Checking shared OpenSSH configs in CI without a wrapper script

[u/Noah4ever123]

I keep SSH configs in dotfiles and some team repositories, and I wanted the same checks locally and in CI. I ended up writing sshconfig-lint in Rust.

The current beta accepts multiple files directly, resolves nested Include files, detects Include cycles and reports the original file and line for every finding. It also has strict mode plus JSON, SARIF and GitHub annotation output.

A typical repository check is just:

sshconfig-lint .ssh/config infrastructure/ssh_config --strict

For GitHub annotations:

sshconfig-lint .ssh/config --format github

I avoided an automatic --fix because moving Host blocks or deleting IdentityFile entries can change the effective config in ways that are hard to notice.

Source: https://github.com/Noah4ever/sshconfig-lint

CI guide: https://sshconfig-lint.apps.thiering.org/en/ci

How are you validating shared SSH configs at the moment? I am especially interested in Include-heavy setups.