shellcheck-markdown.yml

---
name: Shellcheck code in Markdown

on:
  push:

  workflow_call:
  workflow_dispatch:

# cancel any in-progress job or run
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: sh
    steps:
      - uses: actions/checkout@v4
      - name: Run shellcheck
        run: |
          # test shell syntax of Markdown code snippets
          # https://github.com/dylanaraps/pure-sh-bible/commit/9d54e96011

          # Markdown filename extensions
          # github/linguist@7503f/lib/linguist/languages.yml#L3707-L3718

          # run shellcheck on the extracted code blocks
          command find -- . \
            -path '*/.git' -prune -o \
            -path '*/.well-known' -prune -o \
            -path '*/Library' -prune -o \
            -path '*/node_modules' -prune -o \
            -path '*/t' -prune -o \
            -path '*/Test*' -prune -o \
            -path '*/test*' -prune -o \
            -path '*/tst*' -prune -o \
            -path '*copilot*' -prune -o \
            -path '*dummy*' -prune -o \
            -path '*vscode*' -prune -o \
            '(' \
            -name '*.md' -o \
            -name '*.livemd' -o \
            -name '*.markdn' -o \
            -name '*.markdown' -o \
            -name '*.mdown' -o \
            -name '*.mdwn' -o \
            -name '*.mdx' -o \
            -name '*.mkd' -o \
            -name '*.mkdn' -o \
            -name '*.mkdown' -o \
            -name '*.ronn' -o \
            -name '*.scd' -o \
            -name '*.workbook' -o \
            -name 'contents.lr' \
            ')' \
            -type f \
            -exec sh -x -c '
            command git ls-files --error-unmatch -- "${1-}" >/dev/null 2>&1 ||
              ! command git rev-parse --is-inside-work-tree >/dev/null 2>&1 &&
              while IFS='\'''\'' read -r -- line; do
                command test "${code-}" = '\''1'\'' &&
                  command test "${line-}" != '\''```'\'' &&
                  command printf -- '\''%s\n'\'' "${line-}"

              case "${line-}" in
              '\''```sh'\''|'\''```bash'\''|'\''```shell'\''|'\''```zsh'\'')
                code='\''1'\''
                ;;
              '\''```'\'')
                code='\'''\''
                ;;
              *) ;;
              esac

            # run shellcheck on the extracted code blocks
            # SC1071: allow conforming shells besides sh, bash, ksh, dash
            # SC1090: allow linking to a dynamic location
            # SC1091: allow linking to, but not following, linked scripts
            # SC2123: allow `$PATH` modification
            # SC2312: allow masking return values
            done <"${1-}"' _ {} ';' |
            command shellcheck \
              --check-sourced \
              --enable=all \
              --exclude='SC1071,SC1090,SC1091,SC2123,SC2312' \
              --norc \
              --severity=style \
              --shell=sh \
              --source-path=/dev/null \
              -- \
              - ||
            exit "${?:-1}"
...