GHA/checksrc: preprocess workflows to lint more shell code

`zizmor` keeps being confused by non-"well-known" shell designators
`msys2 {0}`, `<path>\bash.exe '{0}'`, `cpa.sh {0}`, while `actionlint`
silently skips checking such shell code. Though it's all POSIX/bash.
Replace the unrecognized shell designators with `bash` before running
the linters, to remove these blind spots.

zizmor pedantic persona:
Before: `No findings to report. Good job! (1 ignored, 61 suppressed)`
After: `No findings to report. Good job! (1 ignored)`

zizmor auditor persona:
Before: `No findings to report. Good job! (62 ignored)`
After: `No findings to report. Good job! (1 ignored)`

Closes #22626
This commit is contained in:
Viktor Szakats 2026-08-20 00:33:42 +02:00
parent 2f1dda9691
commit 5d6dc81678
No known key found for this signature in database

View file

@ -178,6 +178,10 @@ jobs:
with:
persist-credentials: false
- name: 'zizmor/actionlint (prepare)'
# Replace custom bash-like shell designators with the standard one to make linters process them
run: sed -i.bak -E 's/shell\x3a .+ zizmor\x3a ignore.+$/shell\x3a bash/g' .github/workflows/*.yml
- name: 'zizmor GHA'
env:
GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'