Suppress ShellCheck findings for actionlint

.github/workflows/codespell.yml

@@ -25,3 +25,31 @@ jobs:
         uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2.1
         with:
           ignore_words_file: .codespellignore
+      - name: ShellCheck
+        run: |
+          set -eo pipefail
+          if ! command -v shellcheck >/dev/null 2>&1; then
+            sudo apt-get update
+            sudo apt-get install --no-install-recommends -y shellcheck
+          fi
+
+          mapfile -t shell_files < <(git ls-files '*.sh' '*.bash' '*.bats')
+          if [ "${#shell_files[@]}" -eq 0 ]; then
+            echo "No shell scripts found to lint"
+            exit 0
+          fi
+
+          shellcheck "${shell_files[@]}"
+      - name: Install actionlint
+        env:
+          GOBIN: ${{ runner.temp }}/bin
+        run: |
+          set -eo pipefail
+          mkdir -p "$GOBIN"
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.7
+      - name: actionlint
+        env:
+          ACTIONLINT_BIN: ${{ runner.temp }}/bin/actionlint
+        run: |
+          set -eo pipefail
+          "$ACTIONLINT_BIN" -color

.github/workflows/rust-ci.yml

@@ -120,6 +120,7 @@ jobs:
           - runner: windows-latest
             target: x86_64-pc-windows-msvc
             profile: dev
+          # actionlint: disable-next-line runner-label
           - runner: windows-11-arm
             target: aarch64-pc-windows-msvc
             profile: dev
@@ -137,6 +138,7 @@ jobs:
           - runner: windows-latest
             target: x86_64-pc-windows-msvc
             profile: release
+          # actionlint: disable-next-line runner-label
           - runner: windows-11-arm
             target: aarch64-pc-windows-msvc
             profile: release
@@ -177,6 +179,7 @@ jobs:
         if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' && matrix.profile != 'release' }}
         continue-on-error: true
         run: |
+          # shellcheck disable=SC2016
           find . -name Cargo.toml -mindepth 2 -maxdepth 2 -print0 \
             | xargs -0 -n1 -I{} bash -c 'cd "$(dirname "{}")" && cargo check --profile ${{ matrix.profile }}'
 

.github/workflows/rust-release.yml

@@ -72,6 +72,7 @@ jobs:
             target: aarch64-unknown-linux-gnu
           - runner: windows-latest
             target: x86_64-pc-windows-msvc
+          # actionlint: disable-next-line runner-label
           - runner: windows-11-arm
             target: aarch64-pc-windows-msvc
 
@@ -102,6 +103,7 @@ jobs:
       - name: Stage artifacts
         shell: bash
         run: |
+          # shellcheck disable=SC2193
           dest="dist/${{ matrix.target }}"
           mkdir -p "$dest"
 
@@ -121,6 +123,7 @@ jobs:
       - name: Compress artifacts
         shell: bash
         run: |
+          # shellcheck disable=SC2193
           # Path that contains the uncompressed binaries for the current
           # ${{ matrix.target }}
           dest="dist/${{ matrix.target }}"
@@ -195,7 +198,7 @@ jobs:
           # Extract the version from the tag name, which is in the format
           # "rust-v0.1.0".
           version="${GITHUB_REF_NAME#rust-v}"
-          echo "name=${version}" >> $GITHUB_OUTPUT
+          echo "name=${version}" >> "$GITHUB_OUTPUT"
 
       - name: Determine npm publish settings
         id: npm_publish_settings
@@ -203,6 +206,7 @@ jobs:
           VERSION: ${{ steps.release_name.outputs.name }}
         run: |
           set -euo pipefail
+          # shellcheck disable=SC2153
           version="${VERSION}"
 
           if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -340,7 +344,7 @@ jobs:
         run: |
           set -euo pipefail
           gh api \
-            repos/${GITHUB_REPOSITORY}/git/refs/heads/latest-alpha-cli \
+            "repos/${GITHUB_REPOSITORY}/git/refs/heads/latest-alpha-cli" \
             -X PATCH \
             -f sha="${GITHUB_SHA}" \
             -F force=true