{"id":45137101,"url":"https://github.com/pcolby/check-run-scripts","last_synced_at":"2026-02-20T00:05:36.591Z","repository":{"id":319404204,"uuid":"1068885588","full_name":"pcolby/check-run-scripts","owner":"pcolby","description":"ShellCheck your embedded GitHub Actions scripts","archived":false,"fork":false,"pushed_at":"2025-11-14T10:39:27.000Z","size":155,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-11-14T12:26:58.723Z","etag":null,"topics":["github-actions","shellcheck","shellcheck-action","workflows"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pcolby.png","metadata":{"files":{"readme":"readme.md","changelog":"changelog.md","contributing":null,"funding":null,"license":"license.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-03T04:08:33.000Z","updated_at":"2025-11-14T10:39:30.000Z","dependencies_parsed_at":"2025-10-19T02:28:50.573Z","dependency_job_id":"6ef860d4-3c43-42ac-ad6b-2b8493f093f0","html_url":"https://github.com/pcolby/check-run-scripts","commit_stats":null,"previous_names":["pcolby/check-run-scripts"],"tags_count":13,"template":false,"template_full_name":null,"purl":"pkg:github/pcolby/check-run-scripts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pcolby%2Fcheck-run-scripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pcolby%2Fcheck-run-scripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pcolby%2Fcheck-run-scripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pcolby%2Fcheck-run-scripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pcolby","download_url":"https://codeload.github.com/pcolby/check-run-scripts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pcolby%2Fcheck-run-scripts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29637398,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-19T22:32:43.237Z","status":"ssl_error","status_checked_at":"2026-02-19T22:32:38.330Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github-actions","shellcheck","shellcheck-action","workflows"],"created_at":"2026-02-20T00:05:35.790Z","updated_at":"2026-02-20T00:05:36.584Z","avatar_url":"https://github.com/pcolby.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Check `run` Scripts\n\n[![Test](https://github.com/pcolby/check-run-scripts/actions/workflows/test.yaml/badge.svg)](\n  https://github.com/pcolby/check-run-scripts/actions/workflows/test.yaml)\n[![Lint](https://github.com/pcolby/check-run-scripts/actions/workflows/lint.yaml/badge.svg)](\n  https://github.com/pcolby/check-run-scripts/actions/workflows/lint.yaml)\n[![CodeQL](https://github.com/pcolby/check-run-scripts/actions/workflows/github-code-scanning/codeql/badge.svg)](\n  https://github.com/pcolby/check-run-scripts/actions/workflows/github-code-scanning/codeql)\n\nGitHub Action, and stand-alone script, for running ShellCheck against scripts embedded in GitHub Actions [workflow] and\n[composite action] files.\n\n## Why\n\nTesting stand-alone scripts is easy. You can simply run [ShellCheck] on them directly. Likewise, testing them in GitHub\nActions as some sort of CI process is easy: just add a step that runs [ShellCheck].\n\nHowever, if you have scripts _embedded_ into GitHub Actions files, checking them is not so easy. This project can help\nwith that.\n\n\u003e [!TIP]\n\u003e Because this Action/script uses [ShellCheck], only scripts for shells supported by [ShellCheck] are checked.\n\u003e Specifically both GitHub Actions, and [ShellCheck] support `bash` and `sh`, so only those are checked. Run steps using\n\u003e `cmd`, `pwsh`, etc are simply logged, and skipped.\n\n## Running Locally\n\n### Dependencies\n\nThe script depends on [Bash], [jq] and [yq], so install those first, if you don't have them already.\n\n### Installation\n\nTo install, simply download the `check-run-scripts.sh` script to somewhere you like, and make it executable.\n\n```sh\ncurl -O 'https://raw.githubusercontent.com/pcolby/check-run-scripts/v1/check-run-scripts.sh'\nchmod u+x check-run-scripts.sh\n./check-run-scripts.sh --version\n```\n\n### Command-Line\n\nOnce installed, run either:\n\n1. in a project's root folder, with a `.github/workflows/` folder containing `*.yaml` or `*.yml` files; or\n2. in a folder containing workflow `*.yaml` or `*.yml` files; or\n3. with positional arguments listing one or more files or directories to search.\n\nYou can use the `--help` option for more details.\n\n```text\nUsage: ./check-run-scripts.sh [\u003coptions\u003e] [\u003cpath\u003e [...]]\n\nOptions:\n  -c,--color=\u003cwhen\u003e Use color (auto, always, never). Defaults to auto.\n  -d,--debug        Enable debug output.\n  -h,--help         Show this help text and exit.\n  -s,--set=\u003cnames\u003e  Set \u003cnames\u003e in each extracted script, so ShellCheck treats\n                    them as assigned.\n  -v,--version      Show the script's version, and exit.\n  -                 Treat the remaining arguments as positional.\n\nAdditionally, any options that start with --sc- will be passed to ShellCheck\nwith the --sc prefix removed. For example, '--sc--norc'. See the ShellCheck\nmanual for the range of options available. If no ShellCheck options are set,\nthe following options are used by default:\n  --check-sourced --enable=all --external-sources --norc\n```\n\n### Examples\n\n```sh\n# Checking the ./.github/workflows directory.\n$ ./check-run-scripts.sh\n2025-10-18 17:28:46 Checking directory: ./.github/workflows\n2025-10-18 17:28:46 Checking: ./.github/workflows/test.yaml\n2025-10-18 17:28:46 Checking job: test\n2025-10-18 17:28:46 Checking step: test[1]\n...\n2025-10-18 17:28:46 Checking step: test[5]\n2025-10-18 17:28:46 Checking: ./.github/workflows/lint.yaml\n2025-10-18 17:28:46 Checking job: check\n2025-10-18 17:28:46 Checking step: check[1]\n...\n$\n# Checking one or more specific files (or directories).\n$ ./check-run-scripts.sh action.yaml\n2025-10-18 17:30:46 Checking: action.yaml\n...\n$\n```\n\n## GitHub Action\n\n\u003e [!NOTE]\n\u003e The action requires `shellcheck`, `jq` and `yq` commands. While GitHub includes these commands on Ubuntu runners\n\u003e already, one or more of those need to be installed on macOS and Windows. See the [macOS](#macos) and\n\u003e [Windows](#windows) sections below for details.\n\n### Action Usage\n\n```yaml\n- uses: pcolby/check-run-scripts@v1\n  with:\n    # Files or directories containing workflow/action files to check. If not specified, files under the\n    # `./.github/workflows` folder will be checked, otherwise files in the current working directory itself.\n    # Paths must be new-line separated. Hint: use YAML's `|-` block scalar syntax.\n    paths: |-\n      ${{ github.workspace }}/.github/workflows\n      action.yaml\n\n    # Emit warnings in sourced files. Normally, `shellcheck` will only warn about issues in the specified files. With\n    # this input set to `true`, any issues in sourced files will also be reported. Defaults to `true`.\n    check-sourced: true\n\n    # Comma-separated list of codes to include, for example `SC2016,SC2310`.\n    # Optional. Defaults to `all`.\n    include: all\n\n    # Comma-separated list of codes to exclude, for example, `SC2016,SC2310`.\n    # Optional. Defaults is '' (none).\n    exclude: SC2016,SC2310\n\n    # Follow source statements even when the file is not specified as input. By default, `shellcheck` will only follow\n    # files specified on the command line (plus `/dev/null`). This option allows following any file the script may\n    # source.\n    # Optional. Default is `true`.\n    external-sources: true\n\n    # Comma-separated list of variables to assume are defined elsewhere. Useful, for example, if earlier steps create\n    # environment variables by writing to `${GITHUB_ENV}`.\n    external-variables: SOME_ENV_VAR,SOME_OTHER_VAR\n\n    # Configuration file to prefer over searching for one in the default locations.\n    # Optional. Default is '' (none).\n    rc-file: some/preferred/shellcheck.rc\n\n    # Additional paths to search for sourced files. Paths must be new-line separated. Hint: use YAML's `|-` block scalar\n    # syntax.\n    # Optional. Default is '' (none).\n    source-path: |-\n      some/extra/path\n      another/path\n\n    # Override shell dialect. Valid values are `sh`, `bash`, `dash`, `ksh`, and `busybox`.\n    # Optional. Defaults to auto-detecting from the action/workflow file/s.\n    shell: bash\n\n    # Minimum severity of errors to report. Must be one of the levels supported by `shellcheck`; currently: `error`,\n    # `warning`, `info` and `style`.\n    # Optional. Defaults to allowing `shellcheck` to use it's own default, which is currently `style`.\n    severity: info\n\n    # Set to `true` to enable debug output.\n    # Optional. Default is '' (non-true).\n    debug: true\n```\n\n[composite action]: https://docs.github.com/en/actions/concepts/workflows-and-actions/custom-actions#composite-actions\n[ShellCheck]: https://github.com/koalaman/shellcheck\n[workflow]: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax\n\n### macOS\n\nFor GitHub's macOS runners, `bash` must be upgraded (macOS's Bash is ancient), and `shellcheck` installed.\n\n```yaml\n- run: brew install bash shellcheck\n- uses: pcolby/check-run-scripts@v1\n```\n\n### Windows\n\nFor GitHub's Windows runners, both `shellcheck` and `yq` must be installed.\n\n```yaml\n- run: choco install shellcheck yq\n- uses: pcolby/check-run-scripts@v1\n```\n\n[Bash]: https://www.gnu.org/software/bash/\n[jq]: https://jqlang.org/\n[yq]: https://mikefarah.gitbook.io/yq\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpcolby%2Fcheck-run-scripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpcolby%2Fcheck-run-scripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpcolby%2Fcheck-run-scripts/lists"}