From 34c28a7b165ae0a637d8e221992a64fc4edab260 Mon Sep 17 00:00:00 2001
From: Martin Simon <martin@simon.tf>
Date: Tue, 6 Oct 2026 21:50:12 +0200
Subject: [PATCH] Lint the action's run body with the pinned shellcheck

ci.yml checks the .sh files with a digest-pinned shellcheck, while
tests/lint-action.sh checked the extracted run: body with whatever
shellcheck the runner had. The script now writes the body inside the
checkout and takes the checker from $SHELLCHECK, as
action-debian-build's shellcheck-composite.py does, and CI points that
at the same pinned image. Unset, it is plain shellcheck, so local runs
are unchanged.

Checked locally through the container: the current body passes, and a
seeded unquoted expansion fails with SC2086.
---
 .github/workflows/ci.yml | 4 ++++
 tests/lint-action.sh     | 9 +++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e2208a0..e7c0a81 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,10 @@ jobs:
             commit-branch.sh tests/*.sh
 
       - name: Lint the action metadata and its inline shell
+        env:
+          SHELLCHECK: >-
+            docker run --rm --volume ${{ github.workspace }}:/repo --workdir /repo
+            koalaman/shellcheck@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d
         run: tests/lint-action.sh
 
       - name: Test
diff --git a/tests/lint-action.sh b/tests/lint-action.sh
index 1e94af8..6956c04 100755
--- a/tests/lint-action.sh
+++ b/tests/lint-action.sh
@@ -17,7 +17,9 @@ shopt -s inherit_errexit
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
-body="$(mktemp)"
+# Inside the checkout, so the containerised checker CI uses can see it;
+# prefixed, so a killed run's leftover names itself in git status.
+body="$(mktemp -p . .lint-action-body.XXXXXX)"
 trap 'rm -f "$body"' EXIT
 
 python3 - "$body" <<'PY'
@@ -85,6 +87,9 @@ with open(sys.argv[1], "w") as out:
 print("  ok   action.yml parses, one bash step, every input piped, no inline expressions")
 PY
 
+# $SHELLCHECK selects the checker. CI points it at the digest-pinned container
+# the .sh files go through, so one version judges every line of shell here.
+read -ra shellcheck <<< "${SHELLCHECK:-shellcheck}"
 # SC2154: the variables come from the step's env:, which shellcheck cannot see.
-shellcheck -S style -e SC2154 "$body"
+"${shellcheck[@]}" -S style -e SC2154 "$body"
 echo "  ok   the run body is shellcheck-clean"