jcoffey-dev
82528a1402
The workflow went in at severity: error on the assumption that a never-linted repository would have a backlog worth grandfathering. It did not -- error found nothing, and warning found exactly two things, so the cautious setting was protecting against a problem that was not there. zimbra_backup.sh: SC2024, sudo does not affect redirects. The `> "$BACKUP_FILE"` runs as root rather than as the sudo'd zimbra user, so backups landed root-owned inside a directory the script deliberately chowns to zimbra:zimbra. Kept the redirect -- root can always write there, and piping into `tee` would put tee's status in $? and hide a zmmailbox failure -- and handed ownership over explicitly afterwards. The suppression is narrow and states why. disk_cleanup.sh: SC2034, total_freed was assigned and never read. CI now holds at warning with a clean tree, so anything that trips it is new rather than inherited.
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
name: ShellCheck
|
|
|
|
# Every file in this repository is a shell script that people are
|
|
# invited to run as root, so a lint gate is the cheapest guard against
|
|
# the class of bug that keeps showing up here: unquoted expansions,
|
|
# values interpolated into commands, and exit statuses that go unchecked.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
shellcheck:
|
|
name: ShellCheck
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Run ShellCheck
|
|
uses: ludeeus/action-shellcheck@master
|
|
with:
|
|
# warning, not error: the first run at this level surfaced
|
|
# exactly two findings and both were fixed, so there is no
|
|
# pre-existing backlog to grandfather in. Anything new that
|
|
# trips it is genuinely new. Dropping to the default (info)
|
|
# would also pull in style suggestions across every script --
|
|
# worth doing, but as its own pass.
|
|
severity: warning
|
|
check_together: 'yes'
|
|
format: gcc
|