From fb3938f19b4d41f7f8fa3c8a96e19287727cce8e Mon Sep 17 00:00:00 2001
From: Riccardo Schirone <riccardo.schirone@trailofbits.com>
Date: Mon, 26 Jan 2026 15:13:01 +0100
Subject: [PATCH] ci: improve static-checks workflow

- Install hadolint from GitHub releases for Dockerfile linting
- Exclude external/ and node_data_storage/ directories from shellcheck
  and hadolint (contain vendored/cloned code)
- Improve merge conflict detection regex to avoid false positives
- Add SC2153 shellcheck disable directives for intentional env var names

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/static-checks.yml | 31 ++++++++++++++++++++++-------
 scripts/common.sh                   |  2 ++
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/static-checks.yml b/.github/workflows/static-checks.yml
index 593a612f..d33c2589 100644
--- a/.github/workflows/static-checks.yml
+++ b/.github/workflows/static-checks.yml
@@ -32,9 +32,8 @@ jobs:
 
       - name: Security audit GitHub Actions
         run: |
-          # Install zizmor
-          uv pip install --isolated zizmor
-          zizmor .github/workflows/
+          # Run zizmor in an isolated environment using uvx
+          uvx zizmor .github/workflows/
 
       - name: Check YAML files
         run: |
@@ -69,14 +68,32 @@ jobs:
 
       - name: Check for merge conflicts
         run: |
-          ! grep -rE '^(<{7}|>{7}|={7})' --include='*.py' --include='*.yaml' --include='*.yml' --include='*.toml' --include='*.json' . || exit 1
+          # Match exact git merge conflict markers:
+          # - <<<<<<< (followed by space, e.g., "<<<<<<< HEAD")
+          # - ======= (exactly 7 equals at end of line)
+          # - >>>>>>> (followed by space, e.g., ">>>>>>> branch-name")
+          ! grep -rE '^(<{7} |>{7} |={7}$)' --include='*.py' --include='*.yaml' --include='*.yml' --include='*.toml' --include='*.json' . || exit 1
 
       - name: Lint shell scripts
         run: |
           shellcheck --version
-          find . -name '*.sh' -type f ! -path './.git/*' ! -path '*/.venv/*' -print0 | xargs -0 shellcheck
+          # Exclude external directories (node_data_storage contains cloned repos, external has vendored code)
+          find . -name '*.sh' -type f \
+            ! -path './.git/*' \
+            ! -path '*/.venv/*' \
+            ! -path './node_data_storage/*' \
+            ! -path './external/*' \
+            -print0 | xargs -0 shellcheck
 
       - name: Lint Dockerfiles
         run: |
-          hadolint --version
-          find . -name 'Dockerfile*' -type f ! -path './.git/*' -print0 | xargs -0 hadolint
+          # Install hadolint
+          curl -sL -o hadolint "https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64"
+          chmod +x hadolint
+          ./hadolint --version
+          # Exclude external directories (node_data_storage contains cloned repos, external has vendored code)
+          find . -name 'Dockerfile*' -type f \
+            ! -path './.git/*' \
+            ! -path './node_data_storage/*' \
+            ! -path './external/*' \
+            -print0 | xargs -0 ./hadolint
diff --git a/scripts/common.sh b/scripts/common.sh
index 3f7baf2f..ffab1f90 100755
--- a/scripts/common.sh
+++ b/scripts/common.sh
@@ -549,12 +549,14 @@ configure_local_api_keys() {
     print_linebreak
     print_status "GitHub Personal Access Token (Optional): Access to private GitHub resources."
     print_status "Only needed if Buttercup will access private repositories or packages."
+    # shellcheck disable=SC2153  # GHCR_AUTH is an external env var, not a misspelling of ghcr_auth
     configure_service "GHCR_AUTH" "GitHub authentication" "$GHCR_AUTH" "<your-ghcr-base64-auth>" false "configure_ghcr_optional"
     
     # Docker Hub credentials (optional)
     print_linebreak
     print_status "Docker Hub Credentials (Optional): Gives higher rate limits when pulling public base images."
     print_status "Recommended for reliable builds, but not strictly required for operation."
+    # shellcheck disable=SC2153  # DOCKER_USERNAME is an external env var, not a misspelling
     configure_service "DOCKER_USERNAME" "Docker Hub credentials" "$DOCKER_USERNAME" "<your-docker-username>" false "configure_docker_hub_optional"
     
     # Validate that at least one LLM API key is configured