status-checks.yaml

name: status checks
on:
  push:

permissions:
  contents: read
  pull-requests: read

jobs:
  shfmt:
    name: run shfmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: reviewdog/action-shfmt@v1
        with:
          level: info
          filter_mode: nofilter
          fail_on_error: true
          shfmt_flags: '-ln bash -ci -sr -i 2'

  shellcheck:
    runs-on: ubuntu-latest

    permissions:
      security-events: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - id: shellCheck
        uses: redhat-plumbers-in-action/differential-shellcheck@v5
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          exclude-path: ./config.sample.sh
          strict-check-on-push: true
          diff-scan: false

      - if: always()
        uses: actions/upload-artifact@v4
        with:
          name: differential shellCheck SARIF
          path: ${{ steps.shellCheck.outputs.sarif }}