chore(github-actions): update ppat/github-workflows (v4.4.0 -> v5.0.0) - #876
Open
ppat-self-hosted-renovate-bot[bot] wants to merge 1 commit into
Open
chore(github-actions): update ppat/github-workflows (v4.4.0 -> v5.0.0)#876ppat-self-hosted-renovate-bot[bot] wants to merge 1 commit into
ppat-self-hosted-renovate-bot[bot] wants to merge 1 commit into
Conversation
ppat
added a commit
that referenced
this pull request
Aug 20, 2026
#877) * chore(github-actions): update ppat/github-workflows (v4.4.0 -> v5.0.1) Bumps every ppat/github-workflows ref (renovate.yaml, lint.yaml x11, release.yaml x2) to the v5.0.1 tag. No workflow_call.inputs used by this repo were renamed or removed between v4.4.0 and v5.0.1. Supersedes #876 (the Renovate PR proposing v4.4.0 -> v5.0.0), which is left untouched. * ci(github-actions): fix shellcheck findings surfaced by actionlint -shellcheck v5's lint-github-actions.yaml turns on actionlint's shellcheck integration (actionlint v1.7.4 -> v1.7.12), which was previously inert. That surfaces the first real shellcheck pass over this repo's own workflow `run:` blocks (lint.yaml, release.yaml) - actionlint appends --norc, so .shellcheckrc does not filter these. 18 findings total, all fixed by quoting or declare/assign-separation, never by changing what arguments a command receives: - lint.yaml (terraform-dirs job): 1x SC2086 on `>> $GITHUB_OUTPUT`. This is a redirection target, not argv, so bash never word-splits it - quoting is behavior-preserving. - release.yaml (Login to Coder step): 4x SC2086 on `${CODER_URL}` (curl/coder login args) + 2x SC2155 on `export VAR=$(curl ...)`. CODER_URL is a single secret URL, never a list, so quoting cannot change argv count; declare/assign-separation only changes when the subshell's exit status would be masked, and nothing here checks it. - release.yaml (Publish template step): 8x SC2086 on ${TEMPLATE_DIR}/${TEMPLATE_VERSION}/${TEMPLATE_NAME}/${WORKSPACE_IMAGE} (all scalars, never space-separated lists) + 3x SC2155 on `export VAR=$(...)`. Verified with an argv-echoing stub that `coder template push` and the `curl`/jq calls receive byte-identical argv before and after, for representative values. `--var test_mode=${TEST_MODE}` was left unquoted deliberately: shellcheck does not flag it (TEST_MODE is only ever assigned the literal `true` or `false`), and quoting it would be an unrequested change with no finding behind it. No inline `# shellcheck disable=` was needed: none of this repo's local run: blocks build an argv list from a space-separated variable the way upstream's ${ACTIONS_FILES}/${SHELLSCRIPT_FILES}-style callers do, so none of the findings fall under the word-splitting-is-intentional carve-out.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.4.0→v5.0.0Release Notes
ppat/github-workflows (ppat/github-workflows)
v5.0.0Compare Source
🧹 Miscellaneous
✨ Features
🚀 Enhancements + Bug Fixes
Configuration
📅 Schedule: (in timezone US/Eastern)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.