ci: pin action-shellcheck to commit SHA

[iap]

Pin ludeeus/action-shellcheck from @2.0.0 (mutable tag) to @00cae500b08a931fb5698e11e79bfbd38e612a38 (immutable commit SHA). Same version, supply chain hardened.

Summary by CodeRabbit

• Chores
  • Updated CI workflows to improve consistency and reproducibility.
  • Pinned the ShellCheck action used in CI to a specific, immutable version for stable linting.
  • Expanded the CodeQL trigger scope so workflow changes across the repo are now scanned.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 633de2a3-2f14-4534-9ed7-9de5906c5233

📥 Commits

Reviewing files that changed from the base of the PR and between c2c429f and 2df4fdc.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

---

Walkthrough

Pins the Shellcheck action to a specific commit SHA and expands the CodeQL workflow PR path filter to include all files under .github/workflows/**.

Changes

CI workflow updates

Layer / File(s)	Summary
Shellcheck action pinned to commit SHA .github/workflows/scripts-ci.yml	Updates ludeeus/action-shellcheck reference from v2.0.0 to commit SHA 00cae500b08a931fb5698e11e79bfbd38e612a38.
CodeQL paths filter broadened .github/workflows/codeql.yml	Changes pull_request paths filter to .github/workflows/** so CodeQL runs when any workflow file changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I pinned the shellcheck carrot tight,
A SHA to hold it through the night,
CodeQL now watches workflow lanes,
Together they guard our CI plains,
Hoppity CI, steady and bright!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is minimal but does not follow the template structure with required sections like Scope, Verification, Risk Review, and Governance.	Expand the description to include template sections: select relevant Scope checkboxes, verify no forge/slither requirements apply, review access control and deployment impact, and confirm target branch and CODEOWNER review.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary change: pinning action-shellcheck to a commit SHA for supply chain hardening.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/pin-shellcheck-sha

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/ludeeus/action-shellcheck	00cae500b08a931fb5698e11e79bfbd38e612a38	🟢 4.6	Details Check Score Reason Code-Review 🟢 3 Found 11/29 approved changesets -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/scripts-ci.yml