feat: markdown action emits inline PR annotations via problem matcher - #35
Merged
Conversation
markdownlint-cli2 has no native GitHub-annotations formatter. Rather than add an outputFormatters entry to the shared .markdownlint-cli2.jsonc — which every consumer and local lefthook run would then have to satisfy with an extra formatter package — register a self-contained GitHub problem matcher that parses markdownlint-cli2's `file:line:col … MD### …` output into inline PR-diff annotations. Gated by an `annotations` input (default true); the matcher is removed after the run and the real lint exit code is preserved. The regex tolerates the output with or without the severity word and column, so it holds across markdownlint-cli2 versions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f880cc7a7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "problemMatcher": [ | ||
| { | ||
| "owner": "markdownlint-cli2", | ||
| "severity": "error", |
There was a problem hiding this comment.
When a consumer config marks a rule with severity: warning, markdownlint-cli2 emits lines such as viewme.md:5 warning MD012... and can still exit 0 when there are no errors, but this matcher hard-codes every match as an error while the regex discards the warning token. In those green, advisory-only runs GitHub will still render red error annotations, so capture the severity group in the pattern instead of forcing the matcher default to error.
Useful? React with 👍 / 👎.
kyle-sexton
added a commit
that referenced
this pull request
Jul 14, 2026
## Summary
- centralize checksum-verified release installation in job-scoped
runtime directories and derive immutable self-pins from tracked template
workflows
- bound read-only network operations and discard partial failed-attempt
output before retries
- add reusable Go quality execution with native Linux and Windows
golangci-lint v2.12.2, exact official archive checksums, config
verification, complete issue reporting, Linux race tests, Windows
ordinary tests, gofmt/tidy/module verification, and no direct
Staticcheck side policy
- install govulncheck v1.6.0 through the authenticated Go module
proxy/checksum database and classify validated SARIF so reachable
findings fail product while tool/network/DB/malformed-output failures
require an infrastructure rerun
- track golangci-lint and govulncheck drift through their official
release channels
## Caller contract
```yaml
jobs:
go-quality:
permissions:
contents: read
uses: melodic-software/ci-workflows/.github/workflows/go-quality.yml@<full-commit-sha>
with:
config: <standards-managed-config-path>
```
`working-directory` defaults to `.` and `go-version-file` defaults to
`go.mod`. Tool versions, checksums, runners, package scope, and blocking
posture are deliberately not caller-configurable.
ci-runner PR #35 remains the downstream consumer and will adopt the
final immutable SHA after Standards materializes its managed config
path. This branch does not edit ci-runner.
## Verification
- 195 Node tests passed
- govulncheck SARIF classifier behavioral suite passed
- OSV scan guard, Pulumi deployment guard, and Pulumi drift suites
passed
- actionlint passed for go-quality.yml
- ShellCheck and shfmt passed for the new guard/tests
- Biome 2.5.1 passed across all scripts
- git diff --check passed
## Authoritative references
- golangci-lint v2.12.2 immutable release and official checksums:
https://github.com/golangci/golangci-lint/releases/tag/v2.12.2
- golangci-lint v2 CLI/config verification:
https://golangci-lint.run/docs/configuration/cli/
- govulncheck v1.6.0 command and structured output:
https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
- Go module authentication and checksum database:
https://go.dev/ref/mod#authenticating
- GitHub Actions full-SHA guidance:
https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions
- curl timeout/retry semantics: https://curl.se/docs/manpage.html
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds inline GitHub PR-diff annotations to the markdown lane via a self-contained problem matcher (no shared-config change, no extra npm package — unlike the outputFormatters/formatter-template route, which would couple every consumer + local hook). Gated by an
annotationsinput (default on); matcher removed after the run, real lint exit preserved. Regex validated against markdownlint-cli2 output with/without severity word and column.🤖 Generated with Claude Code