shellcheck-privste.yml

name: ShellCheck Private Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

permissions:
  contents: read
  security-events: write

jobs:
  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install ShellCheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck

      - name: Run ShellCheck on all .sh and save output
        run: |
          files=$(find . -type f -name "*.sh" -not -path "./.git/*" -print)
          if [ -z "$files" ]; then
            echo "No shell scripts found"
            echo "NO_SCRIPTS" > shellcheck-output.txt
            exit 0
          fi
          shellcheck $files > shellcheck-output.txt || true
          shellcheck -f sarif $files > shellcheck-results.sarif || true

      - name: Upload results as artifact (private to repo collaborators)
        uses: actions/upload-artifact@v4
        with:
          name: shellcheck-results-${{ github.run_id }}
          path: |
            shellcheck-output.txt
            shellcheck-results.sarif