From fc42c8abed28f74d4753bdb3c4f4c385d7cec96c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Mon, 8 Jun 2026 16:54:22 +0200 Subject: [PATCH 01/13] feat(shellcheck): introduce shellcheck GH action --- shellcheck/action.yml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 shellcheck/action.yml diff --git a/shellcheck/action.yml b/shellcheck/action.yml new file mode 100644 index 0000000..34ff7af --- /dev/null +++ b/shellcheck/action.yml @@ -0,0 +1,39 @@ +--- +name: ShellCheck GitHub Action +description: | + Execute ShellCheck in a GitHub Action. + Scans all .sh file in the repo, and reports errors whose severity is info or + above. + +on: + pull_request: + workflow_dispatch: + push: + branches: [feat/shellcheck, main, master, prod] + +# The list of permissions is explained on the GitHub doc: +# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs +permissions: + actions: read + contents: read + +env: + SHELLCHECK_VERSION: "0.11.0" + +jobs: + shellcheck: + name: "ShellCheck" + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + - name: Install shellcheck + shell: bash + run: | + curl --silent --location --remote-name https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz + tar --extract --xz --file shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz --directory /tmp + sudo mv /tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck /usr/local/bin/ + - name: Run shellcheck + shell: bash + run: | + find . -name "*.sh" -exec shellcheck -S info -s bash {} + +... From 86c41643fce190a809fa99a5d8a612aefc6cc587 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Mon, 8 Jun 2026 17:20:49 +0200 Subject: [PATCH 02/13] feat(shellcheck): allow to specify ShellCheck version to use Leverage the 'inputs' option to allow specifying a ShellCheck version. --- shellcheck/action.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 34ff7af..79e91a1 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -17,21 +17,23 @@ permissions: actions: read contents: read -env: - SHELLCHECK_VERSION: "0.11.0" +inputs: + shellcheck-version: + description: ShellCheck version + required: false + default: "0.11.0" jobs: shellcheck: name: "ShellCheck" runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - name: Install shellcheck shell: bash run: | - curl --silent --location --remote-name https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz - tar --extract --xz --file shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz --directory /tmp - sudo mv /tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck /usr/local/bin/ + curl --silent --location --remote-name https://github.com/koalaman/shellcheck/releases/download/v${{ inputs.shellcheck-version }}/shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz + tar --extract --xz --file shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz --directory /tmp + sudo mv /tmp/shellcheck-v${{ inputs.shellcheck-version }}/shellcheck /usr/local/bin/ - name: Run shellcheck shell: bash run: | From 4a8bfdff5b6cac7b4bfcc91a56e5b0e7f82b2756 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Mon, 8 Jun 2026 17:28:40 +0200 Subject: [PATCH 03/13] feat(shellcheck): update ShellCheck action --- shellcheck/action.yml | 40 +++++++++++++--------------------------- 1 file changed, 13 insertions(+), 27 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 79e91a1..993b30e 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -5,37 +5,23 @@ description: | Scans all .sh file in the repo, and reports errors whose severity is info or above. -on: - pull_request: - workflow_dispatch: - push: - branches: [feat/shellcheck, main, master, prod] - -# The list of permissions is explained on the GitHub doc: -# https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs -permissions: - actions: read - contents: read - inputs: shellcheck-version: description: ShellCheck version required: false default: "0.11.0" -jobs: - shellcheck: - name: "ShellCheck" - runs-on: ubuntu-latest - steps: - - name: Install shellcheck - shell: bash - run: | - curl --silent --location --remote-name https://github.com/koalaman/shellcheck/releases/download/v${{ inputs.shellcheck-version }}/shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz - tar --extract --xz --file shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz --directory /tmp - sudo mv /tmp/shellcheck-v${{ inputs.shellcheck-version }}/shellcheck /usr/local/bin/ - - name: Run shellcheck - shell: bash - run: | - find . -name "*.sh" -exec shellcheck -S info -s bash {} + +runs: + using: "composite" + steps: + - name: Install shellcheck + shell: bash + run: | + curl --silent --location --remote-name https://github.com/koalaman/shellcheck/releases/download/v${{ inputs.shellcheck-version }}/shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz + tar --extract --xz --file shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz --directory /tmp + sudo mv /tmp/shellcheck-v${{ inputs.shellcheck-version }}/shellcheck /usr/local/bin/ + - name: Run shellcheck + shell: bash + run: | + find . -name "*.sh" -exec shellcheck -S info -s bash {} + ... From 7eecb421b8efc78e37a9cd7c1048183770584cd8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois?= Date: Mon, 8 Jun 2026 18:14:46 +0200 Subject: [PATCH 04/13] fix: apply suggestion from Semgrep Co-authored-by: semgrep-code-scalingo[bot] <183740896+semgrep-code-scalingo[bot]@users.noreply.github.com> --- shellcheck/action.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 993b30e..4130b53 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -16,10 +16,12 @@ runs: steps: - name: Install shellcheck shell: bash - run: | - curl --silent --location --remote-name https://github.com/koalaman/shellcheck/releases/download/v${{ inputs.shellcheck-version }}/shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz - tar --extract --xz --file shellcheck-v${{ inputs.shellcheck-version }}.linux.x86_64.tar.xz --directory /tmp - sudo mv /tmp/shellcheck-v${{ inputs.shellcheck-version }}/shellcheck /usr/local/bin/ +env: + SHELLCHECK_VERSION: ${{ inputs.shellcheck-version }} +run: | + curl --silent --location --remote-name "https://github.com/koalaman/shellcheck/releases/download/v$SHELLCHECK_VERSION/shellcheck-v$SHELLCHECK_VERSION.linux.x86_64.tar.xz" + tar --extract --xz --file "shellcheck-v$SHELLCHECK_VERSION.linux.x86_64.tar.xz" --directory /tmp + sudo mv "/tmp/shellcheck-v$SHELLCHECK_VERSION/shellcheck" /usr/local/bin/ - name: Run shellcheck shell: bash run: | From 3d3530ef646e45515bab645c26e8d59cf7424ad0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Tue, 9 Jun 2026 12:07:20 +0200 Subject: [PATCH 05/13] fix(shellcheck): use Docker Hub image As agreed during review. Also adds support for: - providing a list of files to scan (defaults to all .sh files) - providing the severity to report --- shellcheck/action.yml | 63 ++++++++++++++++++++++++++++++++----------- 1 file changed, 47 insertions(+), 16 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 4130b53..b8e24a6 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -7,23 +7,54 @@ description: | inputs: shellcheck-version: - description: ShellCheck version + description: | + ShellCheck version to use. This should match a Docker Hub tag. + See https://hub.docker.com/r/koalaman/shellcheck/tags for a list of + available tags. required: false - default: "0.11.0" + default: "v0.11.0" + + shellcheck-severity: + description: | + ShellCheck severity to use. + One of 'error', 'warning', 'info', or 'style'. + required: false + default: style + + files: + description: | + List of files to scan. + When unset, defaults to recursively scanning all .sh files in the repo. + required: false + default: "" runs: - using: "composite" - steps: - - name: Install shellcheck - shell: bash -env: - SHELLCHECK_VERSION: ${{ inputs.shellcheck-version }} -run: | - curl --silent --location --remote-name "https://github.com/koalaman/shellcheck/releases/download/v$SHELLCHECK_VERSION/shellcheck-v$SHELLCHECK_VERSION.linux.x86_64.tar.xz" - tar --extract --xz --file "shellcheck-v$SHELLCHECK_VERSION.linux.x86_64.tar.xz" --directory /tmp - sudo mv "/tmp/shellcheck-v$SHELLCHECK_VERSION/shellcheck" /usr/local/bin/ - - name: Run shellcheck - shell: bash - run: | - find . -name "*.sh" -exec shellcheck -S info -s bash {} + + using: "docker" + image: "koalaman/shellcheck:${{ inputs.shellcheck-version }}" + entrypoint: /bin/sh + args: + - -c + - | + set -o errexit + set -o nounset + + cd /github/workspace + + if [ -n "${{ inputs.files }}" ]; then + # Empty argv ($@): + set -- + + # Fill argv with the given files. Preserves spaces in filenames: + while IFS= read -r file; do + set -- "$@" "$file" + done <<'EOF' + ${{ inputs.files }} + EOF + + # Call ShellCheck with input files: + shellcheck -S "${{ inputs.shellcheck-severity }}" -s bash "$@" + else + find . -type f -name '*.sh' -not -path './.git/*' -exec \ + shellcheck -S "${{ inputs.shellcheck-severity }}" -s bash {} + + fi ... From 6c9bf02229a99b3a62c5c6ba325a9e531b1f6407 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Tue, 9 Jun 2026 14:58:06 +0200 Subject: [PATCH 06/13] fix(shellcheck): hardcode Docker image tag The 'runs.image' option only accept a static value. --- shellcheck/action.yml | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index b8e24a6..3cf7c59 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -2,18 +2,8 @@ name: ShellCheck GitHub Action description: | Execute ShellCheck in a GitHub Action. - Scans all .sh file in the repo, and reports errors whose severity is info or - above. inputs: - shellcheck-version: - description: | - ShellCheck version to use. This should match a Docker Hub tag. - See https://hub.docker.com/r/koalaman/shellcheck/tags for a list of - available tags. - required: false - default: "v0.11.0" - shellcheck-severity: description: | ShellCheck severity to use. @@ -30,7 +20,7 @@ inputs: runs: using: "docker" - image: "koalaman/shellcheck:${{ inputs.shellcheck-version }}" + image: "docker://koalaman/shellcheck:v0.11.0" entrypoint: /bin/sh args: - -c @@ -38,7 +28,7 @@ runs: set -o errexit set -o nounset - cd /github/workspace + cd "${GITHUB_WORKSPACE:-/github/workspace}" if [ -n "${{ inputs.files }}" ]; then # Empty argv ($@): From 32d77e0ac4ad80b5d9e12be7448e160702dde2ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Tue, 9 Jun 2026 15:10:20 +0200 Subject: [PATCH 07/13] feat(shellcheck): use koalaman/shellcheck-alpine Docker image koalaman/shellcheck is very minimal: it only contains the ShellCheck executable. --- shellcheck/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 3cf7c59..1978e6c 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -20,7 +20,7 @@ inputs: runs: using: "docker" - image: "docker://koalaman/shellcheck:v0.11.0" + image: "docker://koalaman/shellcheck-alpine:v0.11.0" entrypoint: /bin/sh args: - -c From f80dabca76a65f182d6390e8a525b61bdecb2440 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Tue, 9 Jun 2026 15:33:39 +0200 Subject: [PATCH 08/13] feat(shellcheck): use a composite action This allows to: - specify a ShellCheck version - integrates the 'actions/checkout' step - explicitely mounts the volume --- shellcheck/action.yml | 72 ++++++++++++++++++++++++++----------------- 1 file changed, 43 insertions(+), 29 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 1978e6c..c2cfd28 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -4,6 +4,14 @@ description: | Execute ShellCheck in a GitHub Action. inputs: + shellcheck-version: + description: | + ShellCheck version to use. This should match a Docker Hub tag. + See https://hub.docker.com/r/koalaman/shellcheck/tags for a list of + available tags. + required: false + default: "v0.11.0" + shellcheck-severity: description: | ShellCheck severity to use. @@ -19,32 +27,38 @@ inputs: default: "" runs: - using: "docker" - image: "docker://koalaman/shellcheck-alpine:v0.11.0" - entrypoint: /bin/sh - args: - - -c - - | - set -o errexit - set -o nounset - - cd "${GITHUB_WORKSPACE:-/github/workspace}" - - if [ -n "${{ inputs.files }}" ]; then - # Empty argv ($@): - set -- - - # Fill argv with the given files. Preserves spaces in filenames: - while IFS= read -r file; do - set -- "$@" "$file" - done <<'EOF' - ${{ inputs.files }} - EOF - - # Call ShellCheck with input files: - shellcheck -S "${{ inputs.shellcheck-severity }}" -s bash "$@" - else - find . -type f -name '*.sh' -not -path './.git/*' -exec \ - shellcheck -S "${{ inputs.shellcheck-severity }}" -s bash {} + - fi -... + using: "composite" + steps: + - uses: actions/checkout@v5 + - name: Run ShellCheck + shell: bash + run: | + docker run --rm \ + --volume "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" \ + --workdir "$GITHUB_WORKSPACE" \ + koalaman/shellcheck-alpine:${{ inputs.shellcheck-version }} \ + sh -c <<'SCRIPT' + + set -o errexit + set -o nounset" + cd "${GITHUB_WORKSPACE}" + + severity="${{ inputs.shellcheck-severity }}" + files="${{ inputs.files }}" + + if [ -n "${files}" ]; then + set -- + + while IFS= read -r file; do + [ -n "${file}" ] && set -- "$@" "${file}" + done < Date: Tue, 9 Jun 2026 15:51:07 +0200 Subject: [PATCH 09/13] fix(shellcheck): use environment var Seems to be better for security purposes. --- shellcheck/action.yml | 49 ++++++++++++++++++++++++------------------- 1 file changed, 27 insertions(+), 22 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index c2cfd28..8c9e478 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -26,6 +26,11 @@ inputs: required: false default: "" +env: + FILES: ${{ inputs.files }} + SEVERITY: ${{ inputs.shellcheck-severity }} + VERSION: ${{ inputs.shellcheck-version }} + runs: using: "composite" steps: @@ -34,31 +39,31 @@ runs: shell: bash run: | docker run --rm \ - --volume "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" \ - --workdir "$GITHUB_WORKSPACE" \ - koalaman/shellcheck-alpine:${{ inputs.shellcheck-version }} \ - sh -c <<'SCRIPT' + --env FILES \ + --env SEVERITY \ + --volume "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \ + --workdir "${GITHUB_WORKSPACE}" \ + koalaman/shellcheck-alpine:${VERSION} \ + sh -s <<'SCRIPT' - set -o errexit - set -o nounset" - cd "${GITHUB_WORKSPACE}" + set -o errexit + set -o nounset" - severity="${{ inputs.shellcheck-severity }}" - files="${{ inputs.files }}" + cd "${GITHUB_WORKSPACE}" - if [ -n "${files}" ]; then - set -- + if [ -n "${FILES}" ]; then + set -- - while IFS= read -r file; do - [ -n "${file}" ] && set -- "$@" "${file}" - done < Date: Tue, 9 Jun 2026 15:53:05 +0200 Subject: [PATCH 10/13] fix(shellcheck): move env in run block --- shellcheck/action.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 8c9e478..e66519c 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -26,17 +26,20 @@ inputs: required: false default: "" -env: - FILES: ${{ inputs.files }} - SEVERITY: ${{ inputs.shellcheck-severity }} - VERSION: ${{ inputs.shellcheck-version }} runs: using: "composite" steps: - uses: actions/checkout@v5 + - name: Run ShellCheck shell: bash + + env: + FILES: ${{ inputs.files }} + SEVERITY: ${{ inputs.shellcheck-severity }} + VERSION: ${{ inputs.shellcheck-version }} + run: | docker run --rm \ --env FILES \ From 31f8e5ba97720148da66aba94acc2272d71ff5d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Tue, 9 Jun 2026 16:12:36 +0200 Subject: [PATCH 11/13] fix(shellcheck): add example for 'inputs.files' Following review. --- shellcheck/action.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/shellcheck/action.yml b/shellcheck/action.yml index e66519c..2ac2cd4 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -23,10 +23,17 @@ inputs: description: | List of files to scan. When unset, defaults to recursively scanning all .sh files in the repo. + Use the following syntax to specify a list of files: + + with: + files: | + first.sh + second file.sh + third file + required: false default: "" - runs: using: "composite" steps: From 29fdfb712eeae886c7513e06fa29ce1d881535f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20KUBLER?= Date: Wed, 10 Jun 2026 10:00:59 +0200 Subject: [PATCH 12/13] chore(shellcheck): move script in its own file --- shellcheck/action.yml | 31 ++++------------------------ shellcheck/scripts/run-shellcheck.sh | 27 ++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 27 deletions(-) create mode 100755 shellcheck/scripts/run-shellcheck.sh diff --git a/shellcheck/action.yml b/shellcheck/action.yml index 2ac2cd4..60a8321 100644 --- a/shellcheck/action.yml +++ b/shellcheck/action.yml @@ -41,39 +41,16 @@ runs: - name: Run ShellCheck shell: bash - env: FILES: ${{ inputs.files }} SEVERITY: ${{ inputs.shellcheck-severity }} VERSION: ${{ inputs.shellcheck-version }} - run: | docker run --rm \ --env FILES \ - --env SEVERITY \ - --volume "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}" \ + --env SEVERITY \ + --volume "${GITHUB_WORKSPACE}:${GITHUB_WORKSPACE}:ro" \ + --volume "${GITHUB_ACTION_PATH}:${GITHUB_ACTION_PATH}:ro" \ --workdir "${GITHUB_WORKSPACE}" \ koalaman/shellcheck-alpine:${VERSION} \ - sh -s <<'SCRIPT' - - set -o errexit - set -o nounset" - - cd "${GITHUB_WORKSPACE}" - - if [ -n "${FILES}" ]; then - set -- - - while IFS= read -r file; do - [ -n "${file}" ] && set -- "$@" "${file}" - done < Date: Wed, 10 Jun 2026 10:55:49 +0200 Subject: [PATCH 13/13] fix(shellcheck): remove erroneous instruction from script --- shellcheck/scripts/run-shellcheck.sh | 2 -- 1 file changed, 2 deletions(-) diff --git a/shellcheck/scripts/run-shellcheck.sh b/shellcheck/scripts/run-shellcheck.sh index 0f6bb0e..d9b25f0 100755 --- a/shellcheck/scripts/run-shellcheck.sh +++ b/shellcheck/scripts/run-shellcheck.sh @@ -3,8 +3,6 @@ set -o errexit set -o nounset -cd "${GITHUB_WORKSPACE}" - if [ -n "${FILES}" ]; then # Reset argv ($@): set --