fix(ci): scope shellcheck.yml to changed files only (#313)#314
Merged
Conversation
Mirror the proven changed-files pattern from .github/workflows/lint.yml L97-123: detect touched shell files with tj-actions/changed-files (same SHA pin and CVE-2025-30022 comment as lint.yml) and run shellcheck -x only against that subset. Trigger paths filters and the push-to-main trigger are preserved unchanged. Drops the redundant Install ShellCheck step — Ubuntu 24.04 runners ship shellcheck preinstalled, the same assumption lint.yml relies on. Adds an explicit 'No shell files changed — skipping.' branch to match the proven skip behavior. Fixes #313 by unblocking PR #308 (and any future PR that touches a non-shell path): pre-existing findings in unmodified scripts no longer gate unrelated work. PR #308's own 22 findings in scripts/test-refresh-frontend-deps.sh and scripts/test-safe-rebuild-frontend-volume.sh remain PR #308's responsibility.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes GitHub issue #313 by scoping
.github/workflows/shellcheck.ymlto lint only the shell scripts the PR actually changed, matching the proven pattern in.github/workflows/lint.ymlL97-123.One-file workflow body rewrite, no new files, no version bumps, no
# shellcheck disable=, no edits tolint.yml.Why
shellcheck.ymlranshellcheck -x scripts/*.sh monitor_performance.sh docker/neo4j/entrypoint.shagainst every shell script in the repo with no filter and no severity floor. Any PR touchingscripts/picked up pre-existing findings from files it did not modify and was blocked.lint.ymlL11 documents the repo's convention: "shell script lint on changed files."lint.ymlL97-123 implements that convention viatj-actions/changed-files.shellcheck.ymlignored it.Validation case — PR #308 (
fix(scripts): renew stale frontend node_modules anonymous volumes, issue #306): state MERGEABLE butshellcheck.yml/shellcheckcheck FAILURE. The failing run produced 27 diagnostics: 6 pre-existing (SC2317 ×4 + SC2034 inscripts/test-check-frontend-deps.sh; SC2088 inscripts/validate-env.sh) plus 22 PR-308-owned findings in the PR's new test files.This change is the parallel of PR #312 (issue #309) — same pattern, different organ. PR #312 fixed the actionlint+shellcheck cascade on
.github/workflows/cd.yml; this PR fixes the equivalent onscripts/*.sh.What changes
.github/workflows/shellcheck.ymljobs block (lines 19-30) — full rewrite:Install ShellCheckstep (Ubuntu 24.04 runners ship shellcheck preinstalled per the existing comment inlint.yml).tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5 — SHA pin (CVE-2025-30022)— same SHA aslint.yml.files_yaml:scripts/**/*.sh,docker/neo4j/entrypoint.sh,monitor_performance.sh— same set aslint.yml.Run ShellCheckstep guarded byif: steps.changed.outputs.any_changed == 'true'and filters to*.shfiles only.No shell files changed — skipping.Trigger block (lines 1-18) is unchanged —
pull_requestandpushpaths preserved verbatim.Diff: 1 file, +23/-7.
Verification expectation
After this lands on
main:shellcheck.yml/shellcheckcheck on this PR turns green.shellcheck.ymloutput only when their owning files are touched.Out of scope
.github/workflows/lint.yml(proven working).scripts/test-check-frontend-deps.sh/scripts/validate-env.sh(a follow-up cleanup PR is owed but is separate from this fix)..shellcheckrc, pre-commit hooks, or shellcheck severity policy changes.tj-actions/changed-filesbeyonded68ef82/v46.0.5(must stay in lockstep withlint.yml).if: falsereal-deploy step or other workflow files.Refs: #313, #308