super-linter: Project name has been changed, breaking the current Action path and a lot of the documentation

This was intentional and we unfortunately didn’t give notice on it. I apologize for that.

In full transparency, GitHub is working to align our open source work under a single open source enterprise so we can provide good stewardship and a unified governance model across our enterprise open-source projects. We jumped the gun on this one without considering some of the ramifications (we planned to rely on the GitHub redirects in the short-term), but we failed to take into consideration the Verified Creator and GitHub Created enterprise policies, which broke enterprise users. This is why we worked so diligently to get the original repo back as quickly as we could while following our internal GRC policies once we became aware of the problems this was causing.

In the near-term, we have forked this repo back into the GitHub org, and while the fork doesn’t show up on the Actions marketplace, referencing the github/super-linter action will pass both the Verified Creator and GitHub-Created enterprise policies while we work through these details.

We apologize for the frustration this caused, it is in no way representative of the stewards we as employees of GitHub want to be in open-source and we learned some valuable lessons that will influence other migrations we might undertake in terms of technical considerations, but also keeping our communities aware of our plans. It is also not indicative of our investment in this project. I will continue to maintain this project as a GitHub-sponsored project where it will live under the official GitHub open-source enterprise which is home to many of GitHub’s most amazing projects now. We take our commitment to open-source seriously and will learn from this event to improve our processes and communication in the future.

This was intentional and we unfortunately didn’t give notice on it. I apologize for that.

Can you speak to the motivation behind the org name change? This has broken workflows for a lot of people. Publicly it may appear to be as simple as changing the org reference but for managed organizations/enterprises that restrict access to workflows this is no longer included in the “Allow actions created by GitHub” setting for Actions controls which means it now needs to be explicitly allow-listed for enterprise use.

An incomplete view of the impact of this change via code search here https://github.com/search?q=path%3A.github%2Fworkflows+github%2Fsuper-linter&type=code

https://github.com/github/super-linter redirect in the browser, but does not appear to in GitHub Actions.

Cloning the old url also works:

➜ git clone git@github.com:github/super-linter.git
Cloning into 'super-linter'...
remote: Enumerating objects: 18011, done.
remote: Counting objects: 100% (289/289), done.
remote: Compressing objects: 100% (176/176), done.
remote: Total 18011 (delta 188), reused 169 (delta 110), pack-reused 17722
Receiving objects: 100% (18011/18011), 25.10 MiB | 4.15 MiB/s, done.
Resolving deltas: 100% (12140/12140), done.

EDIT - the redirect in actions not working looks like its by design: https://docs.github.com/en/actions/learn-github-actions/finding-and-customizing-actions#adding-an-action-to-your-workflow

Just got notice back from the team that they added the badge. Hope that helps!

Amazing @zkoppert , thanks! Saved us a lot of work. 💪

This project has been has been forked back into the GitHub org. Broken references should be fixed and workflows should be triggerable again

I am actively working to get this fixed up. Hang on for an update soon.

Based on https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository, it looks like it is possible to fix by breaking the redirect to put a super-linter repository back at github/super-linter (with full copy), so that any renamed usages to super-linter/super-linter do not break

We are also going to work to add runtime detection to the Action to identify which version users are using, and provide Actions warning annotations about this change and what users will need to do. Again, with plenty of runway with regards to time.

@lindluni Do you know if Renovate would pick up this type of change, if using Action warning annotations as you describe? I have seen some types of Action warnings but only when looking at a specific Action job run. Are there other ways to get notified? I’m watching this repo for Releases and Security Alerts, would this change trigger any of those?

Renovate would NOT pick this up, it’s definitely an interesting conundrum, and one we are working to think our way through. I can tell you this is already changing the way we think about these types of migrations, not just for us, but for our customers as well. There have been many projects over the years that have started in one org, grown to be so big that they deserved their own org and had to deal with migrating an entire community. We are already working to figure out how we can reduce the friction when these events as occur.

In the meantime we will continue to sync changes back to the GitHub/super-linter project and we are exploring ways to alert the community to these changes through the most automated ways possible, whether that be brown outs, Actions annotations, or some other means, we will be thoughtful and transparent with our community before deprecated the GitHub/super-linter repo in favor of this repo.

When @admiralAwkbar created the Super Linter it started out as a project to learn more about creating Actions and solve a challenge he had in his own work. The thought that it would grow to be a package that has been downloaded 10’s of millions of times was the furthest from his mind. We need to work from here to reinforce the open source principles that I’ve believed in since my first job, and build better processes in Super Linter to ensure we are set up for the future, with our community in mind.

So the net-net is, today, you won’t have to make any changes. And when the time comes to make changes there will be sufficient notice period, and we will do all we can to communicate this change manually, automatically, and widely, with the input of our community.

Just got notice back from the team that they added the badge. Hope that helps!

I’m guessing this repo move is a result of the project no longer being “certified” by github. Is there a plan in action to restore this certification? I know for myself this becomes problematic for my internal security reviews to use this very useful action. Perhaps others are in the same position.

Needs to rename the action uses:

from github/super-linter/slim@v5 to super-linter/super-linter@v5.0.0

We are also going to work to add runtime detection to the Action to identify which version users are using, and provide Actions warning annotations about this change and what users will need to do. Again, with plenty of runway with regards to time.

Just to clarify: Does this mean that this action will continue to be available at github/super-linter indefinitely, or will we need to switch to super-linter/super-linter at some point in the future?

At some point we will switch to this repo only, but not without sufficient notice period, and not until we solve the enterprise compliance issues around Verified Creator

This was intentional and we unfortunately didn’t give notice on it. I apologize for that.

Appreciate the honesty on this.

@h-no I have just reached out to the partnerships team now to try and get this “Verified creator” status for the super-linter/super-linter action.

Just to clarify: Does this mean that this action will continue to be available at github/super-linter indefinitely, or will we need to switch to super-linter/super-linter at some point in the future?

At some point we will switch to this repo only, but not without sufficient notice period, and not until we solve the enterprise compliance issues around Verified Creator

@lindluni I’m wondering what the status regarding “Verified Creator” for this repo is? github/super-linter hasn’t been updated since July 5th and we’re having trouble switching to this repo due to company policy regarding Actions. github/super-linter lagging behind hasn’t been a noticeable problem for us until we decided to upgrade to prettier v3. This repo uses v3, github/super-linter is on v2…

@bewuethr thanks, I should’ve maybe mentioned that we’re on the GitHub Team plan where the allowlist only affects public repositories, not private repositories (the allowlist is not even available for private repositories on GitHub Team as far as I can tell).

Maybe it’s also possible for super-linter to become a verified creator (so it would be covered again by the second checkbox from your screenshot above)

We apologize for the frustration this caused, it is in no way representative of the stewards we as employees of GitHub want to be

@lindluni your comments have reinforced my faith in you guys! Thanks for sharing some details on what’s happening in big picture.

How should the slim image be referenced now that the name changed? As the issue describes, the README.md file says to use uses: github/super-linter/slim@v5 which does not work.

[Edit] Answering my own question: uses: super-linter/super-linter/slim@v5.0.0