Lint the action's run body with the pinned shellcheck (#5)

ci.yml checks the .sh files with a digest-pinned shellcheck, while
tests/lint-action.sh checked the extracted run: body with whatever
shellcheck the runner had. The script now writes the body inside the
checkout and takes the checker from $SHELLCHECK, as
action-debian-build's shellcheck-composite.py does, and CI points that
at the same pinned image. Unset, it is plain shellcheck, so local runs
are unchanged.

Checked locally through the container: the current body passes, and a
seeded unquoted expansion fails with SC2086.

Author: barnumbirr

.github/workflows/ci.yml

@@ -35,6 +35,10 @@ jobs:
             commit-branch.sh tests/*.sh
 
       - name: Lint the action metadata and its inline shell
+        env:
+          SHELLCHECK: >-
+            docker run --rm --volume ${{ github.workspace }}:/repo --workdir /repo
+            koalaman/shellcheck@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d
         run: tests/lint-action.sh
 
       - name: Test

tests/lint-action.sh

@@ -17,7 +17,9 @@ shopt -s inherit_errexit
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$ROOT"
 
-body="$(mktemp)"
+# Inside the checkout, so the containerised checker CI uses can see it;
+# prefixed, so a killed run's leftover names itself in git status.
+body="$(mktemp -p . .lint-action-body.XXXXXX)"
 trap 'rm -f "$body"' EXIT
 
 python3 - "$body" <<'PY'
@@ -85,6 +87,9 @@ with open(sys.argv[1], "w") as out:
 print("  ok   action.yml parses, one bash step, every input piped, no inline expressions")
 PY
 
+# $SHELLCHECK selects the checker. CI points it at the digest-pinned container
+# the .sh files go through, so one version judges every line of shell here.
+read -ra shellcheck <<< "${SHELLCHECK:-shellcheck}"
 # SC2154: the variables come from the step's env:, which shellcheck cannot see.
-shellcheck -S style -e SC2154 "$body"
+"${shellcheck[@]}" -S style -e SC2154 "$body"
 echo "  ok   the run body is shellcheck-clean"