-
Notifications
You must be signed in to change notification settings - Fork 31
Open
Labels
Description
Objective
Resolve 10 shellcheck issues across daily-performance-summary and test-python-safe-input workflows.
Context
Severity: Error
Tool: actionlint (shellcheck integration)
Affected Workflows:
daily-performance-summary(5 issues)test-python-safe-input(5 issues)
Issues Breakdown
SC2086: Double quote to prevent globbing (4 occurrences)
Variables need quoting to prevent word splitting and globbing issues.
SC2129: Use compound redirection (2 occurrences)
Use { cmd1; cmd2; } >> file instead of multiple >> redirects for efficiency.
SC2009: Use pgrep instead of grepping ps (2 occurrences)
Replace fragile ps | grep patterns with more robust pgrep command.
Approach
- Locate the source markdown files for both workflows
- Find shell script blocks with the reported issues
- Apply shellcheck fixes:
- Add double quotes around variables:
$var→"$var" - Combine redirections:
cmd1 >> file; cmd2 >> file→{ cmd1; cmd2; } >> file - Replace ps patterns:
ps aux | grep pattern→pgrep pattern
- Add double quotes around variables:
- Recompile workflows with
make recompile - Verify with actionlint
Files to Modify
- Edit:
.github/workflows/daily-performance-summary.md - Edit:
.github/workflows/test-python-safe-input.md - Generated: Corresponding
.lock.ymlfiles (via recompile)
Example Fixes
SC2086 Fix:
# Before
echo $variable
# After
echo "$variable"SC2129 Fix:
# Before
echo "line1" >> file.txt
echo "line2" >> file.txt
# After
{
echo "line1"
echo "line2"
} >> file.txtSC2009 Fix:
# Before
ps aux | grep myprocess
# After
pgrep myprocessAcceptance Criteria
- All 4 SC2086 issues fixed with proper quoting
- All 2 SC2129 issues fixed with compound redirects
- All 2 SC2009 issues fixed with pgrep
- Both workflows recompiled with
make recompile - Actionlint shows no shellcheck errors for these workflows
- Workflows execute correctly with shell script changes
Why This Matters
- Prevents word splitting bugs that could cause runtime failures
- Improves shell script robustness and reliability
- Follows bash best practices
- Makes scripts more maintainable
Related to [plan] Address security findings from static analysis scan #5866
AI generated by Plan Command for discussion #5845