name: 'Tests: shellcheck' on: [pull_request, push] jobs: shellcheck_matrix: permissions: contents: read runs-on: ubuntu-latest strategy: fail-fast: false matrix: shell: - bash - sh - dash - ksh file: - nvm.sh include: - shell: bash file: install.sh # only supported on bash - shell: bash file: bash_completion # only needed in bash/zsh - shell: bash file: nvm-exec # only runs in bash steps: - name: Harden Runner uses: step-security/harden-runner@v1 with: allowed-endpoints: ghcr.io:443 github.com:443 pkg-containers.githubusercontent.com:443 - uses: actions/checkout@v2 - name: Set up Homebrew uses: Homebrew/actions/setup-homebrew@master - name: Install latest shellcheck run: brew install shellcheck env: HOMEBREW_NO_ANALYTICS: 1 - run: which shellcheck - run: shellcheck --version - name: Run shellcheck on ${{ matrix.file }} run: shellcheck -s ${{ matrix.shell }} ${{ matrix.file }} shellcheck: permissions: contents: none needs: [shellcheck_matrix] runs-on: ubuntu-latest steps: - name: Harden Runner uses: step-security/harden-runner@v1 with: egress-policy: block - run: 'echo tests completed'