differential-shellcheck.yml

---

name: Differential ShellCheck
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  merge_group:
    types: [ checks_requested ]

permissions:
  contents: read

jobs:
  lint:
    name: Differential ShellCheck - test current changes
    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      # Let's have this log of GitHub context for further development and debugging
      - name: Dump GitHub context
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: echo "$GITHUB_CONTEXT"

      - name: Repository checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          fetch-depth: 0

      # Replace docker://ghcr.io/redhat-plumbers-in-action/differential-shellcheck:vX.Y.Z with Dockerfile
      - name: Edit an action.yml file to test current changes
        run: |
          sed -i "s/docker:\/\/ghcr\.io\/redhat-plumbers-in-action\/differential-shellcheck.*/Dockerfile/g" action.yml

      - name: Differential ShellCheck - test current changes
        id: ShellCheck
        uses: ./
        with:
          exclude-path: |
            test/**
            src/**.{zsh,osh}
          display-engine: sarif-fmt
          token: ${{ secrets.GITHUB_TOKEN }}

      - if: always()
        name: Upload artifact with defects in SARIF format
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        with:
          name: Differential ShellCheck SARIF
          path: ${{ steps.ShellCheck.outputs.sarif }}
          retention-days: 7

      - if: always()
        name: Upload artifact with defects in XHTML format
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        with:
          name: Differential ShellCheck HTML
          path: ${{ steps.ShellCheck.outputs.html }}
          retention-days: 7