- name: Run ShellCheck Analysis
  uses: reactive-firewall/shellcheck-scan@v1
  with:
    # Optional: Specify exact path to scan (advanced feature)
    # To use a specific file, uncomment and set:
    path: '${{ github.workspace }}/downloads/my-artifact.bash'
    
    # Optional: Custom glob pattern for matching files
    match: '**/*.{sh,bash,ksh}'
    
    # Optional: Set minimum severity level (style, info, warning, error)
    severity: 'warning'
    
    # Optional: Specify shell dialect (bash, sh, dash, ksh, busybox)
    shell-format: 'bash'

    # Optional: Set to true to upload scan results as artifacts
    publish-artifacts: true

name: ShellCheck Analysis

on: [push, pull_request]

jobs:
  shellcheck:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: reactive-firewall/shellcheck-scan@v1

# .github/workflows/shellcheck.yml
---
name: shellcheck
on: [push, pull_request]

permissions: {}  # Setting default permissions to none for enhanced security

jobs:
  shellcheck:
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull_requests: read  # to get PR metadata
      security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results

    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          submodules: true
      - name: Shellcheck Scan
        uses: reactive-firewall/shellcheck-scan@v1
        with:  # optional arguments
          match: 'scripts/* **/*.sh'
          publish-artifacts: false
        if: ${{ success() }}

- uses: reactive-firewall/shellcheck-scan@v1
  with:
    severity: 'warning'
    shell-format: 'bash'
    match: '**/*.bash'