From 1ec46d3cf7ff30dfdb8e45d1d09812e6f91c76fc Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 20 Aug 2026 06:39:21 +0000 Subject: [PATCH] chore(github-actions): update ppat/github-workflows (v4.4.0 -> v5.0.1) Bump every ppat/github-workflows ref used by this repo (detect-changed-files, lint-github-actions, lint-markdown, lint-pre-commit, lint-renovate-config-check, lint-shellcheck, lint-yaml, lint-zizmor, renovate) to v5.0.1, preserving the repo-specific mise_ignore_cfg input on every call site. v5's lint-github-actions.yaml bumps actionlint v1.7.4 -> v1.7.12, which turns on its `-shellcheck` integration (previously inert against this repo: v1.7.4 found nothing even with the same flags). That integration appends `--norc`, so this repo's `.shellcheckrc` disable list does not filter it. Reproducing it locally surfaced two SC2046 findings, both `chezmoi execute-template --source=$(pwd)` in the local `chezmoi` job's run: blocks (lint.yaml:95,117). Quoting `$(pwd)` there is a pure hardening fix, not a suppression: argv is byte-identical to the unquoted form for any cwd without whitespace/glob characters (which `working-directory: ./current` always is in CI), and only diverges in the pathological case quoting exists to guard against. Supersedes #780. --- .github/workflows/lint.yaml | 20 ++++++++++---------- .github/workflows/renovate.yaml | 2 +- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 9579323e..65f0f692 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -25,7 +25,7 @@ env: jobs: detect-changes: - uses: ppat/github-workflows/.github/workflows/detect-changed-files.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/detect-changed-files.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: # yamllint disable-line rule:indentation files_yaml: | @@ -92,7 +92,7 @@ jobs: sed -i 's|"darwin"|"linux"|' "$sc" # don't want to fetch secrets during linting sed -i 's|{{ (bitwardenSecrets ".*" .bwsAccessToken).value }}|fake-test-value|' "$sc" - chezmoi execute-template --source=$(pwd) < "$sc" > "${sc%.tmpl}" + chezmoi execute-template --source="$(pwd)" < "$sc" > "${sc%.tmpl}" echo "running shellcheck..." shellcheck --rcfile .shellcheckrc "${sc%.tmpl}" echo "::endgroup::" @@ -114,7 +114,7 @@ jobs: echo "rendering file..." # don't want to fetch secrets during linting sed -i 's|{{ (bitwardenSecrets ".*" .bwsAccessToken).value }}|fake-test-value|' "$e" - chezmoi execute-template --source=$(pwd) < "$e" > "${e%.tmpl}" + chezmoi execute-template --source="$(pwd)" < "$e" > "${e%.tmpl}" echo "running dotenv-linter..." dotenv-linter --skip QuoteCharacter "${e%.tmpl}" echo "::endgroup::" @@ -123,7 +123,7 @@ jobs: github-actions: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-github-actions.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-github-actions.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).actions_all_changed_files }} @@ -132,14 +132,14 @@ jobs: markdown: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).markdown_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-markdown.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-markdown.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).markdown_all_changed_files }} mise_ignore_cfg: private_dot_config/mise/config.toml pre-commit: - uses: ppat/github-workflows/.github/workflows/lint-pre-commit.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-pre-commit.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} mise_ignore_cfg: private_dot_config/mise/config.toml @@ -147,7 +147,7 @@ jobs: renovate-config-check: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).renovate_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-renovate-config-check.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-renovate-config-check.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).renovate_all_changed_files }} @@ -193,7 +193,7 @@ jobs: shellcheck: needs: [detect-changes, shellcheck-discover-files] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).shellscripts_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-shellcheck.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-shellcheck.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && needs.shellcheck-discover-files.outputs.files || fromJSON(needs.detect-changes.outputs.results).shellscripts_all_changed_files }} @@ -202,7 +202,7 @@ jobs: yaml: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).yaml_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-yaml.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-yaml.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).yaml_all_changed_files }} @@ -211,7 +211,7 @@ jobs: zizmor: needs: [detect-changes] if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }} - uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: git_ref: ${{ github.head_ref || github.ref }} mise_ignore_cfg: private_dot_config/mise/config.toml diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml index 203d5d55..27a10114 100644 --- a/.github/workflows/renovate.yaml +++ b/.github/workflows/renovate.yaml @@ -16,7 +16,7 @@ concurrency: jobs: renovate: - uses: ppat/github-workflows/.github/workflows/renovate.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + uses: ppat/github-workflows/.github/workflows/renovate.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1 with: dry_run: ${{ github.event_name == 'pull_request' }} git_ref: ${{ github.head_ref || github.ref }}