feat(shellcheck): introduce shellcheck GH action - #64
Conversation
Leverage the 'inputs' option to allow specifying a ShellCheck version.
![semgrep-code-scalingo[bot]](https://avatars.githubusercontent.com/u/4868969?s=60&v=4){kind=small}
Co-authored-by: semgrep-code-scalingo[bot] <183740896+semgrep-code-scalingo[bot]@users.noreply.github.com>
As agreed during review. Also adds support for: - providing a list of files to scan (defaults to all .sh files) - providing the severity to report
The 'runs.image' option only accept a static value.
koalaman/shellcheck is very minimal: it only contains the ShellCheck executable.
This allows to: - specify a ShellCheck version - integrates the 'actions/checkout' step - explicitely mounts the volume
Seems to be better for security purposes.
Following review.
EtienneM
left a comment
EtienneM
left a comment
There was a problem hiding this comment.
a few remaining questions/suggestion, but already approving
| --env FILES \ | ||
| --env SEVERITY \ |
There was a problem hiding this comment.
question: are you sure ENV and FILES is how you can read the information from the environment?
There was a problem hiding this comment.
Yes, that's the way to proceed :)
| sh -s <<'SCRIPT' | ||
|
|
||
| set -o errexit | ||
| set -o nounset" | ||
|
|
||
| cd "${GITHUB_WORKSPACE}" | ||
|
|
||
| if [ -n "${FILES}" ]; then | ||
| set -- | ||
|
|
||
| while IFS= read -r file; do | ||
| [ -n "${file}" ] && set -- "$@" "${file}" | ||
| done <<EOF | ||
| ${FILES} | ||
| EOF | ||
|
|
||
| shellcheck -S "${SEVERITY}" -s bash "$@" | ||
| else | ||
| find . -type f -name '*.sh' -not -path './.git/*' \ | ||
| -exec shellcheck -S "${SEVERITY}" -s bash {} + | ||
| fi | ||
|
|
||
| SCRIPT |
There was a problem hiding this comment.
suggestion: I'm not keen on long scripts written like that. What do you think about adding this script in the shellcheck folder and calling it from here?
There was a problem hiding this comment.
Ahah, I was actually expecting/fearing this. I personally prefer to have it all in one file so I can have a clear view about what the action does.
But I'm also OK to put it in a separate file if you think it's clearer. It also allows to run it in another context 😃
2 participants
Uh oh!
There was an error while loading. Please reload this page.