Fleet-wide CI: MegaLinter gating + external fork CI + 3 new Dagger modules

decision Fri Jul 03 2026 00:00:00 GMT+0000 (Coordinated Universal Time) cimegalinterdaggerforksworkflows

Fleet-wide CI expansion — 2026-07-03

What shipped

1. MegaLinter fleet config — chirag127/workflows/.mega-linter.yml rewritten:

   • GATING linters: 8 security scanners (gitleaks, secretlint, trufflehog, semgrep, trivy, osv-scanner, dustilock, checkov), JS/TS eslint, JSON/YAML lint, dotenv-linter, hadolint, actionlint, zizmor.
   • ADVISORY (report, don't fail): copypaste_jscpd, devskim, kics, grype, markdownlint, spelling, css_stylelint, html_htmlhint, json_v8r, json_npm_package_json_lint.
   • HARD-DISABLED (conflict with fleet biome): prettier + standard descriptors.

2. MegaLinter reusable workflow — chirag127/workflows/.github/workflows/megalinter.yml:

   • Downstream opt-in — repos add one workflow that uses: chirag127/workflows/.github/workflows/megalinter.yml@main.
   • Fleet config auto-fetched if repo has no .mega-linter.yml.

3. Fork CI — external, zero-byte on fork main — chirag127/workspace/.github/workflows/fork-ci.yml:

   • Runs nightly + workflow_dispatch + repository_dispatch.
   • Matrix over 6 forks. Checks out umbrella with submodules recursive, runs fork-audit Dagger module, posts commit status via API.
   • Zero files added to any fork main. Preserves no-fork-divergence.

4. fork-audit Dagger module — drift + license + MegaLinter-security-flavor.

5. data-scrape-api Dagger module + reusable — for the 9 data-scrape APIs.

6. infra-umbrella Dagger module + reusable — for workspace + hermes-config

   • agent-skills.

Why (rule preservation)

• Fork CI without files on fork main preserves the letter of no-fork-divergence and fork-thin-upstream-tracking. Same effective coverage; infra stays in umbrella, forks stay thin.
• MegaLinter opt-in reusable avoids blanket-reding every repo on next push.

Follow-up (deferred)

• Wire MegaLinter into pilot repos (bookmark-mind, api-fleet-landing, sops-lens).
• Wire ci-data-scrape-api.yml into each of the 9 data-scrape repos.
• Wire ci-infra-umbrella.yml into workspace + hermes-config + agent-skills.
• Add FORK_STATUS_TOKEN secret (PAT repo:status) — without it, fallback is silent (warning, not failure).

Cross-refs

• rules/agent/no-fork-divergence
• rules/agent/fork-thin-upstream-tracking
• decisions/agent-tooling/dagger-confirmed-2026-07-02