fix(build): quote shell variables and group redirects in workflow files by WilliamBerryiii · Pull Request #299 · microsoft/hve-core

WilliamBerryiii · 2026-01-26T19:07:35Z

Description

Fixed shellcheck warnings SC2086 (unquoted variables) and SC2129 (ungrouped redirects) in GitHub Actions workflow files. These warnings were surfaced during CI runs and follow the same fix patterns established in PR #246.

Quoted $GITHUB_ENV and $GITHUB_STEP_SUMMARY shell variables to prevent word splitting
Grouped multiple echo statements into single redirects using brace syntax { ...; } >> file
Applied fixes to both markdown-lint.yml and codeql-analysis.yml workflows

Related Issue(s)

Fixes #298

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Sample Prompts (for AI Artifact Contributions)

N/A - This PR does not include AI artifacts.

Testing

Ran actionlint locally against both modified workflow files with no errors
Prior art validated in PR chore: remove step-security/harden-runner from workflows #246 which applied identical fix patterns

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

N/A

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

These shellcheck warnings existed prior to Dependabot PR #295 and were surfaced during CI validation. The fixes align with patterns from PR #246 which addressed identical issues in extension-publish*.yml workflows.

🔧 Generated by Copilot

Quote $GITHUB_ENV and $GITHUB_STEP_SUMMARY variables (SC2086) and group multiple echo statements into single redirects (SC2129) in markdown-lint.yml and codeql-analysis.yml. 🤖 Generated by Copilot

github-actions · 2026-01-26T19:07:52Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

codecov-commenter · 2026-01-26T19:08:51Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.18%. Comparing base (4e8707e) to head (1de87c8).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #299      +/-   ##
==========================================
- Coverage   38.21%   38.18%   -0.04%     
==========================================
  Files          15       15              
  Lines        2805     2805              
==========================================
- Hits         1072     1071       -1     
- Misses       1733     1734       +1

Flag	Coverage Δ
pester	`38.18% <ø> (-0.04%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR addresses shellcheck warnings SC2086 (unquoted variables) and SC2129 (ungrouped redirects) in GitHub Actions workflow files, following the same fix patterns established in PR #246. The changes improve shell script safety and consistency without any functional modifications.

Changes:

Quoted shell variables ($GITHUB_ENV, $GITHUB_STEP_SUMMARY) to prevent word splitting and globbing
Grouped multiple echo statements into single atomic redirects using brace syntax { ...; } >> file

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`.github/workflows/markdown-lint.yml`	Quoted `$GITHUB_ENV` on line 40 and grouped redirect patterns for both success/failure summary outputs (lines 60-74)
`.github/workflows/codeql-analysis.yml`	Grouped redirect pattern for CodeQL analysis summary output with quoted `$GITHUB_STEP_SUMMARY` (lines 50-57)

🤖 I have created a release *beep* *boop* --- ## [2.0.0](hve-core-v1.1.0...hve-core-v2.0.0) (2026-01-28) ### ⚠ BREAKING CHANGES * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ### ✨ Features * **agents:** add hve-core-installer agent to extension package ([#297](#297)) ([c0e48c6](c0e48c6)) * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ([ae76cab](ae76cab)) * **build:** add code coverage reporting to Pester workflow ([#230](#230)) ([a34822a](a34822a)) * **docs:** add GOVERNANCE.md for OSSF Silver Badge compliance ([#235](#235)) ([b0e752c](b0e752c)) * **docs:** add ROADMAP.md for OSSF Silver badge compliance ([#238](#238)) ([4a41c16](4a41c16)) * **mcp:** add MCP server configuration guidance and installer enhancements ([#225](#225)) ([0bce418](0bce418)) * **scripts:** add YAML linting with actionlint ([#234](#234)) ([d9301f9](d9301f9)) * **security:** add OpenSSF Scorecard workflow and badge ([#271](#271)) ([7c6d788](7c6d788)) * **skills:** add video-to-gif conversion skill with FFmpeg two-pass optimization ([#247](#247)) ([8d65c42](8d65c42)) * **tests:** add Pester tests for LintingHelpers and Validate-MarkdownFrontmatter ([#197](#197), [#198](#198)) ([#205](#205)) ([51ae563](51ae563)) ### 🐛 Bug Fixes * **build:** detect table formatting changes via git diff ([#261](#261)) ([985eee0](985eee0)) * **build:** disable MD024 lint rule in CHANGELOG for release-please ([#220](#220)) ([971df94](971df94)) * **build:** quote shell variables and group redirects in workflow files ([#299](#299)) ([3372509](3372509)) * **build:** resolve scorecard badge and workflow security issues ([#301](#301)) ([aeaed13](aeaed13)) * **extension:** remove frontmatter from README and exclude from markdown linting ([#223](#223)) ([4272529](4272529)) * **instructions:** quote applyTo glob pattern for YAML compatibility ([#216](#216)) ([085199c](085199c)) * **scripts:** add FooterExcludePaths parameter to frontmatter validation ([#334](#334)) ([64db98d](64db98d)) * **scripts:** add GHSA word and logs/ exclusion to cspell config ([#214](#214)) ([5c99b3f](5c99b3f)) * **scripts:** correct type assertions in Invoke-YamlLint.Tests.ps1 ([#332](#332)) ([af7050d](af7050d)) * **scripts:** eliminate false positives in dependency pinning npm pattern ([#273](#273)) ([ccbdfa3](ccbdfa3)) * **security:** add artifact attestation for signed releases ([#257](#257)) ([c52d6e2](c52d6e2)) * standardize markdown footers and complete frontmatter ([#217](#217)) ([b4e7556](b4e7556)) ### 📚 Documentation * add OpenSSF Best Practices Passing badge to README ([#239](#239)) ([91bc529](91bc529)) * **architecture:** add architecture documentation and value proposition ([#252](#252)) ([0e4b02f](0e4b02f)) * **contributing:** add testing requirements for OSSF compliance ([#254](#254)) ([4db1a18](4db1a18)) * **docs:** add enterprise status badges to README header ([#270](#270)) ([ccb68a4](ccb68a4)) * **security:** add security assurance case and threat model for OSSF Silver ([#259](#259)) ([a390e26](a390e26)) ### ♻️ Refactoring * **application:** wrap execution with try blocks, ensure proper … ([#296](#296)) ([35c4417](35c4417)) * **scripts:** extract frontmatter validation to testable module ([#293](#293)) ([4e8707e](4e8707e)) * **scripts:** extract pure functions for Pester testability ([#221](#221)) ([d40e742](d40e742)) ### 🔧 Maintenance * **deps-dev:** bump cspell from 9.4.0 to 9.6.0 in the npm-dependencies group ([#208](#208)) ([855914b](855914b)) * **deps-dev:** bump cspell from 9.6.0 to 9.6.1 in the npm-dependencies group ([#294](#294)) ([1e45ad6](1e45ad6)) * **deps:** bump actions/setup-node from 6.1.0 to 6.2.0 in the github-actions group ([#209](#209)) ([c4c69e2](c4c69e2)) * **deps:** bump the github-actions group with 4 updates ([#295](#295)) ([d8337b8](d8337b8)) * remove step-security/harden-runner from workflows ([#246](#246)) ([c5708d8](c5708d8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>

fix(build): quote shell variables and group redirects in workflow files

1de87c8

Quote $GITHUB_ENV and $GITHUB_STEP_SUMMARY variables (SC2086) and group multiple echo statements into single redirects (SC2129) in markdown-lint.yml and codeql-analysis.yml. 🤖 Generated by Copilot

WilliamBerryiii requested a review from a team as a code owner January 26, 2026 19:07

Copilot AI review requested due to automatic review settings January 26, 2026 19:07

Copilot started reviewing on behalf of WilliamBerryiii January 26, 2026 19:07 View session

Copilot AI reviewed Jan 26, 2026

View reviewed changes

WilliamBerryiii requested review from auyidi1 and benljbrooks January 26, 2026 19:20

auyidi1 approved these changes Jan 26, 2026

View reviewed changes

WilliamBerryiii merged commit 3372509 into main Jan 26, 2026
22 checks passed

WilliamBerryiii deleted the fix/issue-298-shellcheck-warnings branch January 26, 2026 19:46

hve-core-release-please bot mentioned this pull request Jan 26, 2026

chore(main): release hve-core 2.0.0 #212

Merged

This was referenced Jan 28, 2026

chore(main): release hve-core 3.0.0 #341

Closed

chore(main): release hve-core 3.0.0 #417

Closed

This was referenced Feb 6, 2026

chore(main): release hve-core 3.0.0 #441

Closed

chore(main): release hve-core 3.0.0 #530

Closed

chore(main): release hve-core 3.0.0 #532

Closed

chore(main): release hve-core 3.0.0 #534

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(build): quote shell variables and group redirects in workflow files#299

fix(build): quote shell variables and group redirects in workflow files#299
WilliamBerryiii merged 1 commit intomainfrom
fix/issue-298-shellcheck-warnings

WilliamBerryiii commented Jan 26, 2026

Uh oh!

github-actions bot commented Jan 26, 2026

Uh oh!

codecov-commenter commented Jan 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Jan 26, 2026

Description

Related Issue(s)

Type of Change

Sample Prompts (for AI Artifact Contributions)

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Jan 26, 2026

Dependency Review

Scanned Files

Uh oh!

codecov-commenter commented Jan 26, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants