reactive-firewall/ShellCheck SARIF Analysis

ShellCheck SARIF Analysis Scan

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Mar 3, 2026
License: GPL 3.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: reactive-firewall/shellcheck-scan@50ac9fbbffe3dcce0e5479a274875d7514e59c73 # v2.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
path	File path to run shellcheck on. Default behavior is to use git to match tracked paths dynamically. Use 'path' to scan files not tracked by Git in the workspace. Mutually exclusive with 'match', if both are supplied, only 'path' will be used.	no	UNDEFINED
match	Glob-style pattern of files or directories to match and run shellcheck on. Only works with git tracked files. Mutually exclusive with 'path', if both are supplied, only 'path' will be used. If neither 'match' nor 'path' is supplied, the default behavior is to use git to match tracked paths dynamically.	no	*/.{bash,sh,command}
severity	Report only issues of a given severity level or higher. Can be STYLE, INFO, WARNING, or ERROR. Default is style.	no	style
shell-format	Interpret shells as of a given variant. Can be BASH, POSIX, DASH, KSH, ASH, or BUSYBOX. Default is automatic.	no	AUTOMATIC
token	The token used to authenticate when fetching Python distributions from https://github.com/actions/python-versions. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.	yes	${{ github.server_url == 'https://github.com' && github.token \|\| '' }}
publish-artifacts	Also upload results for downloading. (Does not affect GitHub scan alerts)	yes	true
keep-artifacts	SECURITY OVERRIDE - USE AT OWN RISK - Disables mitigations for CWE-910 - Also leave SARIF results on runner after upload. (Unless you have a very good reason, you should leave this alone)'	yes	false

Outputs

name	description
python-version	The python version that was used in the run.
sarif-id	The ID of the uploaded Code Scanning SARIF file, if any, otherwise null.
artifact-id	The uploaded artifact-id
artifact-url	The uploaded artifact-url
artifact-digest	The uploaded artifact-digest