linter.yml

---
name: Lint Code Base

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  statuses: write

jobs:
  run-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Lint Code Base
        uses: super-linter/super-linter@v7
        env:
          DEFAULT_BRANCH: main
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          VALIDATE_ALL_CODEBASE: false
          # Naming any validator puts super-linter in opt-in mode, so only these
          # three run. Leaving it on the default (every validator it can detect)
          # fails this repo: jscpd uses a 0% duplicate threshold and flags the
          # .cjs/.js module twins that CLAUDE.md requires, and checkov flags the
          # workflows' missing permissions blocks. Bash is deliberately absent —
          # shellcheck reports 52 findings across bin/ and test/, which is a
          # cleanup of its own, not a merge gate.
          VALIDATE_GITHUB_ACTIONS: true
          VALIDATE_GITLEAKS: true
          VALIDATE_YAML: true