# .github/workflows/linter.yml

name: Lint

permissions: read-all

on:
  push:
    branches: [ "develop", "master", "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "develop", "master", "main" ]

jobs:
  linter:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      issues: write
      pull-requests: write
      security-events: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set Environment
        if: github.base_ref != 'refs/heads/main'
        run: |
          echo "REPOSITORY_TRIVY_DISABLE_ERRORS=true" >> $GITHUB_ENV
          echo "VALIDATE_ALL_CODEBASE=false" >> $GITHUB_ENV
      - name: MegaLinter
        uses: oxsecurity/megalinter@v8
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MEGALINTER_CONFIG: .github/.mega-linter.yml
      - name: Upload MegaLinter scan results to GitHub Security tab
        if: success() || failure()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'megalinter-reports/megalinter-report.sarif'

# .github/mega-linter.yml

ENABLE:
  - JAVA
  - PROTOBUF
  - EDITORCONFIG
  - COPYPASTE
  - REPOSITORY
ENABLE_LINTERS:
  - SQL_SQLFLUFF
  - SPELL_CSPELL
DISABLE_LINTERS:
  - REPOSITORY_KICS
  - REPOSITORY_GRYPE
  - REPOSITORY_DEVSKIM
DISABLE_ERRORS_LINTERS:
  - SPELL_CSPELL
  - COPYPASTE_JSCPD
  - REPOSITORY_TRIVY
  - JAVA_PMD
  - JAVA_CHECKSTYLE
  - REPOSITORY_CHECKOV

SARIF_REPORTER: true
SARIF_REPORTER_NORMALIZE_LINTERS_OUTPUT: false

PRE_COMMANDS:
  - command: curl https://raw.githubusercontent.com/checkstyle/checkstyle/refs/heads/master/src/main/resources/google_checks.xml > google_checks.xml

LINTER_RULES_PATH: .github/linters
JAVA_CHECKSTYLE_FILE_NAME: google_checks.xml
SPELL_CSPELL_FILE_EXTENSIONS:
  - .java
  - .proto