tests.yml

name: Tests
on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

defaults:
  run:
    # Make sure bash is always invoked with `-eo pipefail`
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
    shell: bash

jobs:
  code-tests:
    name: Code
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
        with:
          # A non-shallow clone is needed for the Differential ShellCheck
          fetch-depth: 0

      - id: ShellCheck
        name: Differential ShellCheck
        uses: redhat-plumbers-in-action/differential-shellcheck@cc6721c45a8800cc666de45493545a07a638d121  # v5.4.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
        if: github.event_name == 'pull_request'

      - name: Upload artifact with ShellCheck defects in SARIF format
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: Differential ShellCheck SARIF
          path: ${{ steps.ShellCheck.outputs.sarif }}
        if: github.event_name == 'pull_request'