super-linter/super-linter

One Docker action that runs a whole collection of linters across every language in the repo.

Official actionCategory: Code Quality & LintingLatest v8View on GitHub

What it does

super-linter/super-linter packages dozens of linters (shell, YAML, Markdown, Python, Go, Terraform, Dockerfiles, and many more) into a single Docker image so one step lints the whole repository.

It declares no action inputs, all configuration is passed as environment variables such as VALIDATE_ALL_CODEBASE, DEFAULT_BRANCH, and per-linter VALIDATE_<LANGUAGE> flags.

Usage

workflow (.yml)

permissions:
  contents: read
  statuses: write
steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0   # full history, needed to detect changed files
  - uses: super-linter/super-linter@v8
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      VALIDATE_ALL_CODEBASE: false
      DEFAULT_BRANCH: main

Notes

Configuration is env-vars only: VALIDATE_ALL_CODEBASE: false lints just the changed files, and VALIDATE_<LANGUAGE>: true/false selects linters. You may only include (true) or only exclude (false) linters in one run, not mix both.

The Docker image is large; the super-linter/super-linter/slim variant cuts pull time if you do not need the full linter set.

Common errors

Changed-file detection fails on a shallow clone, checkout with fetch-depth: 0 when using VALIDATE_ALL_CODEBASE: false.
Setting some VALIDATE_<LANG> variables to true and others to false in the same run is rejected by super-linter at startup; pick one mode.
Missing GITHUB_TOKEN in env breaks commit-status reporting and GitHub API lookups; pass ${{ secrets.GITHUB_TOKEN }} with statuses: write on the job.

Security and pinning

Keep permissions to contents: read and statuses: write, the linter does not need write access to code.
The action runs a large third-party Docker image; pin the action reference to a commit SHA so the image tag it points at cannot silently change.

Alternatives and related

golangci/golangci-lint-actionRun golangci-lint with line-attached annotations, caching, and only-new-issues PR mode. pre-commit/actionRun your repo's pre-commit hooks in CI, with the hook environments cached. astral-sh/ruff-actionLint or format-check Python with Ruff, auto-resolving the version from pyproject.toml.

Frequently asked questions

How do I run only specific linters?

Set VALIDATE_<LANGUAGE>: true env vars for just the linters you want (e.g. VALIDATE_YAML: true). Every linter not listed is then skipped. Alternatively set only VALIDATE_<LANGUAGE>: false flags to exclude a few, but never mix true and false flags in one run.

References

GitHub Actions documentation