## Problem `.github/shellcheck-actions.sh` lints only two files in this repository, and the script currently fails. **The glob is too shallow.** The script expands `$DIR/../**/*.yaml`. Without `globstar`, `**` behaves like `*`, so the pattern resolves to `.github/*/*.yaml`, which matches only: - `setup-python-runner/action.yaml` - `snap-publish/action.yaml` Every workflow in `.github/workflows/` is skipped, so the shell fragments inside `run:` steps of `lint-python.yaml`, `test-python.yaml`, and the rest are never checked. **The script already fails.** Running it against `main` exits 1 because of warnings in `setup-python-runner/action.yaml`: ``` SC2086 (info): Double quote to prevent globbing and word splitting. SC1083 (warning): This } is literal. Check expression (missing ;/\n?) or quote it. ``` Both come from this line: ```yaml echo "cache-hash=$(echo "${{ toJSON(matrix.platform) }}" | sha1sum | cut -f1 -d' ')" >> "${GITHUB_OUTPUT}" ``` The `$(...)` and `${{ ... }}` substitutions produce unbalanced quoting for shellcheck. Because the script runs under `set -euo pipefail`, the first failure aborts the loop, so the remaining files are never reached either. ## Impact `make lint-code` calls this script, so the shellcheck half of the code linters is red on `main` today and provides no coverage of the workflows. ## Suggested fix 1. Widen the glob so workflow files are included, for example by enabling `globstar` at the top of the script: ```bash shopt -s globstar for f in "$DIR"/../**/*.yaml; do ``` This reaches `.github/workflows/*.yaml` as well as `.github/**/*.yaml`, which makes the coverage of that directory sensible. 2. Decide what to do about the `setup-python-runner/action.yaml` warnings. Options include templating the value into an environment variable so the `run:` block stays valid shell for shellcheck, or excluding known-workflow-template expressions from the check. 3. Confirm the intended failure semantics. A single informational finding aborting the whole loop makes the check hard to reason about. ## Notes Found while splitting `lint-python.yaml` into separate jobs (canonical/starflow#199). That change does not depend on this fix, but it keeps `make lint-code` as the name of the code lint entry point, so this should be addressed before relying on that job as a required check.