From 0526e4ad5f1eea0a251db4121ed7cf3edecb6f34 Mon Sep 17 00:00:00 2001
From: Blair Hamilton <blair@pinpredict.com>
Date: Sun, 7 Jun 2026 21:06:57 -0400
Subject: [PATCH] ci: tidy pre-existing shellcheck findings + drop -S warning
 escape hatch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes the four info/style findings that PG#944's initial actionlint
roll-out had to suppress via `SHELLCHECK_OPTS=-S warning`:

- chart-release.yml / docker-release.yml: quote the prefix inside
  `${var#${prefix}}` (SC2295).
- tag-config.yml: quote `+${svc}` inside `${var%+${svc}}` (SC2295);
  group three sequential `>> "$GITHUB_OUTPUT"` redirects under one
  `{ ... } >> "$GITHUB_OUTPUT"` (SC2129); replace the `sed`-based
  list-prefix with a `while read` loop (SC2001).

With these cleared, the severity override on actionlint.yml's env can
go away too — shellcheck is back to running at its default severity
(`info`+), so future style regressions in `run:` blocks fail PRs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/actionlint.yml     |  6 ------
 .github/workflows/chart-release.yml  |  2 +-
 .github/workflows/docker-release.yml |  2 +-
 .github/workflows/tag-config.yml     | 14 +++++++++-----
 4 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 498694a..5056e9a 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -35,12 +35,6 @@ on:
 # tightens rules in a way that flags previously-passing workflows.
 env:
   ACTIONLINT_VERSION: "1.7.7"
-  # Scope shellcheck to warning+ severity. The gate's job is to catch
-  # input-contract regressions and real shell bugs (SC2086 quoting,
-  # SC2046 word-splitting, etc.); info/style nitpicks (SC2295, SC2001,
-  # SC2129) in long-standing `run:` blocks aren't worth blocking PRs
-  # over. Drop this once the existing scripts are tidied up.
-  SHELLCHECK_OPTS: "-S warning"
 
 jobs:
   actionlint:
diff --git a/.github/workflows/chart-release.yml b/.github/workflows/chart-release.yml
index f8a1a71..58b220f 100644
--- a/.github/workflows/chart-release.yml
+++ b/.github/workflows/chart-release.yml
@@ -73,7 +73,7 @@ jobs:
             if [ -z "$latest" ]; then
               candidate="0.0.1"
             else
-              version="${latest#${prefix}}"
+              version="${latest#"${prefix}"}"
               IFS='.' read -r major minor patch <<< "$version"
               candidate="${major}.${minor}.$((patch + 1))"
             fi
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 3a75a10..5cdac18 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -134,7 +134,7 @@ jobs:
           if [ -z "$latest_tag" ]; then
             major=0; minor=0; patch=0
           else
-            version="${latest_tag#${prefix}}"
+            version="${latest_tag#"${prefix}"}"
             IFS='.' read -r major minor patch <<< "$version"
           fi
           patch=$((patch + 1))
diff --git a/.github/workflows/tag-config.yml b/.github/workflows/tag-config.yml
index ed0d61c..0baaf40 100644
--- a/.github/workflows/tag-config.yml
+++ b/.github/workflows/tag-config.yml
@@ -78,10 +78,14 @@ jobs:
           fi
 
           echo "Services to tag:"
-          echo "$services" | sed 's/^/  - /'
-          echo "list<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$services" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
+          while IFS= read -r svc; do
+            echo "  - $svc"
+          done <<< "$services"
+          {
+            echo "list<<EOF"
+            echo "$services"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Compute and push tags
         if: steps.changed.outputs.list != ''
@@ -100,7 +104,7 @@ jobs:
               next="v0.0.1+${svc}"
             else
               version="${latest#v}"
-              version="${version%+${svc}}"
+              version="${version%+"${svc}"}"
               IFS='.' read -r major minor patch <<< "$version"
               next="v${major}.${minor}.$((patch + 1))+${svc}"
             fi