jcoffey-dev
95ec7f4a45
Every file here is a shell script that the README invites people to run as root, and nothing has been linting them: .github/workflows was deleted in 5eadf64 and never replaced. The bugs found in this week's audit -- values interpolated into a command string, an unguarded find -delete, exit statuses read from $? after the fact -- are largely the class a linter catches for free. Starts at severity: error deliberately. The existing scripts have never been through a lint pass, so failing on warnings from day one would block every PR on pre-existing findings rather than on new ones. The intent is to tighten to warning, then to nothing, as the backlog is cleared.
34 lines
1019 B
YAML
34 lines
1019 B
YAML
name: ShellCheck
|
|
|
|
# Every file in this repository is a shell script that people are
|
|
# invited to run as root, so a lint gate is the cheapest guard against
|
|
# the class of bug that keeps showing up here: unquoted expansions,
|
|
# values interpolated into commands, and exit statuses that go unchecked.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
shellcheck:
|
|
name: ShellCheck
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Run ShellCheck
|
|
uses: ludeeus/action-shellcheck@master
|
|
with:
|
|
# Findings are reported but do not fail the build yet: the
|
|
# existing scripts have not been through a lint pass, so
|
|
# failing on day one would block every PR on pre-existing
|
|
# issues. Tighten to "error" -> "warning" -> remove once the
|
|
# backlog is cleared; see the audit in the README.
|
|
severity: error
|
|
check_together: 'yes'
|
|
format: gcc
|