Graduate the proven universal MegaLinter policy corpus into EgoLint

[szmyty]

Outcome

Extract the now-proven universal MegaLinter configuration, native linter configs, task orchestration, fixtures, reporting policy, and remediation lessons from egohygiene/egohygiene into the canonical egohygiene/egolint repository without copying product-specific assumptions or leaving parallel sources of truth.

Context

The egohygiene/egohygiene repository has been used as a large polyglot proving ground for a universal linting platform. The current work established and iterated:

• a root .mega-linter.yml with explicit repository-wide defaults;
• domain-organized linter configuration under .config/lint/;
• security scanner configuration under .config/security/;
• per-linter Taskfile entry points and native fallback tasks where MegaLinter integration is insufficient;
• representative fixtures under tests/fixtures/;
• reporter outputs including Markdown, JSON, SARIF, console, and per-linter logs;
• explicit ownership boundaries for overlapping tools;
• compatibility-only tools versus modern default tools;
• fixes for path mismatches, project-mode/file-mode behavior, reporter recursion, shell portability, and formatter conflicts.

This work should become canonical EgoLint product source rather than remain embedded in the product repository.

Scope

Inventory and provenance

• Inventory the final .mega-linter.yml, .config/lint/**, .config/security/**, .engineering/tasks/lint.yml, wrapper scripts, and tests/fixtures/** used by the proven setup.
• Record source commit(s), file provenance, and any product-specific adaptations that must not migrate unchanged.
• Classify each tool as universal-default, adaptive/profile-specific, compatibility-only, disabled/deferred, deprecated, or native-adapter-only.

Canonical policy extraction

• Move reusable tool configuration into EgoLint-owned config packs/profiles.
• Preserve one canonical semantic owner for formatting, linting, typing, security, spelling, prose, links, schemas, repository policy, and supply-chain concerns.
• Keep repository-specific exceptions in consumer configuration rather than hard-coding them into universal defaults.
• Preserve the modern Python ownership model: Ruff as primary formatter/linter/import sorter, Bandit/Mypy/Pylint/Pyright as complementary analysis, Black/isort/Flake8 as compatibility-only.
• Preserve the current JavaScript direction and link to Add a JavaScript package-quality profile with Oxlint, Biome, and publint #13 for Biome/Oxlint/publint ownership rather than duplicating it here.
• Preserve security-tool boundaries and planned REUSE/SBOM alignment.

Execution model

• Convert current Taskfile/wrapper behavior into stable EgoLint CLI/profile interfaces.
• Preserve explicit commands equivalent to doctor, full run, changed-scope run, single-tool run, and reviewed fix operations.
• Keep native fallbacks for tools whose MegaLinter descriptor behavior is insufficient or disabled.
• Ensure shell/task implementations are portable across supported local environments.

Fixtures and validation

• Migrate representative positive fixtures and add hostile/negative fixtures where current remediation exposed gaps.
• Test config discovery, project-mode versus file-mode behavior, path resolution, reporter output, fix safety, generated/vendored exclusions, and missing-tool behavior.
• Prove at least one polyglot consumer repository from a clean checkout.

Reporting

• Preserve stable human and machine-readable report contracts.
• Keep JSON/SARIF/report artifacts suitable for Relay and Observatory consumers.
• Avoid updated-source reporter recursion and other report-folder self-ingestion.

Acceptance criteria

• Every migrated config/tool has a documented EgoLint owner and applicability state.
• Reusable policy no longer depends on egohygiene/egohygiene product paths.
• The canonical config tree and tool matrix are versioned in EgoLint.
• A clean polyglot fixture proves the extracted configuration end to end.
• Single-tool, full, changed-scope, doctor, and fix-preview workflows are supported through stable EgoLint interfaces.
• Compatibility-only tools remain available without creating formatter/linter wars in the default profile.
• Reporter output includes stable human-readable and machine-readable evidence.
• Security and supply-chain profiles preserve explicit ownership and defer unresolved REUSE/SBOM work to the proper follow-up.
• Consumer repositories need only thin configuration and do not copy the full policy tree.
• Migration guidance explains how egohygiene/egohygiene removes or replaces the incubated configuration after canonical adoption.

Related

• Publish MegaLinter, SARIF, editor, and GitHub Action integrations #4 — MegaLinter, SARIF, editor, and GitHub Action integrations
• Release Egolint with security and dependency-debt profiles #5 — immutable first release
• Add a JavaScript package-quality profile with Oxlint, Biome, and publint #13 — JavaScript package-quality profile with Oxlint/Biome/publint
• Define adaptive capability detection and execution policy #35 — adaptive capability detection and execution policy
• Implement manual, observe, ratchet, and enforce modes #36 — manual/observe/ratchet/enforce modes
• Roadmap: ship the adaptive EgoLint quality distribution #42 — adaptive EgoLint quality distribution roadmap
• Run pinned EgoLint profiles through a reusable workflow relay#49 — reusable EgoLint workflow

Non-goals

• Fixing every current lint finding in egohygiene/egohygiene inside this extraction issue.
• Treating every bundled MegaLinter tool as universally applicable.
• Replacing canonical third-party linters with custom reimplementations.
• Copying product-specific ignores, paths, or exceptions into EgoLint defaults.