Skip to content

fix(storage): prepare admission for the patched migration runtime - #6085

Queued
devantler wants to merge 6 commits into
mainfrom
codex/storage-adopt-v1-benchmark-runtime-5665
Queued

devantler wants to merge 6 commits into
mainfrom
codex/storage-adopt-v1-benchmark-runtime-5665

Conversation

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Why

The storage migration needs the patched temporary runtime, but its preparation still names the older build. That would prevent the replacement from starting correctly.

What

Prepare admission for the published patched runtime and remove the superseded build from that exception. Runtime rollout follows separately after the remaining recovery and capacity prerequisites.

Part of #6073

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Validation at f331a549486a188e49f3486faf9f651edb9d7ccb:

  • The replacement binds to the immutable published image from protected publication run 43028830096, source 591ed0ccebd032c4d9705c356c267e724b30e2a9. Its published binary, patched compiler, signatures, provenance and anonymous pull were verified in the operator record.
  • The real Kubernetes admission evaluator reproduced both failures before the policy edit: the patched image was refused, and the superseded image was admitted. The corrected policy passes those decisions plus the existing creator, namespace, service account, ownership, V1, container and privilege boundaries.
  • The complete affected migration package passed race tests in 58.740 seconds, including its complete nested native admission proof. Authorization package race tests passed in 90.356 seconds. The actual authorization validator passed using kubectl v1.36.2, whose binary matched the official checksum. The sole rendered authorization change is this policy's exact image match; its reviewed ledger entry was updated from that renderer's output.
  • Published KSail 7.213.4 validated 878 files for each local and production configuration, explicitly including the changed admission policy. The existing layer-local namespace-selector warnings for three unrelated policies remain an offline validation limitation.

Current-head hosted checks and substantive review remain required. After protected delivery, fresh deployed policy/type-checking and image binding readback precede the separate runtime rollout. That rollout also requires the recovery, memory headroom and volume-health gates in #6073. This preparation does not establish runtime adoption, benchmark acceptance or V2 migration.

@github-actions

github-actions Bot commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 22 errors
on-resolvers.sh
✅ [SUCCESS] scripts/tests/test-publish-workflow-signing-revisions.sh
✅ [SUCCESS] scripts/tests/test-pvc-prune-safety.sh
✅ [SUCCESS] scripts/tests/test-read-actual-budget-userns-maps.sh
✅ [SUCCESS] scripts/tests/test-read-cilium-api-limiter.sh
✅ [SUCCESS] scripts/tests/test-reassert-flux-root-verify.sh
✅ [SUCCESS] scripts/tests/test-redeploy-main-when-behind.sh
✅ [SUCCESS] scripts/tests/test-refresh-flux-ghcr-auth-safety.sh
✅ [SUCCESS] scripts/tests/test-regenerate-publish-workflow-approved-revisions.sh
✅ [SUCCESS] scripts/tests/test-registry-auth-lib.sh
✅ [SUCCESS] scripts/tests/test-release-asset-download.sh
✅ [SUCCESS] scripts/tests/test-release-recovery.sh
✅ [SUCCESS] scripts/tests/test-release-writer-refusal.sh
✅ [SUCCESS] scripts/tests/test-reloader-placement-selection.sh
✅ [SUCCESS] scripts/tests/test-reloader-rendered-placement.sh
✅ [SUCCESS] scripts/tests/test-report-kubescape-scan-orphans.sh
✅ [SUCCESS] scripts/tests/test-report-prod-convergence.sh
✅ [SUCCESS] scripts/tests/test-required-merge-workflows.sh
✅ [SUCCESS] scripts/tests/test-restart-uncapped-talos-coredns.sh
✅ [SUCCESS] scripts/tests/test-restore-stranded-prod-workflow.sh
✅ [SUCCESS] scripts/tests/test-restrict-homepage-service-groups.sh
✅ [SUCCESS] scripts/tests/test-restrict-tenant-network-policies.sh
✅ [SUCCESS] scripts/tests/test-restrict-tenant-secret-stores.sh
✅ [SUCCESS] scripts/tests/test-retire-arc-pool.sh
✅ [SUCCESS] scripts/tests/test-rgd-template-static-scan-wiring.sh
✅ [SUCCESS] scripts/tests/test-rgd-template-static-scan.sh
✅ [SUCCESS] scripts/tests/test-run-go-regressions.sh
✅ [SUCCESS] scripts/tests/test-run-parallel-guard-cases.sh
✅ [SUCCESS] scripts/tests/test-run-publication-generator-tests.sh
✅ [SUCCESS] scripts/tests/test-setup-ksail.sh
✅ [SUCCESS] scripts/tests/test-setup-supply-chain-tools.sh
✅ [SUCCESS] scripts/tests/test-setup-talosctl.sh
✅ [SUCCESS] scripts/tests/test-shared-publish-workflow-pin-guard.sh
✅ [SUCCESS] scripts/tests/test-signing-report-publisher-families.sh
✅ [SUCCESS] scripts/tests/test-stranded-autoscaler-node-alerter.sh
✅ [SUCCESS] scripts/tests/test-stranded-volume-attach-alert.sh
✅ [SUCCESS] scripts/tests/test-substrate-bucket-init-hook.sh
✅ [SUCCESS] scripts/tests/test-summarize-sarif-findings.sh
✅ [SUCCESS] scripts/tests/test-talos-apparmor-lsm-regressions.sh
✅ [SUCCESS] scripts/tests/test-talos-apparmor-lsm.sh
✅ [SUCCESS] scripts/tests/test-talos-drain-budget.sh
✅ [SUCCESS] scripts/tests/test-talos-factory-schematic-registration.sh
✅ [SUCCESS] scripts/tests/test-talos-render-kernel-args.sh
✅ [SUCCESS] scripts/tests/test-talos-schematic-readback.sh
✅ [SUCCESS] scripts/tests/test-talos-version-pins.sh
✅ [SUCCESS] scripts/tests/test-tenant-controller-namespace-coverage.sh
✅ [SUCCESS] scripts/tests/test-tenant-edit-networkpolicy-write.sh
✅ [SUCCESS] scripts/tests/test-tenant-kro-pull-secret.sh
✅ [SUCCESS] scripts/tests/test-tenant-publication-binding.sh
✅ [SUCCESS] scripts/tests/test-tenant-route-hostname-boundary.sh
✅ [SUCCESS] scripts/tests/test-tenant-source-constructors.sh
✅ [SUCCESS] scripts/tests/test-tenant-source-discovery.sh
✅ [SUCCESS] scripts/tests/test-tenant-webapp-boundary.sh
✅ [SUCCESS] scripts/tests/test-tetragon-agent-priority.sh
✅ [SUCCESS] scripts/tests/test-tofu-controller-retirement.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-configmap-content-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-first-party-rbac-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-private-mail-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vault-backup-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vault-config-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vendored-operator-boundary.sh
✅ [SUCCESS] scripts/tests/test-umami-provisioning-bootstrap.sh
✅ [SUCCESS] scripts/tests/test-umami-rendered-placement.sh
✅ [SUCCESS] scripts/tests/test-umami-sso-dashboard-route.sh
✅ [SUCCESS] scripts/tests/test-umami-tracking-probe.sh
✅ [SUCCESS] scripts/tests/test-use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/tests/test-validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/tests/test-validate-image-verifier-liveness-workflow.sh
✅ [SUCCESS] scripts/tests/test-validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/tests/test-validate-kyverno-fixture-evaluation.sh
✅ [SUCCESS] scripts/tests/test-vault-snapshot-group-readable.sh
✅ [SUCCESS] scripts/tests/test-velero-cancellation-release.sh
✅ [SUCCESS] scripts/tests/test-velero-data-mover-resources.sh
✅ [SUCCESS] scripts/tests/test-velero-kopia-renovate-pin.sh
✅ [SUCCESS] scripts/tests/test-velero-maintenance-oom-alert.sh
✅ [SUCCESS] scripts/tests/test-velero-node-agent-priority.sh
✅ [SUCCESS] scripts/tests/test-verify-arc-transport.sh
✅ [SUCCESS] scripts/tests/test-verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/tests/test-verify-image-unsigned.sh
✅ [SUCCESS] scripts/tests/test-verify-matcher-accepts-digest.sh
✅ [SUCCESS] scripts/tests/test-verify-published-evidence.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/tests/test-vpa-updater-event-rbac.sh
✅ [SUCCESS] scripts/tests/test-wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiled-scan.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiler-wiring.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiler.sh
✅ [SUCCESS] scripts/tests/test-webapp-container-security.sh
✅ [SUCCESS] scripts/tests/test-webapp-inputs-wiring.sh
✅ [SUCCESS] scripts/tests/test-webapp-inputs.sh
✅ [SUCCESS] scripts/tests/test-webapp-runtime-hosted.sh
✅ [SUCCESS] scripts/tests/test-wedding-backup-denial-runtime.sh
✅ [SUCCESS] scripts/tests/test-world-zone-signatures.sh
✅ [SUCCESS] scripts/tests/test-world-zone-trial.sh
✅ [SUCCESS] scripts/tests/test-write-publish-workflow-matchers.sh
✅ [SUCCESS] scripts/update-vendored-operators.sh
✅ [SUCCESS] scripts/use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/validate-alert-coverage.sh
✅ [SUCCESS] scripts/validate-embedded-json.sh
✅ [SUCCESS] scripts/validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/validate-kyverno-fixture-evaluation.sh
❌ [ERROR] scripts/validate-webapp-inputs.sh
    Error: File:[scripts/validate-webapp-inputs.sh] is not executable

✅ [SUCCESS] scripts/verify-arc-transport.sh
✅ [SUCCESS] scripts/verify-data-product-rollout.sh
❌ [ERROR] scripts/verify-email-provider/probe-client.sh
    Error: File:[scripts/verify-email-provider/probe-client.sh] is not executable

❌ [ERROR] scripts/verify-email-provider/run.sh
    Error: File:[scripts/verify-email-provider/run.sh] is not executable

✅ [SUCCESS] scripts/verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/verify-heartbeat-cleanup.sh
✅ [SUCCESS] scripts/verify-image-unsigned.sh
✅ [SUCCESS] scripts/verify-kubelet-config-readback.sh
✅ [SUCCESS] scripts/verify-matcher-accepts-digest.sh
❌ [ERROR] scripts/verify-private-mail-storage-recovery.sh
    Error: File:[scripts/verify-private-mail-storage-recovery.sh] is not executable

✅ [SUCCESS] scripts/verify-prod-recovery-source.sh
✅ [SUCCESS] scripts/verify-published-evidence.sh
❌ [ERROR] scripts/verify-shared-backup-consumers.sh
    Error: File:[scripts/verify-shared-backup-consumers.sh] is not executable

✅ [SUCCESS] scripts/verify-talos-schematic-readback.sh
✅ [SUCCESS] scripts/verify-umami-tracking.sh
✅ [SUCCESS] scripts/verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial-pod.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage-pod.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/wait-for-platform-flux-revision.sh
✅ [SUCCESS] scripts/wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/write-publish-workflow-matchers.sh
✅ [SUCCESS] tests/kyverno-stale-report-prune/assert-probe-result.sh


(Truncated to last 8000 characters out of 27155)
⚠️ SPELL / cspell - 1 error
ltrimstr",
        "luks",
        "lycheeignore",
        "machineconfig",
        "mapfile",
        "matchconditions",
        "materialised",
        "materialises",
        "maxx",
        "metacharacter",
        "metav",
        "mikefarah",
        "milters",
        "misconfig",
        "misrouted",
        "mktemp",
        "modfile",
        "multitenant",
        "mutatingadmissionpolicies",
        "mutatingadmissionpolicybindings",
        "mutatingpolicies",
        "mutatingwebhookconfiguration",
        "mutatingwebhookconfigurations",
        "mvdan",
        "myapp",
        "najsk",
        "namerefs",
        "namespaceinventory",
        "namespaceless",
        "neighbouring",
        "neighbours",
        "nesac",
        "netgo",
        "netpol",
        "netpols",
        "networkneighborhood",
        "networkneighborhoods",
        "networkpolicies",
        "neutralises",
        "neutralising",
        "nextjs",
        "nilnil",
        "nlimitrange",
        "nobuckets",
        "noclobber",
        "nodepod",
        "nohooks",
        "nohup",
        "nolint",
        "nonaggregated",
        "noncanonical",
        "nonliteral",
        "nonlocal",
        "nonmatching",
        "nonregular",
        "nonroot",
        "noprofile",
        "noproxy",
        "norc",
        "normalisation",
        "normalise",
        "normalised",
        "normalises",
        "nosec",
        "nounset",
        "nsterrr",
        "nullglob",
        "numjobs",
        "nvme",
        "objectcache",
        "ocirepositories",
        "ocirepository",
        "openbao",
        "opencontainers",
        "openeuler",
        "openfeature",
        "optin",
        "organisation",
        "organisation's",
        "originissuers",
        "osusergo",
        "overprovisioning",
        "packagemetadata",
        "parallelised",
        "pasteable",
        "pdbs",
        "permissioning",
        "perr",
        "persistentvolume",
        "persistentvolumeclaim",
        "persistentvolumeclaims",
        "persistentvolumes",
        "pgdata",
        "pipefail",
        "plugincel",
        "podkey",
        "podperiods",
        "podthrottled",
        "polic",
        "policyreports",
        "portforward",
        "postrender",
        "precheck",
        "prefilter",
        "preimage",
        "premerge",
        "preservingly",
        "prestop",
        "prioritisable",
        "prioritisation",
        "prioritise",
        "prioritised",
        "prioritising",
        "privesc",
        "promtool",
        "protojson",
        "providerconfigs",
        "proxyprotocol",
        "pseudonymization",
        "pseudonymized",
        "pseudonymizes",
        "psql",
        "psqlrc",
        "pushsecret",
        "pushsecrets",
        "pvcs",
        "randomises",
        "randread",
        "randrepeat",
        "randrw",
        "randseed",
        "randwrite",
        "rawfile",
        "rdqwpktr",
        "readarray",
        "readback",
        "readbacks",
        "readyz",
        "realpath",
        "rebuildable",
        "recognisable",
        "recognisably",
        "recognise",
        "recognised",
        "recognises",
        "recolour",
        "reconverges",
        "redir",
        "redirs",
        "referencegrants",
        "regenerable",
        "rego",
        "releaserc",
        "relpath",
        "rematerialise",
        "rematerialised",
        "remediations",
        "replicaset",
        "replicasets",
        "repoint",
        "repointed",
        "repoints",
        "repositoryrulesets",
        "rescan",
        "rescans",
        "reserialize",
        "resizer",
        "resourcegraphdefinitions",
        "resourcesets",
        "restic",
        "restrictor",
        "retabbed",
        "retagged",
        "retagging",
        "retarget",
        "retirementproof",
        "rollouts",
        "rulemanager",
        "rustfs",
        "rwmixread",
        "sanitised",
        "sanitiser",
        "sanitising",
        "sarif",
        "sbommanager",
        "scheckov",
        "schedulable",
        "scheduledbackups",
        "scopeable",
        "scopeless",
        "seccomp",
        "secretbox",
        "secretstore",
        "seedable",
        "serialise",
        "serviceaccount",
        "setcap",
        "setgid",
        "setsid",
        "shellcheck",
        "shfmt",
        "shopt",
        "siderolabs",
        "sigstore",
        "skmde",
        "slicelabels",
        "slsa",
        "slurpfile",
        "snapshotfs",
        "softwarecomposition",
        "specnull",
        "spiffe",
        "stalwartlabs",
        "standbyok",
        "startswith",
        "statefulset",
        "statefulsets",
        "statemanager",
        "stdlib",
        "storageclass",
        "storageclasses",
        "storageconfig",
        "strenv",
        "strictjson",
        "strvals",
        "subaddress",
        "subjectaccessreviews",
        "subrequest",
        "subresource",
        "subresources",
        "subshell",
        "subtest",
        "summ",
        "summarise",
        "summarised",
        "supplychain",
        "surfaceless",
        "syft",
        "syfttypes",
        "syscall",
        "sysctls",
        "sysfs",
        "syste",
        "systeminformation",
        "talosconfig",
        "talosctl",
        "tanzu",
        "tdir",
        "templatesyncignore",
        "testdata",
        "testonly",
        "thresholded",
        "tmpfs",
        "todate",
        "tolerations",
        "tonumber",
        "toomanyrequests",
        "toplevel",
        "tostring",
        "tracepoints",
        "trimpath",
        "trixie",
        "trueish",
        "uids",
        "umami",
        "umami's",
        "unablated",
        "uncharacterized",
        "uncompilable",
        "unconfigured",
        "uncordon",
        "undecoded",
        "undeployed",
        "undercounted",
        "undercounts",
        "undispositioned",
        "unexcepted",
        "unexempted",
        "unfetched",
        "unfiled",
        "ungated",
        "ungenerated",
        "unidiff",
        "unifi",
        "uninspectable",
        "uninspected",
        "unjournaled",
        "unjudged",
        "unmarshals",
        "unmatch",
        "unmodelled",
        "unopenable",
        "unparseable",
        "unpartitioned",
        "unpatchable",
        "unprovisioned",
        "unrecognisable",
        "unrecognised",
        "unrenderable",
        "unrequested",
        "unretried",
        "unreviewed",
        "unrewritten",
        "unrun",
        "unscanned",
        "unshippable",
        "unsignalled",
        "unstarted",
        "unsuspended",
        "unvalidated",
        "unwaited",
        "unwired",
        "upbound",
        "updatekeys",
        "upjet",
        "uprobes",
        "urlencode",
        "usec",
        "userns",
        "ushfn",
        "validatable",
        "validatingadmissionpolicies",
        "validatingadmissionpolicybindings",
        "valuesfrom",
        "vcunav",
        "velero",
        "verticalpodautoscalers",
        "vfio",
        "virt",
        "volumeattachments",
        "volumeconfig",
        "volumesnapshot",
        "volumestatus",
        "vpas",
        "vulnerabilitymanifests",
        "vulnerabilitymanifestsummaries",
        "vulnerabilitymanifestsummary",
        "vulns",
        "wals",
        "webapps",
        "webui",
        "wffc",
        "wgpolicyk",
        "wildcarding",
        "wlid",
        "workloadconfigurationscan",
        "workloadconfigurationscans",
        "workloadconfigurationscansummaries",
        "workloadconfigurationscansummary",
        "worktree",
        "xform",
        "xlated",
        "xpkg",
        "yannh",
        "yubikey",
        "yzwvjjmcyfnl",
        "zizmor",
        "zizmorcore"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository

(Truncated to last 8000 characters out of 1179996)
⚠️ COPYPASTE / jscpd - 691 errors
(6 lines, 54 tokens)
   scripts/validate-merge-group-heal/main_test.go [85:9 - 92:2]
Clone found (go)
 - scripts/validate-merge-group-heal/main_test.go [184:335 - 191:7] (8 lines, 61 tokens)
   scripts/validate-merge-group-heal/main_test.go [553:3 - 562:7]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [27:4 - 33:14] (7 lines, 75 tokens)
   scripts/validate-policy-actions/main_test.go [161:2 - 165:49]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [30:67 - 39:3] (10 lines, 64 tokens)
   scripts/validate-policy-actions/main_test.go [218:64 - 227:3]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [179:65 - 186:41] (8 lines, 83 tokens)
   scripts/validate-policy-actions/main_test.go [255:191 - 262:41]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [215:69 - 228:3] (14 lines, 101 tokens)
   scripts/validate-policy-actions/main_test.go [259:72 - 272:2]
Clone found (go)
 - scripts/verify-arc-app-identity/runner_group.go [170:2 - 176:30] (7 lines, 77 tokens)
   scripts/verify-arc-app-identity/verify.go [249:2 - 255:30]
Clone found (bash)
 - scripts/verify-data-product-rollout.sh [281:78 - 286:7] (6 lines, 129 tokens)
   scripts/verify-data-product-rollout.sh [362:72 - 366:79]
Clone found (go)
 - scripts/verify-email-data-recovery/cleanup.go [55:3 - 64:15] (10 lines, 58 tokens)
   scripts/verify-email-data-recovery/retained_entry.go [241:82 - 250:15]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [17:37 - 29:2] (13 lines, 72 tokens)
   scripts/verify-email-storage-canary/main.go [45:1 - 58:2]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [33:2 - 38:13] (6 lines, 53 tokens)
   scripts/verify-email-provider/main.go [71:2 - 76:13]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [92:16 - 101:33] (10 lines, 88 tokens)
   scripts/verify-email-storage-canary/main.go [108:16 - 117:33]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [269:18 - 288:2] (20 lines, 117 tokens)
   scripts/verify-email-storage-canary/main.go [160:13 - 179:2]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_lifecycle_test.go [163:76 - 168:46] (6 lines, 63 tokens)
   scripts/verify-email-data-recovery/observation_lifecycle_test.go [221:94 - 226:46]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_workflow_test.go [14:85 - 39:16] (26 lines, 190 tokens)
   scripts/verify-email-data-recovery/retained_workflow_test.go [14:85 - 39:16]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_workflow_test.go [48:111 - 57:36] (10 lines, 66 tokens)
   scripts/verify-email-data-recovery/retained_workflow_test.go [48:108 - 57:36]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_workflow_test.go [74:2 - 82:4] (9 lines, 99 tokens)
   scripts/verify-email-data-recovery/retained_workflow_test.go [64:2 - 72:4]
Clone found (go)
 - scripts/verify-email-data-recovery/proof.go [86:62 - 93:3] (8 lines, 53 tokens)
   scripts/verify-email-data-recovery/retained_disposal.go [81:76 - 88:5]
Clone found (go)
 - scripts/verify-email-data-recovery/resources_test.go [93:2 - 101:3] (9 lines, 62 tokens)
   scripts/verify-email-data-recovery/resources_test.go [128:4 - 136:5]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [350:22 - 357:4] (8 lines, 68 tokens)
   scripts/verify-email-storage-canary/main.go [382:22 - 389:4]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [458:2 - 467:11] (10 lines, 62 tokens)
   scripts/verify-email-storage-canary/main.go [472:2 - 481:11]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [458:37 - 467:11] (10 lines, 50 tokens)
   scripts/verify-email-storage-canary/main.go [486:5 - 495:11]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [468:35 - 477:3] (10 lines, 50 tokens)
   scripts/verify-email-storage-canary/main.go [517:39 - 526:3]
Clone found (bash)
 - scripts/verify-kubelet-config-readback.sh [52:1 - 57:10] (6 lines, 63 tokens)
   scripts/verify-talos-schematic-readback.sh [16:46 - 20:42]
Clone found (go)
 - scripts/verify-longhorn-migration-headroom/provider_location_test.go [16:53 - 21:105] (6 lines, 68 tokens)
   scripts/verify-longhorn-migration-headroom/provider_location_test.go [49:85 - 54:107]
Clone found (bash)
 - scripts/verify-shared-backup-consumers.sh [55:86 - 60:47] (6 lines, 72 tokens)
   scripts/verify-wedding-backup-cutover.sh [74:45 - 80:47]
Clone found (go)
 - scripts/verify-wedding-backup-bootstrap/proof_test.go [95:67 - 100:62] (6 lines, 63 tokens)
   scripts/verify-wedding-backup-bootstrap/proof_test.go [165:70 - 170:62]
Clone found (go)
 - scripts/verify-wedding-backup-bootstrap/runtime.go [39:2 - 59:41] (21 lines, 172 tokens)
   scripts/verify-wedding-dedicated-restore/main.go [163:2 - 183:41]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [114:1 - 128:68] (15 lines, 136 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [133:1 - 147:68]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [131:8 - 141:6] (11 lines, 136 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [155:30 - 165:6]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [144:87 - 150:113] (7 lines, 73 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [166:47 - 172:113]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [164:47 - 169:96] (6 lines, 82 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [223:37 - 228:96]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [253:5 - 280:12] (28 lines, 110 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [302:5 - 329:12]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [282:49 - 294:16] (13 lines, 54 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [331:62 - 343:16]
┌────────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format     │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ bash       │ 424            │ 122030      │ 642120       │ 197          │ 2381 (1.95%)     │ 16391 (2.55%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ diff       │ 18             │ 15370       │ 160622       │ 94           │ 704 (4.58%)      │ 11296 (7.03%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ go         │ 696            │ 164613      │ 1282668      │ 400          │ 3265 (1.98%)     │ 30221 (2.36%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ javascript │ 9              │ 694         │ 12086        │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ toml       │ 1              │ 32          │ 86           │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt        │ 3              │ 2299        │ 16956        │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:     │ 1151           │ 305038      │ 2114538      │ 691          │ 6350 (2.08%)     │ 57908 (2.74%)     │
└────────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 691 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (2.1%) over threshold (0.0%)
time: 6.26s

(Truncated to last 8000 characters out of 133341)
⚠️ SPELL / lychee - 48 errors
📝 Summary
---------------------
🔍 Total..........700
🔗 Unique.........465
✅ Successful.....542
⏳ Timeouts.........0
🔀 Redirected......15
👻 Excluded.......107
❓ Unknown..........0
🚫 Errors..........48
⛔ Unsupported.....48

Errors in .github/workflows/ci.yaml
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 895:14) | Error (cached)
[404] https://get.helm.sh/$archive (at 1175:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 1648:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 4211:65) | Error (cached)
[404] https://get.helm.sh/$archive.sha256sum (at 4212:75) | Rejected status code: 404 Not Found

Errors in .github/workflows/copy-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 132:27) | Error (cached)
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 112:17) | Error (cached)

Errors in .github/workflows/measure-ci-runtime.yaml
[404] https://get.helm.sh/$archive (at 114:77) | Rejected status code: 404 Not Found

Errors in .github/workflows/prepare-email-storage-key.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 109:17) | Connection refused - server may be down or port blocked

Errors in .github/workflows/publish-coroot-checkpoint-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-checkpoint-hotfix.yaml@refs/heads/main (at 212:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-coroot-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-node-agent-hotfix.yaml@refs/heads/main (at 248:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-dex-security-image.yaml
[404] https://devantler.tech/attestations/dex-build/v1 (at 155:82) | Rejected status code: 404 Not Found
[404] https://devantler.tech/attestations/dex-build/v1 (at 159:23) | Rejected status code: 404 Not Found
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-dex-security-image.yaml@refs/heads/main (at 157:20) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kagent-claude-harness.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kagent-claude-harness.yaml@refs/heads/main (at 129:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kubescape-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-node-agent-hotfix.yaml@refs/heads/main (at 186:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kubescape-storage-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-storage-hotfix.yaml@refs/heads/main (at 270:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-background-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-background-hotfix.yaml@refs/heads/main (at 205:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-migration-runtime.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-migration-runtime.yaml@refs/heads/main (at 187:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-reports-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-reports-hotfix.yaml@refs/heads/main (at 183:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-longhorn-v1-retirement.yaml
[404] https://devantler.tech/attestations/longhorn-retirement-build/v1 (at 208:24) | Rejected status code: 404 Not Found
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-longhorn-v1-retirement.yaml@refs/heads/main (at 206:20) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-longhorn-v2-only.yaml
[404] https://devantler.tech/attestations/longhorn-v2-only-build/v1 (at 163:22) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive (at 120:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 61:77) | Error (cached)
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-longhorn-v2-only.yaml@refs/heads/main (at 161:21) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-private-mail-bootstrap.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-private-mail-bootstrap.yaml@refs/heads/main (at 176:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-release-recovery.yaml
[404] https://api.github.com/repos/$REPOSITORY/releases/generate-notes (at 192:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 257:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 97:14) | Rejected status code: 404 Not Found

Errors in .github/workflows/validate-coroot-security-progress.yaml
[ERROR] http://127.0.0.1:1/ (at 137:67) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 89:36) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 90:25) | Error (cached)
[ERROR] http://127.0.0.1:9090/ (at 130:80) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 135:66) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 136:64) | Connection refused - server may be down or port blocked

Errors in .github/workflows/verify-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 110:27) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 103:17) | Error (cached)

Errors in .github/workflows/verify-email-storage-key-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 110:17) | Error (cached)

Errors in .github/workflows/verify-openbao-backup-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 114:17) | Error (cached)

Errors in docs/costs.md
[404] https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/#cloud-servers (at 24:27) | Rejected status code: 404 Not Found

Errors in scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html
[ERROR] error: (at 1:78) | Cannot resolve root-relative link '/': To resolve root-relative links in local files, provide a root dir
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/bundle.main.841ee8bbb7cc9d85b79e.css (at 1:536) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-16x16.png (at 1:401) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-32x32.png (at 1:336) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon.ico (at 1:450) | File not found. Check if file exists and path is correct

Errors in scripts/reconcile-talos-kernel-args/README.md
[404] https://github.com/devantler-tech/ksail/actions/runs/37591901167 (at 623:23) | Rejected status code: 404 Not Found

Errors in talos/control-planes/wireguard.yaml
[404] https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ (at 49:5) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ --[308]--> https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig

Hint: Followed 15 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 92 errors
[Expected: 400; Actual: 523]
AGENTS.md:470:401 error MD013/line-length Line length [Expected: 400; Actual: 613]
AGENTS.md:471:401 error MD013/line-length Line length [Expected: 400; Actual: 711]
AGENTS.md:475:401 error MD013/line-length Line length [Expected: 400; Actual: 509]
AGENTS.md:479:401 error MD013/line-length Line length [Expected: 400; Actual: 458]
AGENTS.md:480:401 error MD013/line-length Line length [Expected: 400; Actual: 525]
AGENTS.md:484:401 error MD013/line-length Line length [Expected: 400; Actual: 444]
AGENTS.md:521:401 error MD013/line-length Line length [Expected: 400; Actual: 1565]
AGENTS.md:522:401 error MD013/line-length Line length [Expected: 400; Actual: 2266]
AGENTS.md:584:401 error MD013/line-length Line length [Expected: 400; Actual: 1217]
AGENTS.md:586:401 error MD013/line-length Line length [Expected: 400; Actual: 463]
AGENTS.md:588:401 error MD013/line-length Line length [Expected: 400; Actual: 1741]
AGENTS.md:602:401 error MD013/line-length Line length [Expected: 400; Actual: 1396]
AGENTS.md:610:401 error MD013/line-length Line length [Expected: 400; Actual: 542]
AGENTS.md:681:401 error MD013/line-length Line length [Expected: 400; Actual: 790]
AGENTS.md:686:401 error MD013/line-length Line length [Expected: 400; Actual: 515]
CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
docs/adr/headless-cms.md:66:401 error MD013/line-length Line length [Expected: 400; Actual: 450]
docs/adr/headless-cms.md:67:401 error MD013/line-length Line length [Expected: 400; Actual: 457]
docs/crossplane-sync-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 427]
docs/crossplane-sync-recovery.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 577]
docs/dr/alerting.md:263:28 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:22:389 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:23:264 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:35 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:161 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:239 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:114 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:296 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:302 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it leaks"]
docs/dr/crypto-custody.md:309 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it is *lost* (no..."]
docs/dr/restore-drill.md:161 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:23:102 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:23:487 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:34 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:44 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:53 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:263 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:708:92 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/spire-server-ha.md:93 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/dr/velero-cnpg.md:11 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/github-management.md:38:401 error MD013/line-length Line length [Expected: 400; Actual: 419]
docs/github-management.md:40:401 error MD013/line-length Line length [Expected: 400; Actual: 522]
docs/node-autoscaling.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/oidc-kubectl.md:111 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/operations/email-client-identity.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/gateway-receiver-boundary.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/ingress-client-address.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/production-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 491]
docs/release-recovery.md:10:401 error MD013/line-length Line length [Expected: 400; Actual: 576]
docs/release-recovery.md:12:401 error MD013/line-length Line length [Expected: 400; Actual: 793]
docs/release-recovery.md:14:401 error MD013/line-length Line length [Expected: 400; Actual: 477]
docs/runtime-security.md:140 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/rwx-storage.md:38 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:60 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
k8s/bases/infrastructure/controllers/tetragon/README.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 505]
k8s/bases/README.md:10:141 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:39 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:138 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:91 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:207 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:9:234 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/judge-openbao-quorum/README.md:25:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
scripts/README.md:15:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:16:185 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:98 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:20:255 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]

(Truncated to last 8000 characters out of 10096)

✅ Linters with no issues

actionlint, betterleaks, checkov, git_diff, grype, hadolint, jsonlint, osv-scanner, prettier, prettier, revive, secretlint, shellcheck, shfmt, syft, trivy, trivy-sbom, trufflehog, v8r, v8r, yamllint, zizmor

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@github-actions

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 22 errors
on-resolvers.sh
✅ [SUCCESS] scripts/tests/test-publish-workflow-signing-revisions.sh
✅ [SUCCESS] scripts/tests/test-pvc-prune-safety.sh
✅ [SUCCESS] scripts/tests/test-read-actual-budget-userns-maps.sh
✅ [SUCCESS] scripts/tests/test-read-cilium-api-limiter.sh
✅ [SUCCESS] scripts/tests/test-reassert-flux-root-verify.sh
✅ [SUCCESS] scripts/tests/test-redeploy-main-when-behind.sh
✅ [SUCCESS] scripts/tests/test-refresh-flux-ghcr-auth-safety.sh
✅ [SUCCESS] scripts/tests/test-regenerate-publish-workflow-approved-revisions.sh
✅ [SUCCESS] scripts/tests/test-registry-auth-lib.sh
✅ [SUCCESS] scripts/tests/test-release-asset-download.sh
✅ [SUCCESS] scripts/tests/test-release-recovery.sh
✅ [SUCCESS] scripts/tests/test-release-writer-refusal.sh
✅ [SUCCESS] scripts/tests/test-reloader-placement-selection.sh
✅ [SUCCESS] scripts/tests/test-reloader-rendered-placement.sh
✅ [SUCCESS] scripts/tests/test-report-kubescape-scan-orphans.sh
✅ [SUCCESS] scripts/tests/test-report-prod-convergence.sh
✅ [SUCCESS] scripts/tests/test-required-merge-workflows.sh
✅ [SUCCESS] scripts/tests/test-restart-uncapped-talos-coredns.sh
✅ [SUCCESS] scripts/tests/test-restore-stranded-prod-workflow.sh
✅ [SUCCESS] scripts/tests/test-restrict-homepage-service-groups.sh
✅ [SUCCESS] scripts/tests/test-restrict-tenant-network-policies.sh
✅ [SUCCESS] scripts/tests/test-restrict-tenant-secret-stores.sh
✅ [SUCCESS] scripts/tests/test-retire-arc-pool.sh
✅ [SUCCESS] scripts/tests/test-rgd-template-static-scan-wiring.sh
✅ [SUCCESS] scripts/tests/test-rgd-template-static-scan.sh
✅ [SUCCESS] scripts/tests/test-run-go-regressions.sh
✅ [SUCCESS] scripts/tests/test-run-parallel-guard-cases.sh
✅ [SUCCESS] scripts/tests/test-run-publication-generator-tests.sh
✅ [SUCCESS] scripts/tests/test-setup-ksail.sh
✅ [SUCCESS] scripts/tests/test-setup-supply-chain-tools.sh
✅ [SUCCESS] scripts/tests/test-setup-talosctl.sh
✅ [SUCCESS] scripts/tests/test-shared-publish-workflow-pin-guard.sh
✅ [SUCCESS] scripts/tests/test-signing-report-publisher-families.sh
✅ [SUCCESS] scripts/tests/test-stranded-autoscaler-node-alerter.sh
✅ [SUCCESS] scripts/tests/test-stranded-volume-attach-alert.sh
✅ [SUCCESS] scripts/tests/test-substrate-bucket-init-hook.sh
✅ [SUCCESS] scripts/tests/test-summarize-sarif-findings.sh
✅ [SUCCESS] scripts/tests/test-talos-apparmor-lsm-regressions.sh
✅ [SUCCESS] scripts/tests/test-talos-apparmor-lsm.sh
✅ [SUCCESS] scripts/tests/test-talos-drain-budget.sh
✅ [SUCCESS] scripts/tests/test-talos-factory-schematic-registration.sh
✅ [SUCCESS] scripts/tests/test-talos-render-kernel-args.sh
✅ [SUCCESS] scripts/tests/test-talos-schematic-readback.sh
✅ [SUCCESS] scripts/tests/test-talos-version-pins.sh
✅ [SUCCESS] scripts/tests/test-tenant-controller-namespace-coverage.sh
✅ [SUCCESS] scripts/tests/test-tenant-edit-networkpolicy-write.sh
✅ [SUCCESS] scripts/tests/test-tenant-kro-pull-secret.sh
✅ [SUCCESS] scripts/tests/test-tenant-publication-binding.sh
✅ [SUCCESS] scripts/tests/test-tenant-route-hostname-boundary.sh
✅ [SUCCESS] scripts/tests/test-tenant-source-constructors.sh
✅ [SUCCESS] scripts/tests/test-tenant-source-discovery.sh
✅ [SUCCESS] scripts/tests/test-tenant-webapp-boundary.sh
✅ [SUCCESS] scripts/tests/test-tetragon-agent-priority.sh
✅ [SUCCESS] scripts/tests/test-tofu-controller-retirement.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-configmap-content-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-first-party-rbac-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-private-mail-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vault-backup-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vault-config-identity-boundary.sh
✅ [SUCCESS] scripts/tests/test-trivyignore-vendored-operator-boundary.sh
✅ [SUCCESS] scripts/tests/test-umami-provisioning-bootstrap.sh
✅ [SUCCESS] scripts/tests/test-umami-rendered-placement.sh
✅ [SUCCESS] scripts/tests/test-umami-sso-dashboard-route.sh
✅ [SUCCESS] scripts/tests/test-umami-tracking-probe.sh
✅ [SUCCESS] scripts/tests/test-use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/tests/test-validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/tests/test-validate-image-verifier-liveness-workflow.sh
✅ [SUCCESS] scripts/tests/test-validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/tests/test-validate-kyverno-fixture-evaluation.sh
✅ [SUCCESS] scripts/tests/test-vault-snapshot-group-readable.sh
✅ [SUCCESS] scripts/tests/test-velero-cancellation-release.sh
✅ [SUCCESS] scripts/tests/test-velero-data-mover-resources.sh
✅ [SUCCESS] scripts/tests/test-velero-kopia-renovate-pin.sh
✅ [SUCCESS] scripts/tests/test-velero-maintenance-oom-alert.sh
✅ [SUCCESS] scripts/tests/test-velero-node-agent-priority.sh
✅ [SUCCESS] scripts/tests/test-verify-arc-transport.sh
✅ [SUCCESS] scripts/tests/test-verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/tests/test-verify-image-unsigned.sh
✅ [SUCCESS] scripts/tests/test-verify-matcher-accepts-digest.sh
✅ [SUCCESS] scripts/tests/test-verify-published-evidence.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/tests/test-verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/tests/test-vpa-updater-event-rbac.sh
✅ [SUCCESS] scripts/tests/test-wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiled-scan.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiler-wiring.sh
✅ [SUCCESS] scripts/tests/test-webapp-compiler.sh
✅ [SUCCESS] scripts/tests/test-webapp-container-security.sh
✅ [SUCCESS] scripts/tests/test-webapp-inputs-wiring.sh
✅ [SUCCESS] scripts/tests/test-webapp-inputs.sh
✅ [SUCCESS] scripts/tests/test-webapp-runtime-hosted.sh
✅ [SUCCESS] scripts/tests/test-wedding-backup-denial-runtime.sh
✅ [SUCCESS] scripts/tests/test-world-zone-signatures.sh
✅ [SUCCESS] scripts/tests/test-world-zone-trial.sh
✅ [SUCCESS] scripts/tests/test-write-publish-workflow-matchers.sh
✅ [SUCCESS] scripts/update-vendored-operators.sh
✅ [SUCCESS] scripts/use-prod-stable-api-endpoint.sh
✅ [SUCCESS] scripts/validate-alert-coverage.sh
✅ [SUCCESS] scripts/validate-embedded-json.sh
✅ [SUCCESS] scripts/validate-homepage-bookmarks.sh
✅ [SUCCESS] scripts/validate-image-verifier-liveness.sh
✅ [SUCCESS] scripts/validate-kyverno-fixture-evaluation.sh
❌ [ERROR] scripts/validate-webapp-inputs.sh
    Error: File:[scripts/validate-webapp-inputs.sh] is not executable

✅ [SUCCESS] scripts/verify-arc-transport.sh
✅ [SUCCESS] scripts/verify-data-product-rollout.sh
❌ [ERROR] scripts/verify-email-provider/probe-client.sh
    Error: File:[scripts/verify-email-provider/probe-client.sh] is not executable

❌ [ERROR] scripts/verify-email-provider/run.sh
    Error: File:[scripts/verify-email-provider/run.sh] is not executable

✅ [SUCCESS] scripts/verify-gateway-routes-applied.sh
✅ [SUCCESS] scripts/verify-heartbeat-cleanup.sh
✅ [SUCCESS] scripts/verify-image-unsigned.sh
✅ [SUCCESS] scripts/verify-kubelet-config-readback.sh
✅ [SUCCESS] scripts/verify-matcher-accepts-digest.sh
❌ [ERROR] scripts/verify-private-mail-storage-recovery.sh
    Error: File:[scripts/verify-private-mail-storage-recovery.sh] is not executable

✅ [SUCCESS] scripts/verify-prod-recovery-source.sh
✅ [SUCCESS] scripts/verify-published-evidence.sh
❌ [ERROR] scripts/verify-shared-backup-consumers.sh
    Error: File:[scripts/verify-shared-backup-consumers.sh] is not executable

✅ [SUCCESS] scripts/verify-talos-schematic-readback.sh
✅ [SUCCESS] scripts/verify-umami-tracking.sh
✅ [SUCCESS] scripts/verify-wedding-backup-cutover.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial-pod.sh
✅ [SUCCESS] scripts/verify-wedding-backup-denial.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage-pod.sh
✅ [SUCCESS] scripts/verify-wedding-shared-backup-coverage.sh
✅ [SUCCESS] scripts/wait-for-platform-flux-revision.sh
✅ [SUCCESS] scripts/wait-for-prod-api-stability.sh
✅ [SUCCESS] scripts/write-publish-workflow-matchers.sh
✅ [SUCCESS] tests/kyverno-stale-report-prune/assert-probe-result.sh


(Truncated to last 8000 characters out of 27155)
⚠️ SPELL / cspell - 1 error
ns",
        "mvdan",
        "myapp",
        "najsk",
        "namerefs",
        "namespaceinventory",
        "namespaceless",
        "neighbouring",
        "neighbours",
        "nesac",
        "netcat",
        "netgo",
        "netpol",
        "netpols",
        "networkneighborhood",
        "networkneighborhoods",
        "networkpolicies",
        "neutralises",
        "neutralising",
        "nextjs",
        "nilnil",
        "nlimitrange",
        "nobuckets",
        "noclobber",
        "nodepod",
        "nohooks",
        "nohup",
        "nolint",
        "nonaggregated",
        "noncanonical",
        "nonliteral",
        "nonlocal",
        "nonmatching",
        "nonregular",
        "nonroot",
        "noprofile",
        "noproxy",
        "norc",
        "normalisation",
        "normalise",
        "normalised",
        "normalises",
        "normalising",
        "nosec",
        "nounset",
        "nslookup",
        "nsterrr",
        "nullglob",
        "numjobs",
        "nvme",
        "objectcache",
        "ocirepositories",
        "ocirepository",
        "onnode",
        "openbao",
        "opencontainers",
        "openeuler",
        "openfeature",
        "optin",
        "organisation",
        "organisation's",
        "originissuers",
        "osusergo",
        "osxkeychain",
        "overprovisioning",
        "packagemetadata",
        "parallelised",
        "pasteable",
        "pdbs",
        "permissioning",
        "perr",
        "persistentvolume",
        "persistentvolumeclaim",
        "persistentvolumeclaims",
        "persistentvolumes",
        "pgdata",
        "pids",
        "pipefail",
        "plugincel",
        "poddisruptionbudgets",
        "podkey",
        "podperiods",
        "podthrottled",
        "polic",
        "policyexceptions",
        "policyreport",
        "policyreports",
        "portforward",
        "postcheck",
        "postrender",
        "postrenderer",
        "precheck",
        "preferredversion",
        "prefilter",
        "preimage",
        "premerge",
        "preservingly",
        "prestop",
        "prioritisable",
        "prioritisation",
        "prioritise",
        "prioritised",
        "prioritising",
        "privesc",
        "promtool",
        "protojson",
        "providerconfigs",
        "proxyprotocol",
        "pseudonymization",
        "pseudonymized",
        "pseudonymizes",
        "psql",
        "psqlrc",
        "pushsecret",
        "pushsecrets",
        "pvcs",
        "randomises",
        "randread",
        "randrepeat",
        "randrw",
        "randseed",
        "randwrite",
        "rawfile",
        "rdqwpktr",
        "readarray",
        "readback",
        "readbacks",
        "readyz",
        "realpath",
        "rebuildable",
        "recognisable",
        "recognisably",
        "recognise",
        "recognised",
        "recognises",
        "recolour",
        "reconverges",
        "redir",
        "redirs",
        "referencegrants",
        "regenerable",
        "rego",
        "releaserc",
        "relpath",
        "rematerialise",
        "rematerialised",
        "remediations",
        "replicaset",
        "replicasets",
        "repoint",
        "repointed",
        "repoints",
        "repositoryrulesets",
        "rescan",
        "rescanned",
        "rescanned's",
        "rescans",
        "reserialize",
        "resizer",
        "resourcegraphdefinitions",
        "resourcesets",
        "restic",
        "restrictor",
        "retabbed",
        "retagged",
        "retagging",
        "retarget",
        "retirementproof",
        "rocksdb",
        "rollouts",
        "rulemanager",
        "runtimerulealertbindings",
        "rustfs",
        "rwmixread",
        "sanitised",
        "sanitiser",
        "sanitising",
        "sarif",
        "sasl",
        "sbommanager",
        "scheckov",
        "schedulable",
        "scheduledbackups",
        "scopeable",
        "scopeless",
        "seccomp",
        "secretbox",
        "secretstore",
        "seedable",
        "serialise",
        "serviceaccount",
        "setcap",
        "setgid",
        "setsid",
        "shellcheck",
        "shfmt",
        "shopt",
        "siderolabs",
        "sigstore",
        "skmde",
        "slicelabels",
        "slurpfile",
        "snapshotfs",
        "softwarecomposition",
        "specnull",
        "spiffe",
        "stalwartlabs",
        "standbyok",
        "startswith",
        "statefulset",
        "statefulsets",
        "statemanager",
        "stdlib",
        "storageclass",
        "storageclasses",
        "storageconfig",
        "strenv",
        "strictjson",
        "strvals",
        "subaddress",
        "subjectaccessreviews",
        "subrequest",
        "subresource",
        "subresources",
        "subshell",
        "subtest",
        "summ",
        "summarise",
        "summarised",
        "supplychain",
        "supportbundles",
        "surfaceless",
        "syft",
        "syfttypes",
        "syscall",
        "sysctls",
        "sysfs",
        "syste",
        "systeminformation",
        "talosconfig",
        "talosctl",
        "tanzu",
        "tdir",
        "templatesyncignore",
        "testbin",
        "testdata",
        "testonly",
        "thresholded",
        "tmpfs",
        "todate",
        "tolerations",
        "tonumber",
        "toomanyrequests",
        "toplevel",
        "tostring",
        "tracepoints",
        "trimpath",
        "trixie",
        "trueish",
        "uids",
        "umami",
        "umami's",
        "unablated",
        "uncharacterized",
        "unclickable",
        "uncompilable",
        "unconfigured",
        "uncordon",
        "undecoded",
        "undeployed",
        "undercounted",
        "undercounts",
        "undispositioned",
        "unexcepted",
        "unexempted",
        "unfetched",
        "unfiled",
        "ungated",
        "ungenerated",
        "unidiff",
        "unifi",
        "uninspectable",
        "uninspected",
        "unjournaled",
        "unjudged",
        "unmarshals",
        "unmatch",
        "unmodelled",
        "unopenable",
        "unparseable",
        "unpartitioned",
        "unpatchable",
        "unprovisioned",
        "unrecognisable",
        "unrecognised",
        "unrenderable",
        "unrequested",
        "unretried",
        "unreviewed",
        "unrewritten",
        "unrouted",
        "unrun",
        "unscanned",
        "unshippable",
        "unsignalled",
        "unstarted",
        "unsuspended",
        "unvalidated",
        "unwaited",
        "unwired",
        "upbound",
        "updatekeys",
        "upjet",
        "uprobes",
        "urlencode",
        "usec",
        "userns",
        "ushfn",
        "validatable",
        "validatingadmissionpolicies",
        "validatingadmissionpolicybindings",
        "validatingpolicy",
        "validatingwebhookconfigurations",
        "valuesfrom",
        "vcunav",
        "velero",
        "verticalpodautoscalers",
        "vfio",
        "virt",
        "volumeattachments",
        "volumeconfig",
        "volumesnapshot",
        "volumestatus",
        "vpas",
        "vulnerabilitymanifests",
        "vulnerabilitymanifestsummaries",
        "vulnerabilitymanifestsummary",
        "vulns",
        "wals",
        "webadmin",
        "webapps",
        "webui",
        "wffc",
        "wgpolicyk",
        "wildcarding",
        "wlid",
        "workloadconfigurationscan",
        "workloadconfigurationscans",
        "workloadconfigurationscansummaries",
        "workloadconfigurationscansummary",
        "worktrees",
        "xform",
        "xlated",
        "xpkg",
        "yannh",
        "yubikey",
        "yzwvjjmcyfnl",
        "zizmor",
        "zizmorcore"
    ]
}


You can also copy-paste megalinter-reports/.cspell.json at the root of your repository

(Truncated to last 8000 characters out of 1352171)
⚠️ COPYPASTE / jscpd - 725 errors
ns)
   scripts/validate-policy-actions/main_test.go [255:191 - 262:41]
Clone found (go)
 - scripts/validate-policy-actions/main_test.go [215:69 - 227:3] (13 lines, 100 tokens)
   scripts/validate-policy-actions/main_test.go [259:72 - 271:3]
Clone found (go)
 - scripts/verify-arc-app-identity/runner_group.go [170:2 - 176:30] (7 lines, 77 tokens)
   scripts/verify-arc-app-identity/verify.go [249:2 - 255:30]
Clone found (bash)
 - scripts/verify-data-product-rollout.sh [281:78 - 286:7] (6 lines, 129 tokens)
   scripts/verify-data-product-rollout.sh [362:72 - 366:79]
Clone found (go)
 - scripts/verify-email-data-recovery/cleanup.go [55:3 - 64:15] (10 lines, 58 tokens)
   scripts/verify-email-data-recovery/retained_entry.go [241:82 - 250:15]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [17:37 - 29:2] (13 lines, 72 tokens)
   scripts/verify-email-storage-canary/main.go [45:1 - 58:2]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [33:2 - 38:13] (6 lines, 53 tokens)
   scripts/verify-email-provider/main.go [71:2 - 76:13]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [92:16 - 101:33] (10 lines, 88 tokens)
   scripts/verify-email-storage-canary/main.go [108:16 - 117:33]
Clone found (go)
 - scripts/verify-email-data-recovery/kubernetes.go [269:18 - 288:2] (20 lines, 117 tokens)
   scripts/verify-email-storage-canary/main.go [160:13 - 179:2]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_lifecycle_test.go [163:76 - 168:46] (6 lines, 63 tokens)
   scripts/verify-email-data-recovery/observation_lifecycle_test.go [221:94 - 226:46]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_workflow_test.go [14:85 - 39:16] (26 lines, 190 tokens)
   scripts/verify-email-data-recovery/retained_workflow_test.go [14:85 - 39:16]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_workflow_test.go [48:111 - 57:36] (10 lines, 66 tokens)
   scripts/verify-email-data-recovery/retained_workflow_test.go [48:108 - 57:36]
Clone found (go)
 - scripts/verify-email-data-recovery/observation_workflow_test.go [74:2 - 82:4] (9 lines, 99 tokens)
   scripts/verify-email-data-recovery/retained_workflow_test.go [64:2 - 72:4]
Clone found (go)
 - scripts/verify-email-data-recovery/proof.go [86:62 - 93:3] (8 lines, 53 tokens)
   scripts/verify-email-data-recovery/retained_disposal.go [81:76 - 88:5]
Clone found (go)
 - scripts/verify-email-data-recovery/resources_test.go [93:2 - 101:3] (9 lines, 62 tokens)
   scripts/verify-email-data-recovery/resources_test.go [128:4 - 136:5]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [350:22 - 357:4] (8 lines, 68 tokens)
   scripts/verify-email-storage-canary/main.go [382:22 - 389:4]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [458:2 - 467:11] (10 lines, 62 tokens)
   scripts/verify-email-storage-canary/main.go [472:2 - 481:11]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [458:37 - 467:11] (10 lines, 50 tokens)
   scripts/verify-email-storage-canary/main.go [486:5 - 495:11]
Clone found (go)
 - scripts/verify-email-storage-canary/main.go [468:35 - 477:3] (10 lines, 50 tokens)
   scripts/verify-email-storage-canary/main.go [517:39 - 526:3]
Clone found (bash)
 - scripts/verify-kubelet-config-readback.sh [52:1 - 57:10] (6 lines, 63 tokens)
   scripts/verify-talos-schematic-readback.sh [16:46 - 20:42]
Clone found (go)
 - scripts/verify-longhorn-migration-headroom/provider_location_test.go [16:53 - 21:105] (6 lines, 68 tokens)
   scripts/verify-longhorn-migration-headroom/provider_location_test.go [49:85 - 54:107]
Clone found (bash)
 - scripts/verify-shared-backup-consumers.sh [55:86 - 60:47] (6 lines, 72 tokens)
   scripts/verify-wedding-backup-cutover.sh [74:45 - 80:47]
Clone found (go)
 - scripts/verify-wedding-backup-bootstrap/proof_test.go [95:67 - 100:62] (6 lines, 63 tokens)
   scripts/verify-wedding-backup-bootstrap/proof_test.go [165:70 - 170:62]
Clone found (go)
 - scripts/verify-wedding-backup-bootstrap/runtime.go [39:2 - 59:41] (21 lines, 172 tokens)
   scripts/verify-wedding-dedicated-restore/main.go [163:2 - 183:41]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [114:1 - 128:68] (15 lines, 136 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [133:1 - 147:68]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [131:8 - 141:6] (11 lines, 136 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [155:30 - 165:6]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [144:87 - 150:113] (7 lines, 73 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [166:47 - 172:113]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [164:47 - 169:96] (6 lines, 82 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [223:37 - 228:96]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [253:5 - 280:12] (28 lines, 110 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [302:5 - 329:12]
Clone found (bash)
 - scripts/verify-wedding-backup-denial.sh [282:49 - 294:16] (13 lines, 54 tokens)
   scripts/verify-wedding-shared-backup-coverage.sh [331:62 - 343:16]
┌────────────┬────────────────┬─────────────┬──────────────┬──────────────┬──────────────────┬───────────────────┐
│ Format     │ Files analyzed │ Total lines │ Total tokens │ Clones found │ Duplicated lines │ Duplicated tokens │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ bash       │ 424            │ 122030      │ 642120       │ 203          │ 2594 (2.13%)     │ 16451 (2.56%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ diff       │ 18             │ 15370       │ 160622       │ 94           │ 793 (5.16%)      │ 11167 (6.95%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ docker     │ 10             │ 267         │ 2856         │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ go         │ 696            │ 164613      │ 1282668      │ 409          │ 3727 (2.26%)     │ 29604 (2.31%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ go-module  │ 9              │ 1128        │ 14221        │ 19           │ 279 (24.73%)     │ 3286 (23.11%)     │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ javascript │ 9              │ 694         │ 12086        │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ jq         │ 2              │ 147         │ 2709         │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ toml       │ 1              │ 32          │ 86           │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ txt        │ 3              │ 2299        │ 17019        │ 0            │ 0 (0.00%)        │ 0 (0.00%)         │
├────────────┼────────────────┼─────────────┼──────────────┼──────────────┼──────────────────┼───────────────────┤
│ Total:     │ 1172           │ 306580      │ 2134387      │ 725          │ 7393 (2.41%)     │ 60508 (2.83%)     │
└────────────┴────────────────┴─────────────┴──────────────┴──────────────┴──────────────────┴───────────────────┘
Found 725 clones.
HTML report saved to megalinter-reports/copy-paste/jscpd-report.html
ERROR: jscpd found too many duplicates (2.4%) over threshold (0.0%)
time: 6.77s

(Truncated to last 8000 characters out of 140013)
⚠️ SPELL / lychee - 48 errors
📝 Summary
---------------------
🔍 Total..........700
🔗 Unique.........465
✅ Successful.....542
⏳ Timeouts.........0
🔀 Redirected......15
👻 Excluded.......107
❓ Unknown..........0
🚫 Errors..........48
⛔ Unsupported.....48

Errors in .github/workflows/ci.yaml
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 895:14) | Error (cached)
[404] https://get.helm.sh/$archive (at 1175:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 1648:77) | Error (cached)
[404] https://get.helm.sh/$archive (at 4211:65) | Error (cached)
[404] https://get.helm.sh/$archive.sha256sum (at 4212:75) | Rejected status code: 404 Not Found

Errors in .github/workflows/copy-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 132:27) | Error (cached)
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 112:17) | Error (cached)

Errors in .github/workflows/measure-ci-runtime.yaml
[404] https://get.helm.sh/$archive (at 114:77) | Error (cached)

Errors in .github/workflows/prepare-email-storage-key.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 109:17) | Error (cached)

Errors in .github/workflows/publish-coroot-checkpoint-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-checkpoint-hotfix.yaml@refs/heads/main (at 212:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-coroot-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-coroot-node-agent-hotfix.yaml@refs/heads/main (at 248:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-dex-security-image.yaml
[404] https://devantler.tech/attestations/dex-build/v1 (at 155:82) | Rejected status code: 404 Not Found
[404] https://devantler.tech/attestations/dex-build/v1 (at 159:23) | Rejected status code: 404 Not Found
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-dex-security-image.yaml@refs/heads/main (at 157:20) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kagent-claude-harness.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kagent-claude-harness.yaml@refs/heads/main (at 129:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kubescape-node-agent-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-node-agent-hotfix.yaml@refs/heads/main (at 186:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kubescape-storage-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kubescape-storage-hotfix.yaml@refs/heads/main (at 270:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-background-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-background-hotfix.yaml@refs/heads/main (at 205:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-migration-runtime.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-migration-runtime.yaml@refs/heads/main (at 187:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-kyverno-reports-hotfix.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-kyverno-reports-hotfix.yaml@refs/heads/main (at 183:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-longhorn-v1-retirement.yaml
[404] https://devantler.tech/attestations/longhorn-retirement-build/v1 (at 208:24) | Rejected status code: 404 Not Found
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-longhorn-v1-retirement.yaml@refs/heads/main (at 206:20) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-longhorn-v2-only.yaml
[404] https://devantler.tech/attestations/longhorn-v2-only-build/v1 (at 163:22) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive (at 120:77) | Rejected status code: 404 Not Found
[404] https://get.helm.sh/$archive (at 61:77) | Rejected status code: 404 Not Found
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-longhorn-v2-only.yaml@refs/heads/main (at 161:21) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-private-mail-bootstrap.yaml
[404] https://github.com/devantler-tech/platform/.github/workflows/publish-private-mail-bootstrap.yaml@refs/heads/main (at 176:37) | Rejected status code: 404 Not Found

Errors in .github/workflows/publish-release-recovery.yaml
[404] https://api.github.com/repos/$REPOSITORY/releases/generate-notes (at 192:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 257:14) | Rejected status code: 404 Not Found
[404] https://codeload.github.com/$CATALOGUE_REPOSITORY/tar.gz/$CATALOGUE_SHA (at 97:14) | Rejected status code: 404 Not Found

Errors in .github/workflows/validate-coroot-security-progress.yaml
[ERROR] http://127.0.0.1:1/ (at 137:67) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 89:36) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:8080/metrics (at 90:25) | Error (cached)
[ERROR] http://127.0.0.1:9090/ (at 130:80) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 135:66) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:9090/ (at 136:64) | Error (cached)

Errors in .github/workflows/verify-email-credential-custody.yaml
[ERROR] http://127.0.0.1:38200/ (at 110:27) | Connection refused - server may be down or port blocked
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 103:17) | Connection refused - server may be down or port blocked

Errors in .github/workflows/verify-email-storage-key-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 110:17) | Error (cached)

Errors in .github/workflows/verify-openbao-backup-recovery.yaml
[ERROR] http://127.0.0.1:38200/v1/sys/health (at 114:17) | Error (cached)

Errors in docs/costs.md
[404] https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/#cloud-servers (at 24:27) | Rejected status code: 404 Not Found

Errors in scripts/check-hubble-ui-streaming/testdata/frontend-v0.13.6-index.html
[ERROR] error: (at 1:78) | Cannot resolve root-relative link '/': To resolve root-relative links in local files, provide a root dir
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/bundle.main.841ee8bbb7cc9d85b79e.css (at 1:536) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-16x16.png (at 1:401) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon-32x32.png (at 1:336) | File not found. Check if file exists and path is correct
[ERROR] file://scripts/check-hubble-ui-streaming/testdata/favicon.ico (at 1:450) | File not found. Check if file exists and path is correct

Errors in scripts/reconcile-talos-kernel-args/README.md
[404] https://github.com/devantler-tech/ksail/actions/runs/37591901167 (at 623:23) | Rejected status code: 404 Not Found

Errors in talos/control-planes/wireguard.yaml
[404] https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ (at 49:5) | Rejected status code: 404 Not Found | Followed 1 redirect. Redirects: https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig/ --[308]--> https://docs.siderolabs.com/talos/v1.13/reference/configuration/network/deviceconfig

Hint: Followed 15 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 92 errors
[Expected: 400; Actual: 523]
AGENTS.md:470:401 error MD013/line-length Line length [Expected: 400; Actual: 613]
AGENTS.md:471:401 error MD013/line-length Line length [Expected: 400; Actual: 711]
AGENTS.md:475:401 error MD013/line-length Line length [Expected: 400; Actual: 509]
AGENTS.md:479:401 error MD013/line-length Line length [Expected: 400; Actual: 458]
AGENTS.md:480:401 error MD013/line-length Line length [Expected: 400; Actual: 525]
AGENTS.md:484:401 error MD013/line-length Line length [Expected: 400; Actual: 444]
AGENTS.md:521:401 error MD013/line-length Line length [Expected: 400; Actual: 1565]
AGENTS.md:522:401 error MD013/line-length Line length [Expected: 400; Actual: 2266]
AGENTS.md:584:401 error MD013/line-length Line length [Expected: 400; Actual: 1217]
AGENTS.md:586:401 error MD013/line-length Line length [Expected: 400; Actual: 463]
AGENTS.md:588:401 error MD013/line-length Line length [Expected: 400; Actual: 1741]
AGENTS.md:602:401 error MD013/line-length Line length [Expected: 400; Actual: 1396]
AGENTS.md:610:401 error MD013/line-length Line length [Expected: 400; Actual: 542]
AGENTS.md:681:401 error MD013/line-length Line length [Expected: 400; Actual: 790]
AGENTS.md:686:401 error MD013/line-length Line length [Expected: 400; Actual: 515]
CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
docs/adr/headless-cms.md:66:401 error MD013/line-length Line length [Expected: 400; Actual: 450]
docs/adr/headless-cms.md:67:401 error MD013/line-length Line length [Expected: 400; Actual: 457]
docs/crossplane-sync-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 427]
docs/crossplane-sync-recovery.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 577]
docs/dr/alerting.md:263:28 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:22:389 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:23:264 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:35 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:161 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:27:239 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/crypto-custody.md:114 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:296 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "Custody recommendations"]
docs/dr/crypto-custody.md:302 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it leaks"]
docs/dr/crypto-custody.md:309 error MD024/no-duplicate-heading Multiple headings with the same content [Context: "What to do if it is *lost* (no..."]
docs/dr/restore-drill.md:161 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:23:102 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:23:487 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/runbook.md:34 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:44 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:53 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:263 error MD028/no-blanks-blockquote Blank line inside blockquote
docs/dr/runbook.md:708:92 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
docs/dr/spire-server-ha.md:93 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/dr/velero-cnpg.md:11 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/github-management.md:38:401 error MD013/line-length Line length [Expected: 400; Actual: 419]
docs/github-management.md:40:401 error MD013/line-length Line length [Expected: 400; Actual: 522]
docs/node-autoscaling.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/oidc-kubectl.md:111 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/operations/email-client-identity.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/gateway-receiver-boundary.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/ingress-client-address.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "> 🤖 Generated by the Agentic ..."]
docs/operations/production-recovery.md:5:401 error MD013/line-length Line length [Expected: 400; Actual: 491]
docs/release-recovery.md:10:401 error MD013/line-length Line length [Expected: 400; Actual: 576]
docs/release-recovery.md:12:401 error MD013/line-length Line length [Expected: 400; Actual: 793]
docs/release-recovery.md:14:401 error MD013/line-length Line length [Expected: 400; Actual: 477]
docs/runtime-security.md:140 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/rwx-storage.md:38 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:14 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
docs/unifi-management.md:60 error MD040/fenced-code-language Fenced code blocks should have a language specified [Context: "```"]
k8s/bases/infrastructure/controllers/tetragon/README.md:7:401 error MD013/line-length Line length [Expected: 400; Actual: 505]
k8s/bases/README.md:10:141 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:39 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/bases/README.md:11:138 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:91 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:8:207 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
k8s/providers/README.md:9:234 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/judge-openbao-quorum/README.md:25:401 error MD013/line-length Line length [Expected: 400; Actual: 437]
scripts/README.md:15:159 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:16:185 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:98 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:18:171 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]
scripts/README.md:20:255 error MD060/table-column-style Table column style [Table pipe does not align with header for style "aligned"]

(Truncated to last 8000 characters out of 10096)

✅ Linters with no issues

actionlint, betterleaks, checkov, git_diff, grype, hadolint, jsonlint, osv-scanner, prettier, prettier, revive, secretlint, shellcheck, shfmt, syft, trivy, trivy-sbom, trufflehog, v8r, v8r, yamllint, zizmor

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@github-code-quality

github-code-quality Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

Code coverage overview

Languages: Go

Go / code-coverage/go

main codex/storage-adopt-... 79fa90f +/-
— 73% —

Line coverage data for the main branch is not yet available.

View coverage of the 10 most covered files.
File main codex/storage-adopt-... 79fa90f +/-
scripts/kubesca...-bridge/main.go — 91% —
scripts/validat...eworks/shell.go — 89% —
scripts/validat...signing/main.go — 85% —
scripts/validat...-policy/main.go — 84% —
scripts/validat...meworks/main.go — 83% —
scripts/diagnos...artup/access.go — 83% —
scripts/replace...y/quarantine.go — 83% —
scripts/replace...standby/main.go — 79% —
scripts/maintai...clients/main.go — 66% —
scripts/annotat...checkov/main.go — 53% —

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.


Updated November 11, 2026 19:35 UTC

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Nov 11, 2026 •

Copy link
Copy Markdown
Contributor
Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Commits

Reviewing files that changed from the base of the PR and between 4131fc0 and 79fa90f.

Files selected for processing: 5

  • k8s/providers/hetzner/infrastructure/cluster-policies/mutating-admission-policy-longhorn-v1-benchmark-runtime.yaml
  • scripts/guard-consumer-discovery-conservation.sh
  • scripts/migrate-longhorn-v2/testdata/retirement-fence-proof/runtime_admission_test.go
  • scripts/tests/test-guard-consumer-discovery-conservation.sh
  • scripts/validate-eks-ci-role-policy/approved-surface.txt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 79fa90f42c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Readiness at 79fa90f42cf13a579bd90b82f27d865aaeab97ce:

The current revision passed the complete affected migration package again with race detection in 61.008 seconds, including the real Kubernetes admission evaluator. The approved patched image is admitted only within the existing narrow controller boundary; the superseded and unapproved images remain refused. The current independent guard job 130743980551 in CI run 43083289967 also passed the corrected policy fingerprint and its negative controls. The earlier renderer and both 878-file schema validations cover the unchanged policy expression and authorization ledger.

All 85 current-head checks have settled: 69 successful, 15 intentionally skipped and the rate-limited CodeRabbit result neutral. Codex's current-head receipt is 6806419431. Complete conversation, review, inline-comment and thread reads found no unresolved review finding or maintainer direction. GitHub currently reports CLEAN and mergeable. The configured Code Quality rule remains opaque to the gate helper; its two native analysis jobs succeeded, and this is not a claim of complete dependency extraction coverage.

This prepares admission only. The Helm runtime image is unchanged. After protected delivery, deployed policy/type-checking and exact image binding must be read back before the separate runtime adoption in #6073, which retains its recovery, headroom and volume-health gates. No instance-manager restart, benchmark acceptance or V2 activation is established here.

@devantler
devantler marked this pull request as ready for review November 11, 2026 20:52
@devantler
devantler added this pull request to the merge queue Nov 11, 2026
Any commits made after this event will not be merged.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 🫴 Ready

Development

Successfully merging this pull request may close these issues.

1 participant