From ac938207bcd11c38dcbd7568c45e2ca0274dcefc Mon Sep 17 00:00:00 2001 From: topcoder1 Date: Tue, 21 Jul 2026 14:53:39 -0700 Subject: [PATCH] ci(lint): always run shellcheck (scripts) on this repo's own self-test runs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2026-07-21 fleet rollout enforced shellcheck (scripts) on all 29 consumer repos, but the central repo itself never ran the job — the gate `inputs.run_shellcheck_scripts == 'true'` can't fire on pull_request/push self-test triggers, where the inputs context is null. Nothing else lints scripts/ or selftest/*.sh (no hooks, no Makefile; the only other "shellcheck" mention in the repo is a disable-directive comment). Widen the gate: also run when the input stringifies to '' (self-test trigger) AND github.repository is this repo. Callers are unaffected — workflow_call inputs always resolve to 'true'/'false' via their declared defaults, and the repository conjunct pins the new arm to this repo even if that semantic ever drifts. The job body already handles null inputs (`|| 'error'`, `|| '.'`), so no body change is needed. Local baseline: shellcheck -S error over all 12 repo shell scripts (scripts/*.sh + selftest/test_*.sh) is clean, so the job lands green. Co-Authored-By: Claude Fable 5 --- .github/workflows/lint.yml | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 40637a2..990986e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -19,7 +19,8 @@ name: Lint # required check reports `skipped` — which GitHub counts as SATISFIED — and the # PR merges green and UNREVIEWED. See selftest/check_draft_gate_triggers.py. # - prettier --check on the markdown glob (default **/*.md) -# - shellcheck on standalone shell scripts (opt-in, default OFF) +# - shellcheck on standalone shell scripts (opt-in for callers, default +# OFF; always ON for this repo's own self-test runs — see the job) # # Defaults chosen for "drop into an existing repo without breaking it": # - actionlint runs WITHOUT shellcheck. Shellcheck integration in actionlint @@ -467,10 +468,22 @@ jobs: shellcheck: name: shellcheck (scripts) - # Opt-in only — most repos have style/info shellcheck drift on existing - # scripts that would flood the first install PR. Caller flips + # Opt-in for callers — most repos have style/info shellcheck drift on + # existing scripts that would flood the first install PR. Caller flips # `run_shellcheck_scripts: true` when ready to enforce. - if: ${{ format('{0}', inputs.run_shellcheck_scripts) == 'true' }} + # + # Self-test runs (pull_request/push on this repo) always run this job — + # the fleet-wide rollout (2026-07-21) enforced this check on every + # consumer while the central repo's own operator scripts (scripts/, + # selftest/*.sh) had no shellcheck coverage at all. On self-test + # triggers the `inputs` context is null, so the input stringifies to '' + # and the body's `|| 'error'` / `|| '.'` fallbacks supply the defaults. + # A workflow_call caller can never hit the '' arm (omitted inputs + # resolve to their declared defaults, so callers always stringify to + # 'true'/'false') — and the `github.repository` conjunct pins that arm + # to this repo anyway, so caller behavior is unchanged even if + # input-default semantics ever drift. + if: ${{ format('{0}', inputs.run_shellcheck_scripts) == 'true' || (github.repository == 'topcoder1/ci-workflows' && format('{0}', inputs.run_shellcheck_scripts) == '') }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7