posthog/.github/workflows/shellcheck.yml at master · tanglearncode/posthog · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
name: shellcheck

on:
    pull_request:

permissions:
    contents: read

jobs:
    shell_check:
        runs-on: ubuntu-latest
        timeout-minutes: 5
        name: shellcheck
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
            # The runner image ships shellcheck, so apt is only a fallback. apt has
            # no retries and a 120s per-fetch timeout by default, and a stalled
            # mirror can hold this job past its timeout, which the merge queue
            # reads as a failed required check.
            - name: Install shellcheck
              run: |
                  if command -v shellcheck >/dev/null; then
                      shellcheck --version
                      exit 0
                  fi
                  sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 update
                  sudo apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=30 install -y shellcheck
            - name: Check secrets scripts
              run: cd bin && shellcheck deploy-hobby

            - name: Check Windows-compatible repository paths
              run: |
                  shellcheck .github/scripts/check-windows-paths.sh .github/scripts/check-windows-paths.test.sh
                  .github/scripts/check-windows-paths.test.sh
                  .github/scripts/check-windows-paths.sh

            - name: Check desktop backend coupling script
              run: |
                  shellcheck .github/scripts/desktop/*.sh
                  .github/scripts/desktop/check-pr-backend-coupling.test.sh

            - name: Check product JUnit preparation script
              run: |
                  shellcheck .github/scripts/prepare-product-junit-for-trunk.sh .github/scripts/prepare-product-junit-for-trunk.test.sh
                  bash .github/scripts/prepare-product-junit-for-trunk.test.sh

            - name: Check commit-time warning scripts
              run: |
                  # An open PR that has not rebased onto this commit does not carry these
                  # scripts, so the step skips rather than failing before its own tests run.
                  [ -f .github/scripts/check-commit-warnings.test.sh ] || exit 0
                  shellcheck .github/scripts/check-claude-hooks.sh \
                      .github/scripts/check-quill-agents-md.sh \
                      .github/scripts/check-comment-density.sh \
                      .github/scripts/check-commit-warnings.test.sh
                  .github/scripts/check-commit-warnings.test.sh

            - name: Check merge queue triage helpers
              run: |
                  # An open PR that has not rebased onto this commit does not carry these
                  # scripts, so the step skips rather than failing before its own tests run.
                  d=.agents/skills/triaging-merge-queue-failures/scripts
                  [ -f "$d/mq-queue-state.test.sh" ] || exit 0
                  shellcheck "$d/mq-queue-state.sh" "$d/mq-queue-state.test.sh" "$d/mq-triage-marker.sh"
                  bash "$d/mq-queue-state.test.sh"

            # Runs here, not in a path-gated ci-* job, so AGENTS/CLAUDE changes
            # anywhere in the repo are validated on every PR.
            - name: Check AGENTS.md / CLAUDE.md symlinks
              run: |
                  shellcheck .github/scripts/check-agents-md-symlinks.sh
                  .github/scripts/check-agents-md-symlinks.sh