linter.yml

name: Linter

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  statuses: write

jobs:
  build:
    name: Linter
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Lint Code Base
        uses: super-linter/super-linter/slim@v7
        env:
          # Super-Linter v7 enables ~50 validators by default. This is a curated
          # opt-in: only the listed validators run (high-signal for a
          # PowerShell / Bash / docs repo). PowerShell is also covered by the
          # dedicated scriptanalyzer.yml workflow.
          VALIDATE_ALL_CODEBASE: false
          DEFAULT_BRANCH: main
          LINTER_RULES_PATH: .
          VALIDATE_BASH: true
          VALIDATE_YAML: true
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_GITLEAKS: true
          VALIDATE_MARKDOWN: true
          # Exclude the vendored AVM agent playbook and informal cheatsheets from
          # linting, plus any local Python venv / bytecode.
          FILTER_REGEX_EXCLUDE: '(\.github/agents/|cheatsheets/|\.venv/|__pycache__/|/path/to/)'
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}