v8r failing due to megalinter not executing within project path

[estahn]

see for more details oxsecurity/megalinter#1875

[chris48s]

I can't really speak to the megalinter side of this too much because it is not something I use myself, but I've read over the linked issue.

When it comes to using v8r locally (or in any environment, really), v8r will attempt to use the path/filename to find an appropriate schema, but it is fundamentally a guess and won't always be able to find a single schema. In some cases, there might be more than one pattern that matches. If I take megalinter out of the equation:

$ mkdir -p .github/workflows && touch .github/workflows/deploy.yml

$ npx v8r@latest .github/workflows/deploy.yml 
ℹ No config file found
ℹ Processing .github/workflows/deploy.yml
ℹ Found multiple possible schemas for .github/workflows/deploy.yml. Possible matches:
  Deployer Recipe
  A JSON schema for Deployer yaml recipes
  https://raw.githubusercontent.com/deployphp/deployer/master/src/schema.json

  GitHub Workflow
  YAML schema for GitHub Workflow
  https://json.schemastore.org/github-workflow.json

✖ Could not find a schema to validate .github/workflows/deploy.yml

side note: I think MegaLinter actually chooses to just squash errors like this https://github.com/oxsecurity/megalinter/blob/8907fdf0d5c48316a8091ea9cd96075f3dbf7d00/megalinter/descriptors/yaml.megalinter-descriptor.yml#L97

so even if you run it from the root of your repo, you'll need to manually give v8r a hint in this case by using either:

• Manually specifying a schema with --schema
• Using a custom catlog with --catalogs
• or specifying a custom catalog in a config file (although v8r will only look in the root of your repo for a config file)

In general, v8r is quite heavily tied to running in the root of your repo for auto-detecting schemas and that's not really avoidable because that's where all the glob patterns on schemastore are relative to.