessing capabilities, linters are run in parallel, which is way faster than Super-Linter bash script who runs all linters in sequence
  • When the linter allows it, call it 1 time with N files, instead of calling N times with one file

More languages and formats linted

  • C, C++, Copy-Paste detection, Credentials, GraphQL, JSON & YAML with JSON schemas, Markdown tables formatting, Puppet, reStructuredText, Rust, Scala, Spell checker, Swift, Visual Basic .NET ...

Automatically apply formatting and fixes

MegaLinter can automatically apply fixes performed by linters, and push them to the same branch, or create a Pull Request that you can validate

This is pretty handy, especially for linter errors related to formatting (in that case, you don't have any manual update to perform)

Run locally

MegaLinter can be run locally thanks to mega-linter-runner



  • Accuracy: Count the total number of errors and not only the number of files in error
  • Show linter version and applied filters for each linter processed
  • Reports stored as artefacts on GitHub Action run or other remote files
    • General log
    • One report file by linter

Additional Reporters





Enhanced Configuration

  • Assisted installation and configuration using a yeoman generator and JSON schemas for configuration file

Runner Install

Assisted configuration

  • Configure include and exclude regexes for a single language or linter: ex: JAVASCRIPT_FILTER_REGEX_INCLUDE (src)
  • Configure additional CLI arguments for a linter: ex: JAVASCRIPT_ES_ARGUMENTS "--debug --env-info"
  • Configure non blocking errors for a single language or linter: ex: JAVASCRIPT_DISABLE_ERRORS
  • Simplify languages and linters variables
    • ENABLE = list of languages and formats to apply lint on codebase (default: all)
    • ENABLE_LINTERS = list of linters to apply lint on codebase (default: all)
    • DISABLE = list of languages and formats to skip (default: none)
    • DISABLE_LINTERS = list of linters to skip (default: none)
    • Variables VALIDATE_XXX are still taken in account (but should not be used in association with ENABLE and DISABLE variables)

Enhanced Documentation

HTML doc home

  • One page per linter documentation :
    • All variables that can be used with this linter
    • List of file extensions, names and filters applied by the linter
    • Link to MegaLinter default linter configuration
    • Link to linter Web-Site
    • Link to official page explaining how to customize the linter rules
    • Link to official page explaining how to disable rules from source comments
    • Examples of linter command line calls behind the hood
    • Help command text
    • Installation commands

HTML doc linter

  • Installation links for related IDEs


    • Separate languages, formats and tooling formats in the linters table
    • Add logos for each descriptor

Plugins management

For linters less commonly used, MegaLinters offers a plugins architecture so anyone can publish plugins

Simplify architecture and evolutive maintenance

  • Refactoring runtime in Python, for easier handling than bash thanks to classes and python modules
  • Everything related to each linter in a single descriptor YML file
    • easier evolutive maintenance
    • less conflicts to manage between PRs.
    • Few special cases require a python linter class)
  • Default behaviours for all linters, with possibility to override part of them for special cases
  • Hierarchical architecture: Apply fixes and new behaviours to all linters with a single code update
  • Documentation as code
    • Generate linters tables (ordered by type: language, format & tooling format) and include it in README. (see result)
    • Generate one markdown file per Linter, containing all configuration variables, infos and examples (See examples)
  • Automatic generation of Dockerfile using YML descriptors, always using the linter latest version
    • Dockerfile commands (FROM, ARG, ENV, COPY, RUN )
    • APK packages (linux)
    • NPM packages (node)
    • PIP packages (python)
    • GEM packages (ruby)
    • Phive packages (PHP)
  • Have a centralized exclude list (node_modules,.rbenv, etc...)

Improve robustness & stability

  • Test classes for each capability
  • Test classes for each linter: Automatic generation of test classes using .automation/
  • Setup code coverage codecov
  • Development CD / CI
    • Validate multi-status on PR inside each PR (posted from step "Run against all code base")
    • Run test classes and code coverage with pytest during validation GitHub Action
    • Validate descriptor YML files with json schema during build
    • Automated job to upgrade linters to their latest stable version

V4 versus V5

  • Tool to upgrade user repos configuration files using npx mega-linter-runner --upgrade (will upgrade references to nvuillam/mega-linter into oxsecurity/megalinter)

  • Migration from github individual repo nvuillam/mega-linter to github organization repo oxsecurity/megalinter

  • Migration from docker hub space nvuillam to space megalinter

    • Docker images are now oxsecurity/megalinter or oxsecurity/megalinter-FLAVOR
  • Documentation is now hosted at

  • Version management: Now mega-linter docker images, github action and mega-linter-runner versions are aligned

    • latest for latest official release
    • beta for current content of main branch
    • alpha for current content of alpha branch
    • docker image, github action and mega-linter-runner can still be called with exact version number
  • Being more inclusive: rename master branch into main

  • IGNORE_GITIGNORED_FILES parameter default to true

Related Awesome Lists
Top Programming Languages
Top Projects

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Python (838,168
Java (396,711
Golang (163,841
Rust (61,771
Kotlin (49,208
Markdown (28,496
Dockerfile (27,341
Terraform (12,034
Linter (9,118
Groovy (8,486
Jenkins (8,204
Formatter (6,577
Github Actions (5,210
Json Schema (1,795
Code Quality (813
Code Quality Analyzer (15
Megalinter (6
Fixing (4