From 71e5fbbf60f34061a5de1705272113c288e57b0e Mon Sep 17 00:00:00 2001
From: changjoon-park <sisyphus9402@gmail.com>
Date: Fri, 24 Apr 2026 14:35:27 +0900
Subject: [PATCH] Fix ShellCheck findings in lib-deps-check and update-doc-db
 workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Clear four of the five ShellCheck findings reported in #7653. The
fifth finding is in upgrade-pylib.lock.yml — a gh-aw-generated file
marked "DO NOT EDIT" whose source .md does not contain the flagged
pattern — and is out of scope here; it will resolve via the in-flight
gh-aw version bump (#7650).

lib-deps-check.yaml:
  * SC2076: replace `=~ " $module "` (quoted regex interpreted
    literally) with `== *" $module "*` glob match. Same intent
    (literal substring), same semantics across regex metachars.
  * SC2086: quote `$GITHUB_OUTPUT` in the output redirect.

update-doc-db.yml:
  * SC2129: collapse the eight sequential `echo ... >> $OUTPUT_FILE`
    lines (plus one `cat ... >> $OUTPUT_FILE`) into a single grouped
    redirect `{ ...; } > "$OUTPUT_FILE"`. Drops the now-redundant
    `echo -n '' > $OUTPUT_FILE` truncate.
  * SC2016: add `# shellcheck disable=SC2016` above the block; the
    backticks in the auto-generated-header comment are literal
    Markdown, not command substitution.

Verified locally with shellcheck 0.11.0: both modified blocks
produce no ShellCheck output. Semantic equivalence of the
lib-deps-check change confirmed across six test inputs including
regex metachars and glob-meaningful characters.
---
 .github/workflows/lib-deps-check.yaml |  4 ++--
 .github/workflows/update-doc-db.yml   | 21 ++++++++++-----------
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/lib-deps-check.yaml b/.github/workflows/lib-deps-check.yaml
index b009c427df7..b77e931558f 100644
--- a/.github/workflows/lib-deps-check.yaml
+++ b/.github/workflows/lib-deps-check.yaml
@@ -71,14 +71,14 @@ jobs:
               # Lib files: Lib/foo.py -> foo, Lib/foo/__init__.py -> foo
               module=$(echo "$file" | sed -E 's|^Lib/||; s|/__init__\.py$||; s|\.py$||; s|/.*||')
             fi
-            if [[ -n "$module" && ! " $modules " =~ " $module " ]]; then
+            if [[ -n "$module" && " $modules " != *" $module "* ]]; then
               modules="$modules $module"
             fi
           done
 
           modules=$(echo "$modules" | xargs)  # trim whitespace
           echo "Detected modules: $modules"
-          echo "modules=$modules" >> $GITHUB_OUTPUT
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
 
       - name: Setup Python
         if: steps.changed-files.outputs.modules != ''
diff --git a/.github/workflows/update-doc-db.yml b/.github/workflows/update-doc-db.yml
index bcb766e0a35..6c5f717833c 100644
--- a/.github/workflows/update-doc-db.yml
+++ b/.github/workflows/update-doc-db.yml
@@ -87,17 +87,16 @@ jobs:
 
           OUTPUT_FILE='crates/doc/src/data.inc.rs'
 
-          echo -n '' > $OUTPUT_FILE
-
-          echo '// This file was auto-generated by `.github/workflows/update-doc-db.yml`.' >> $OUTPUT_FILE
-          echo "// CPython version: ${PYTHON_VERSION}" >> $OUTPUT_FILE
-          echo '// spell-checker: disable' >> $OUTPUT_FILE
-
-          echo '' >> $OUTPUT_FILE
-
-          echo "pub static DB: phf::Map<&'static str, &'static str> = phf::phf_map! {" >> $OUTPUT_FILE
-          cat crates/doc/generated/raw_entries.txt >> $OUTPUT_FILE
-          echo '};' >> $OUTPUT_FILE
+          # shellcheck disable=SC2016
+          {
+            echo '// This file was auto-generated by `.github/workflows/update-doc-db.yml`.'
+            echo "// CPython version: ${PYTHON_VERSION}"
+            echo '// spell-checker: disable'
+            echo ''
+            echo "pub static DB: phf::Map<&'static str, &'static str> = phf::phf_map! {"
+            cat crates/doc/generated/raw_entries.txt
+            echo '};'
+          } > "$OUTPUT_FILE"
 
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with: