BUG - env overrides not working

[emouawad]

I have implemented a centralized github actions workflow that will git pull, lint and build other targeted repositories.

• central-repo : Global workflow with megalinter
• repo-a
• repo-b

central-repo will analyze and build repo-a or repo-b

Currently everything is working fine - megalinter can lint repo-a or repo-b successfully.

My issue is with the PR Commentor: Error [GitHub Comment Reporter] No pull request has been found, so no comment has been posted.

This happens because megalinter is assuming that the PR is on central-repo not on repo-a

I have tried setting environment variable
GITHUB_REPOSITORY= repo-a
GITHUB_SHA=aaaabbbb
GITHUB_REF=aaaabbbb
but MegaLinter initialization still shows GITHUB_REPOSITORY=central-repo

Basically i need to tell megalinter to target another repository commit/PR to update it with the results.

[nvuillam]

The code to send a PR comment is the following:

megalinter/megalinter/reporters/GithubCommentReporter.py

Line 61 in c5be814

if config.get(self.master.request_id, "GITHUB_TOKEN", "") != "":

It lists the comments associated to the found PR and posts a new one or updates existing one... so your override of GITHUB_REPOSITORY should be ok

what is the value of your overridden GITHUB_REF ? it should be able to find PR id in the following regexp

            ref = os.environ.get("GITHUB_REF", "")
            m = re.compile("refs/pull/(\\d+)/merge").match(ref)

[emouawad]

Thanks for pointing me to that code here is my env

The error : "[GitHub Comment Reporter] No pull request has been found, so no comment has been posted" is pointing to this regex refs/pull/(\d+)/merge my PR number is 9 so refs/pull/9/merge should match but it isn't for some reason.

Are there unit tests for this? or is there another stable version i can try? using gh action oxsecurity/[email protected]

Also reviewing the code - even if the regex cannot find the pr it tries to get it from commit sha - that too is unable to get the PR : No warning or errors

[emouawad]

UPDATE: Potential BUG

@nvuillam I have enabled DEBUG log level and now i understand more what's happening:

overriding the envs: GITHUB_REPOSITORY GITHUB_SHA GITHUB_REF is having no effect! This looks a BUG

megalinter is assuming the targeted repo is where the github workflow is running and loading thos envs from the initial webhook while in my case the targeted repo is another github repo not where the workflow is running - therefore it is essential for megalinter to load those envs from the provided overrides.

[echoix]

Where and how are you setting these overrides?

[emouawad]

Using github actions

- name: Lint
  uses: oxsecurity/[email protected]
  continue-on-error: true
  env:
    GITHUB_TOKEN: ${{ steps.generate-app-token.outputs.token }}
    GITHUB_REPOSITORY: ${{ env.REPO_NAME }}
    GITHUB_SHA: ${{ env.REPO_REF }}
    GITHUB_REF: refs/pull/${{ env.REPO_PR_NUMBER }}/merge

[nvuillam]

Dear @emouawad

First, there is no "BUG" because it is written nowhere in the doc that MegaLinter supports PR comments on another repos that the one which is currently analyzed :)

Second, you are very welcome to submit a pull request that would make such "NEW FEATURE" work :)

You may succeed to make it work just by setting all the variables requested by the reporter ( the code is here -> https://github.com/oxsecurity/megalinter/blob/main/megalinter/reporters/GithubCommentReporter.py )

[emouawad]

hey @nvuillam thanks for taking the time to look into this.

But how overriding the env variables not having any effect is not a bug.
It is documented that one can supply env vars and according to my testing (the screenshot i shared earlier) the env vars are not being loaded.

Now i totally understand that commenting on another repo may not be in the core scope of megalinter - but overriding the env vars that should be trivial.

btw all is working fine for me - i was able to generate the html reports no problem - my issue is only with the commenter not loading from the env vars.

anyway if u don't agree - feel free to close the ticket.