From c6826873feed9b28b9b038ec720f56ff6c3778d2 Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 20 Aug 2026 06:40:35 +0000 Subject: [PATCH 1/2] chore(github-actions): update ppat/github-workflows (v4.4.0 -> v5.0.1) Bumps every ppat/github-workflows ref (renovate.yaml, lint.yaml x11, release.yaml x2) to the v5.0.1 tag. No workflow_call.inputs used by this repo were renamed or removed between v4.4.0 and v5.0.1. Supersedes #876 (the Renovate PR proposing v4.4.0 -> v5.0.0), which is left untouched. --- .github/workflows/lint.yaml | 22 +++++++++++----------- .github/workflows/release.yaml | 4 ++-- .github/workflows/renovate.yaml | 2 +- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index dea420e7..970e7912 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -17,7 +17,7 @@ permissions: jobs: detect-changes: - uses: ppat/github-workflows/.github/workflows/detect-changed-files.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/detect-changed-files.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: # yamllint disable-line rule:indentation files_yaml: | @@ -75,7 +75,7 @@ jobs: commit-messages: if: ${{ github.event_name == 'pull_request' }} - uses: ppat/github-workflows/.github/workflows/lint-commit-messages.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-commit-messages.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref }} fetch_depth: ${{ github.event.pull_request.commits || 0 }} @@ -85,7 +85,7 @@ jobs: github-actions: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-github-actions.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-github-actions.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).actions_all_changed_files }} @@ -93,7 +93,7 @@ jobs: markdown: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).markdown_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-markdown.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-markdown.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).markdown_all_changed_files }} @@ -101,21 +101,21 @@ jobs: docker-files: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).docker_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-hadolint.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-hadolint.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).docker_all_changed_files }} hadolint_config: .hadolint.yaml pre-commit: - uses: ppat/github-workflows/.github/workflows/lint-pre-commit.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-pre-commit.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} renovate-config-check: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).renovate_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-renovate-config-check.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-renovate-config-check.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).renovate_all_changed_files }} @@ -123,7 +123,7 @@ jobs: shellcheck: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).shellscripts_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-shellcheck.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-shellcheck.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).shellscripts_all_changed_files }} @@ -131,7 +131,7 @@ jobs: terraform: needs: [terraform-dirs] if: ${{ github.event_name != 'pull_request' || needs.terraform-dirs.outputs.terraform_dirs != '[]' }} - uses: ppat/github-workflows/.github/workflows/lint-terraform.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-terraform.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} tf_dirs: ${{ needs.terraform-dirs.outputs.terraform_dirs }} @@ -139,7 +139,7 @@ jobs: yaml: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).yaml_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-yaml.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-yaml.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).yaml_all_changed_files }} @@ -147,6 +147,6 @@ jobs: zizmor: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9b4e1aab..59c14e13 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -29,7 +29,7 @@ env: jobs: create-release: - uses: ppat/github-workflows/.github/workflows/release-semantic.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/release-semantic.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: dry_run: ${{ (github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch' && github.event.inputs.test_publish == 'true') }} release_branch: ${{ github.head_ref || github.ref_name }} @@ -39,7 +39,7 @@ jobs: publish-image: needs: [create-release] - uses: ppat/github-workflows/.github/workflows/build-docker-image.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/build-docker-image.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: image_context_path: images/homelab-workspace label_title: "Homelab Workspace" diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index 203d5d55..27a10114 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -16,7 +16,7 @@ concurrency: jobs: renovate: - uses: ppat/github-workflows/.github/workflows/renovate.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/renovate.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: dry_run: ${{ github.event_name == 'pull_request' }} git_ref: ${{ github.head_ref || github.ref }} From 482a5089823633b40760a9d405c9d05629b060ea Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 20 Aug 2026 06:40:50 +0000 Subject: [PATCH 2/2] ci(github-actions): fix shellcheck findings surfaced by actionlint -shellcheck v5's lint-github-actions.yaml turns on actionlint's shellcheck integration (actionlint v1.7.4 -> v1.7.12), which was previously inert. That surfaces the first real shellcheck pass over this repo's own workflow `run:` blocks (lint.yaml, release.yaml) - actionlint appends --norc, so .shellcheckrc does not filter these. 18 findings total, all fixed by quoting or declare/assign-separation, never by changing what arguments a command receives: - lint.yaml (terraform-dirs job): 1x SC2086 on `>> $GITHUB_OUTPUT`. This is a redirection target, not argv, so bash never word-splits it - quoting is behavior-preserving. - release.yaml (Login to Coder step): 4x SC2086 on `${CODER_URL}` (curl/coder login args) + 2x SC2155 on `export VAR=$(curl ...)`. CODER_URL is a single secret URL, never a list, so quoting cannot change argv count; declare/assign-separation only changes when the subshell's exit status would be masked, and nothing here checks it. - release.yaml (Publish template step): 8x SC2086 on ${TEMPLATE_DIR}/${TEMPLATE_VERSION}/${TEMPLATE_NAME}/${WORKSPACE_IMAGE} (all scalars, never space-separated lists) + 3x SC2155 on `export VAR=$(...)`. Verified with an argv-echoing stub that `coder template push` and the `curl`/jq calls receive byte-identical argv before and after, for representative values. `--var test_mode=${TEST_MODE}` was left unquoted deliberately: shellcheck does not flag it (TEST_MODE is only ever assigned the literal `true` or `false`), and quoting it would be an unrequested change with no finding behind it. No inline `# shellcheck disable=` was needed: none of this repo's local run: blocks build an argv list from a space-separated variable the way upstream's ${ACTIONS_FILES}/${SHELLSCRIPT_FILES}-style callers do, so none of the findings fall under the word-splitting-is-intentional carve-out. --- .github/workflows/lint.yaml | 2 +- .github/workflows/release.yaml | 29 +++++++++++++++++------------ 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 970e7912..b464af41 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -71,7 +71,7 @@ jobs: TF_DIRS="[]" echo "No Terraform changes detected" fi - echo "dirs=$TF_DIRS" >> $GITHUB_OUTPUT + echo "dirs=$TF_DIRS" >> "$GITHUB_OUTPUT" commit-messages: if: ${{ github.event_name == 'pull_request' }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 59c14e13..19ed3a67 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -85,7 +85,7 @@ jobs: shell: bash # yamllint disable-line rule:indentation run: | - while ! curl -fsSL ${CODER_URL} > /dev/null; do + while ! curl -fsSL "${CODER_URL}" > /dev/null; do echo "Waiting for coder service to be ready... sleep 5s!" sleep 5 done @@ -93,7 +93,8 @@ jobs: echo echo "Generating authentication token..." - export CODER_SESSION_TOKEN=$(curl -X POST ${CODER_URL}/api/v2/users/login \ + export CODER_SESSION_TOKEN + CODER_SESSION_TOKEN=$(curl -X POST "${CODER_URL}/api/v2/users/login" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json' \ --data '{"email": "'${{ secrets.CODER_EMAIL }}'", "password": "'${{ secrets.CODER_PASSWORD }}'"}' \ @@ -106,12 +107,13 @@ jobs: echo "Authentication token generated." echo echo "Determining coder version..." - export CODER_VERSION=$(curl -fsSL ${CODER_URL}/api/v2/buildinfo | jq -r .version | cut -d'+' -f1 | cut -d'v' -f2) + export CODER_VERSION + CODER_VERSION=$(curl -fsSL "${CODER_URL}/api/v2/buildinfo" | jq -r .version | cut -d'+' -f1 | cut -d'v' -f2) echo "Installing coder CLI..." curl -fsSL https://coder.com/install.sh | sh -s -- --method standalone --version "${CODER_VERSION}" echo echo "Logging into Coder..." - coder login --use-token-as-session ${CODER_URL} + coder login --use-token-as-session "${CODER_URL}" - name: Publish template id: publish-template @@ -122,30 +124,33 @@ jobs: shell: bash # yamllint disable-line rule:indentation run: | - if echo $TEMPLATE_VERSION | grep -E '[0-9]+\.[0-9]+\.[0-9]+'; then - export TEMPLATE_NAME="$(echo ${TEMPLATE_DIR} | cut -d/ -f3)" + if echo "$TEMPLATE_VERSION" | grep -E '[0-9]+\.[0-9]+\.[0-9]+'; then + export TEMPLATE_NAME + TEMPLATE_NAME="$(echo "${TEMPLATE_DIR}" | cut -d/ -f3)" export RELEASE_MSG="[Release Notes](https://github.com/${{ github.repository }}/releases/tag/${TEMPLATE_VERSION})" export TEST_MODE=false else - export TEMPLATE_NAME="$(echo ${TEMPLATE_DIR} | cut -d/ -f3)-test" + export TEMPLATE_NAME + TEMPLATE_NAME="$(echo "${TEMPLATE_DIR}" | cut -d/ -f3)-test" export RELEASE_MSG="[Changes](https://github.com/${{ github.repository }}/commit/${TEMPLATE_VERSION})" export TEST_MODE=true fi echo "Publishing template ${TEMPLATE_DIR} as ${TEMPLATE_NAME}..." set -x coder template push \ - --directory ${TEMPLATE_DIR} \ - --var workspace_image=${WORKSPACE_IMAGE} \ + --directory "${TEMPLATE_DIR}" \ + --var "workspace_image=${WORKSPACE_IMAGE}" \ --var test_mode=${TEST_MODE} \ - --name ${TEMPLATE_VERSION} \ + --name "${TEMPLATE_VERSION}" \ --message "${RELEASE_MSG}" \ --yes \ - ${TEMPLATE_NAME} + "${TEMPLATE_NAME}" set +x echo echo "Confirming template has been published..." coder templates list --output json > /tmp/templates.json - export SELECTED_TEMPLATE=$(cat /tmp/templates.json | jq -r '.[] | select(.Template.name == "'${TEMPLATE_NAME}'")') + export SELECTED_TEMPLATE + SELECTED_TEMPLATE=$(cat /tmp/templates.json | jq -r '.[] | select(.Template.name == "'"${TEMPLATE_NAME}"'")') if [[ -z $SELECTED_TEMPLATE ]]; then echo "Could not find any template published as $TEMPLATE_NAME." exit 1