fix: ensure safer Super-Linter permissions (CKV2_GHA_1) #73
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
--- | |
name: Shellcheck code in Markdown | |
on: | |
push: | |
jobs: | |
build: | |
runs-on: ubuntu-latest | |
defaults: | |
run: | |
shell: sh | |
steps: | |
- uses: actions/checkout@v4 | |
- name: Run shellcheck | |
run: | | |
# test shell syntax of Markdown code snippets | |
# https://github.com/dylanaraps/pure-sh-bible/commit/9d54e96011 | |
# Markdown filename extensions | |
# github/linguist@7503f7588c/lib/linguist/languages.yml#L3707-L3718 | |
command find -- . \ | |
'(' \ | |
-name '*.md' -o \ | |
-name '*.livemd' -o \ | |
-name '*.markdown' -o \ | |
-name '*.mdown' -o \ | |
-name '*.mdwn' -o \ | |
-name '*.mdx' -o \ | |
-name '*.mkd' -o \ | |
-name '*.mkdn' -o \ | |
-name '*.mkdown' -o \ | |
-name '*.ronn' -o \ | |
-name '*.scd' -o \ | |
-name '*.workbook' -o \ | |
-name 'contents.lr' \ | |
')' \ | |
-type f \ | |
-exec sh -v -c ' | |
command git ls-files --error-unmatch -- "${1-}" >/dev/null 2>&1 || | |
! command git rev-parse --is-inside-work-tree >/dev/null 2>&1 && | |
while IFS='\'''\'' read -r line; do | |
command test "${code-}" = '\''1'\'' && | |
command test "${line-}" != '\''```'\'' && | |
command printf -- '\''%s\n'\'' "${line-}" | |
case "${line-}" in | |
'\''```sh'\''|'\''```bash'\''|'\''```shell'\''|'\''```zsh'\'') | |
code='\''1'\'' | |
;; | |
'\''```'\'') | |
code='\'''\'' | |
;; | |
*) ;; | |
esac | |
# run shellcheck on the extracted code blocks | |
# SC1071: allow conforming shells besides sh, bash, ksh, dash | |
# SC1090: allow linking to a dynamic location | |
# SC1091: allow linking to, but not following, linked scripts | |
# SC2123: allow `$PATH` modification | |
# SC2312: allow masking return values | |
done <"${1-}"' _ {} ';' | | |
command shellcheck \ | |
--check-sourced \ | |
--enable=all \ | |
--exclude='SC1071,SC1090,SC1091,SC2123,SC2312' \ | |
--norc \ | |
--severity=style \ | |
--shell=sh \ | |
--source-path=/dev/null \ | |
-- \ | |
- || | |
exit "${?:-1}" | |
... |