ci: use commit hash for github action, add persist-credentials false … #769

	---
	name: ShellCheck
	on: # yamllint disable-line rule:truthy
	pull_request:
	merge_group:
	branches:
	- main
	types:
	- checks_requested
	push:
	branches:
	- main
	workflow_dispatch:
	env:
	# some scripts source tox-lsr scripts - suppress that check
	SHELLCHECK_OPTS: -e SC1091
	permissions:
	contents: read
	jobs:
	shellcheck:
	if: \|
	!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) \|\|
	(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
	runs-on: ubuntu-latest
	steps:
	- name: Update git
	run: \|
	set -euxo pipefail
	sudo apt update
	sudo apt install -y git

	- name: Checkout repo
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
	with:
	persist-credentials: false

	- name: Run ShellCheck
	id: shellcheck_id
	uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master

	- name: Show file paths scanned
	run: \|
	echo Files scanned:
	echo "${{ steps.shellcheck_id.outputs.files }}"

Navigation Menu