container-shell-safety

Run the unpinned-container-steps.py script against your workflow files to list every run step in a caller-supplied-container job with no effective shell setting. Findings that match known bash-only constructs are sorted first with the matched construct named.

When a job uses a caller-supplied container image and the step has no shell setting, Actions resolves the shell from that image, which may be sh instead of bash. POSIX sh rejects bash-only constructs like pipefail with errors such as Illegal option -o pipefail on every run.

Constructs that fail under sh include set -o pipefail, array assignments, declare -A, double-bracket conditionals, local, process substitution, read -d, here-strings, substring expansion, case modification, and echo -e. The script checks step bodies against regexes for each of these.

No, it complements the exact auto-failing gate that only flags set pipefail steps. This script enumerates all unpinned candidates including ones with no bashism yet, leaving the judgment of actual risk to the reviewer since broad auto-failing would false-positive on strings and comments.

Add shell: bash to the step, placed after id or name per the repo convention, or set a job- or workflow-level defaults run shell bash to cover many steps at once. Both forms are recognized as covering a step by the shared shell-pinning logic.