ci: fix shellcheck exclude-path and cosign legacy bundle format#5
Merged
mreuvekamp merged 2 commits intomainfrom May 7, 2026
Merged
ci: fix shellcheck exclude-path and cosign legacy bundle format#5mreuvekamp merged 2 commits intomainfrom
mreuvekamp merged 2 commits intomainfrom
Conversation
The differential-shellcheck action does not accept `ignored-paths`; it warns "Unexpected input(s) 'ignored-paths'" and silently scans the vendored scripts anyway. With `strict-check-on-push: true`, vendor warnings (SC2034, SC2046, etc. in sdkman.sh) fail the push job on main. Rename to the documented `exclude-path` input and use a `**` glob so the entire vendor tree is skipped, matching the intent that already exists in the `git ls-files ':!:claude-sandbox/vendor/**'` filters used by the PR-fail step and the fork-PR fallback job. Fixes failing run on main: 25443956040. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
cosign >= 2.5 enables --new-bundle-format by default, which silently
ignores --output-signature/--output-certificate and then fails because
no --bundle path is provided ("create bundle file: open : no such file
or directory"). Pin the legacy format so the existing .sig/.pem asset
layout and SECURITY.md verification instructions keep working without
a bundle migration.
Repro: release v0.1.0 publish triggered run 25457374576 which failed
on the Sign-archive step.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
ericwout-overheid
changed the title
mreuvekamp
approved these changes
May 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two unrelated CI fixes, both surfaced after security PR #3 landed. Bundled because the second one only became visible the first time we cut a release and is small.
1. shellcheck exclude-path (originally scoped fix)
redhat-plumbers-in-action/differential-shellcheck@v5.5.6action does not acceptignored-paths; it logs##[warning]Unexpected input(s) 'ignored-paths'and scans the vendored scripts anyway.strict-check-on-push: true, SC2034/SC2046 warnings insideclaude-sandbox/vendor/install-scripts/sdkman.shfail the push job onmain(run 25443956040).exclude-pathand uses a**glob to actually skip the vendor tree, matching the:!:claude-sandbox/vendor/**filter already used in the other two jobs.2. release-sign cosign legacy bundle format (added)
--new-bundle-formatby default, which silently ignores--output-signature/--output-certificateand then errors withcreate bundle file: open : no such file or directorybecause no--bundlepath was provided.v0.1.0triggered run 25457374576, which failed on theSign archive with cosign keylessstep for the same reason on both sign-blob calls.--new-bundle-format=falseon both calls so the existing.sig/.pemasset layout — and the consumer verification instructions inSECURITY.md— keep working without a bundle migration.Test plan
shellcheck --severity=warning -xlocally on the three tracked non-vendor scripts (entrypoint.sh,init-firewall.sh,install-docker.sh); all clean.differential-shellcheckjob on this PR no longer logs the "Unexpected input(s) 'ignored-paths'" warning.mainafter merge.release-signforv0.1.0viagh workflow run release-sign --ref main -f tag=v0.1.0and confirm both sign-blob calls produce non-empty.sig/.pemassets.🤖 Generated with Claude Code