Run the Markdown Linter on markdownlint-cli2 instead of Super Linter

[Jakub Jareš (nohwnd)]

The Markdown Linter agentic workflow has never run. Every one of its 63 runs since 2026-05-22 ended in startup_failure, so it has produced exactly zero reports since it was added.

It is the only workflow in the repository that references an action outside actions/* and github/*, and this repository restricts Actions to a selected list:

patterns_allowed: dotnet/arcade/.github/workflows/*
                  peter-evans/create-pull-request@*
                  DavidAnson/markdownlint-cli2-action@*
verified_allowed: false

super-linter/super-linter is not on that list, so the run was rejected before any job started. That is the same failure that took out the markdownlint gate, fixed in #10636 by allow-listing the action. There is no annotation and no job log on a startup failure, which is why this sat unnoticed for three months.

What changed

Super Linter is replaced by markdownlint-cli2, pinned to 0.23.1 — the version bundled by DavidAnson/markdownlint-cli2-action@v24.1.0, which markdownlint.yml already runs on every pull request. The scheduled report and the pull request gate now apply the same rules from .markdownlint-cli2.jsonc, including its ignores, so the report cannot flag anything the gate would let through. Bump the two together.

Two more bugs turned up while rewriting the job:

• The lint step failed the job when it found violations. That skipped the agent job that writes the report, so even if the workflow had started, it could not have reported a violation — only a clean run would have produced output.
• Super Linter ran with VALIDATE_ALL_CODEBASE=false, which lints only files that differ from the default branch. On a scheduled run on main that is nothing. markdownlint-cli2 scans all 86 tracked Markdown files.

Also dropped the now-unused packages: read and statuses: write permissions (the job only needs contents: read), and the dead check-results step whose output no job consumed.

The workflow deliberately keeps no source: field. It came from githubnext/agentics/workflows/markdown-linter.md@main, and relinking it would let gh aw update restore the blocked action and break the workflow again. A comment in the frontmatter records that.

Security review

Required by the gh-aw safe-update warning on this compile.

• Actions removed: super-linter/super-linter@4ce20838b8ab83717e78138c5b3a1407148e0918 (v8.7.0). Removal only — it drops a third-party Docker action that the Actions policy already refused to run.
• Actions added: none. actions/checkout and actions/upload-artifact move within the file at their existing pins; no uses: line changed SHA.
• Secrets: none added or removed. The job no longer needs GITHUB_TOKEN, which Super Linter consumed.
• Permissions: reduced, never widened.
• New network access: the step runs npx --yes markdownlint-cli2@0.23.1, which fetches that exact pinned version from the npm registry on a standard runner. Nothing I could not fully verify.

Verification

• python .github/scripts/check_action_pins.py passes: 2273 references across 49 files.
• Compiled with gh aw v0.86.0 (matching compiler_version) using --action-mode release --action-tag 435186c5. A plain gh aw compile rewrote the gh-aw setup pins to a different repository and edited .gitattributes and .github/aw/actions-lock.json — Local gh aw compile silently corrupts two pinned actions in generated .lock.yml files #10258 again. Those flags reproduce what CI emits, and the lock diff now contains no unintended uses: change.
• Ran the pinned command locally: 86 files linted, 0 issues, so a real run reports noop rather than filing an issue.
• Dispatched the compiled workflow on this branch. It starts and runs instead of failing at startup, which is the actual thing being fixed.

Worth considering separately: with markdownlint.yml gating every pull request, main should always be clean, so this scheduled report will usually have nothing to say. If that turns out to be true over a few weeks, deleting it is reasonable. I did not want to make that call inside a fix.

🤖

[Copilot]

Pull request overview

Replaces the blocked Super Linter job with markdownlint-cli2 for scheduled Markdown reporting.

Changes:

• Aligns scheduled linting with the pull-request Markdown gate.
• Preserves lint logs while reducing permissions.
• Regenerates the compiled agentic workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/markdown-linter.md	Defines the new markdownlint-cli2 workflow.
.github/workflows/markdown-linter.lock.yml	Compiles the updated workflow definition.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.