[External Plugin]: megalinter

[nvuillam]

Plugin name

megalinter

Short description

Set up, run and fix MegaLinter on any repository: 100+ linters for 69+ languages, 23+ formats and 21+ tooling formats, from CI or locally.

GitHub repository

oxsecurity/megalinter

Plugin path inside the repository

./skills

Ref to review

No response

Commit SHA to review

e96b2d606cd8b32303706e8cd8f9c3c9269eb043

Version

1.0.3

License identifier

AGPL-3.0

Author name

OX Security

Author URL

https://github.com/oxsecurity

Homepage URL

https://megalinter.io

Keywords

linter
code-quality
formatter
security
ci

Additional notes for reviewers

MegaLinter aggregates 100+ linters covering 69+ languages, 23+ formats and 21+ tooling formats.

The plugin lives at the repository root and ships:

• 4 skills under skills/ (megalinter, megalinter-setup, megalinter-check, megalinter-fix), auto-discovered per Agent Plugins 1.0
• 3 sub-agents (megalinter-watcher, megalinter-runner, megalinter-fixer)

Manifests: a root plugin.json conforming to Agent Plugins 1.0, with no extra top-level keys.

Updated since the first submission, after the Copilot portability review in this issue:

• The 3 sub-agents now ship to Copilot clients as com.github.copilot/agents/.agent.md. They were previously declared only in the Claude Code and Cursor manifests, which Copilot does not read, so Copilot loaded none of them. They are generated from the Claude Code definitions, and CI fails if the two drift.
• megalinter-setup no longer infers the install mode from skill naming, since no platform exposes a skill's origin: it reads the filesystem and asks the user when that is ambiguous. Its manual Copilot instructions now use the required .agent.md suffix in .github/agents/, and drop the model override that is not a Copilot model id.
• The skills' frontmatter key licence is corrected to license.
• CI now loads this repository as an external plugin in the GitHub Copilot CLI (copilot --plugin-dir . plugins list --json) and asserts it is accepted with no manifest error. It runs offline, with no marketplace and no authentication.

No API key, credentials, or network service are required. The skills drive the public mega-linter-runner npm package and the MegaLinter Docker image.

Docs: https://megalinter.io/latest/agent-plugins/

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

🛑 External plugin intake failed (submitter fixes required)

This submission did not pass automated intake validation and cannot move to maintainer review yet.
Edit the issue form to address the fixes below. Intake reruns automatically when the issue is edited, or the issue author/maintainer can comment /rerun-intake to re-run on demand.

Required fixes

• submission: "source.path" must be a safe relative path inside the repository

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	2144 day(s)
Repository activity	no configured signal
Repository counts	2572 stars · 13 watchers · 309 forks · 44 open issues/PRs
Homepage heuristics	no configured signal

View workflow run

[aaronpowell]

Having a review of the skills, I have some concerns about the viability of using them within GitHub Copilot as they have been designed for Claude (based on my read), and their portability might not be great. The one that I think is of particular challenge would be the setup skill, the way it detects the install mode and how tries to do things like installing the custom agent definitions.

Has it been tested in a Copilot harness to verify that it behaves as desired?

[nvuillam]

@aaronpowell Good catch, you were right on both counts :)

The sub-agents were genuinely broken on Copilot. Agent Plugins 1.0 covers skills but not sub-agents, and Copilot loads those from com.github.copilot/agents/<name>.agent.md; ours were only declared in the Claude Code and Cursor manifests, which Copilot doesn't read. On top of that, the setup skill told the agent to skip installing them because "the plugin already ships them" (false on Copilot, so users got nothing and no fallback). They're now generated into com.github.copilot/agents/, with a CI check that fails if they drift from the source definitions.

The setup skill was also detecting plugin installs from the megalinter: name prefix, which is a Claude Code convention. It now works that out from the filesystem and asks when it's ambiguous. Its manual Copilot instructions were wrong too (missing .agent.md suffix, and model: haiku isn't a Copilot model id). Fixed, along with a licence/license typo that was silently dropping the field.

And no, it hadn't been tested in a Copilot harness: fair hit 🎈 . CI now mounts the repo with copilot --plugin-dir and checks it loads with no manifest error.

Submission updated to e96b2d606cd8b32303706e8cd8f9c3c9269eb043 (1.0.3).

[aaronpowell]

you'll need to re-run the intake process to get the changes picked up by the automations

[nvuillam]

/rerun-intake