Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 4 additions & 9 deletions .github/workflows/shellcheck.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,12 +11,7 @@ on:
- synchronize

jobs:
check-shell-syntax:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- name: Install shellcheck
run: sudo apt-get install shellcheck
- name: Run shellcheck
run: shellcheck `find ./ -type f -name "*lib"`
call-shellcheck-workflow:
uses: Element-Logic/github-workflows/.github/workflows/shellcheck.yml@main

Copilot AI Nov 25, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using @main for the external workflow reference is less secure than pinning to a specific commit SHA. The original workflow used a pinned SHA (actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683). Consider using a specific commit SHA or at least a version tag to prevent unexpected changes if the external workflow is modified.

Suggested change
uses: Element-Logic/github-workflows/.github/workflows/shellcheck.yml@main
uses: Element-Logic/github-workflows/.github/workflows/shellcheck.yml@11bd71901bbe5b1630ceea73d27597364c9af683

Copilot uses AI. Check for mistakes.
with:
arguments: "`find ./ -type f -name '*lib'`"

Copilot AI Nov 25, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Command substitution with backticks will not be evaluated when passed as a workflow input string. The external workflow will receive the literal string "find ./ -type f -name '*lib'" instead of the list of files.

If the external workflow expects a list of files, consider if it supports glob patterns or if the command substitution needs to happen within the external workflow itself. Otherwise, the files won't be found and shellcheck won't run on the intended targets.

Suggested change
arguments: "`find ./ -type f -name '*lib'`"
arguments: "**/*lib"

Copilot uses AI. Check for mistakes.