chore: add prek with some inital checks - shellcheck and zizmor and apply suggested fixes

Author: netomi

.github/dependabot.yml

@@ -8,3 +8,5 @@ updates:
       github-actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7

.github/workflows/playwright.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f  # v6.1.0
         with:
           node-version: 18.x

.github/workflows/publish-cli.yml

@@ -65,6 +65,7 @@ jobs:
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: '24.x'
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install Yarn

.github/workflows/publish-webui.yml

@@ -63,6 +63,7 @@ jobs:
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: '24.x'
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install Yarn

.github/workflows/sonar.yml

@@ -15,7 +15,7 @@ jobs:
       run: mkdir -p ${{ runner.temp }}/artifacts
     - name: Download PR number artifact
       if: github.event.workflow_run.event == 'pull_request'
-      uses: dawidd6/action-download-artifact@v12
+      uses: dawidd6/action-download-artifact@0bd50d53a6d7fb5cb921e607957e9cc12b4ce392 # v12
       with:
         workflow: CI
         run_id: ${{ github.event.workflow_run.id }}
@@ -42,6 +42,7 @@ jobs:
       with:
           repository: ${{ github.event.workflow_run.head_repository.full_name }}
           ref: ${{ github.event.workflow_run.head_branch }}
+          persist-credentials: false
           fetch-depth: 0
     - name: Checkout head branch of pull_request
       if: github.event.workflow_run.event == 'pull_request'

.github/zizmor.yml

@@ -0,0 +1,7 @@
+rules:
+  dangerous-triggers:
+    ignore:
+      - sonar.yml
+  template-injection:
+    ignore:
+      - sonar.yml

.pre-commit-config.yaml

@@ -0,0 +1,29 @@
+repos:
+#- repo: https://github.com/pre-commit/pre-commit-hooks
+#  rev: v6.0.0
+#  hooks:
+#    - id: check-yaml
+#    - id: end-of-file-fixer
+#    - id: mixed-line-ending
+#    - id: trailing-whitespace
+#- repo: https://github.com/Lucas-C/pre-commit-hooks
+#  rev: v1.5.5
+#  hooks:
+#    - id: insert-license
+#      name: Add license for all Java files
+#      files: ^server/.*\.java$
+#      args:
+#        - --comment-style
+#        - "/*| *| */"
+#        - --license-filepath
+#        - LICENSE-template.txt
+#        - --fuzzy-match-generates-todo
+- repo: https://github.com/shellcheck-py/shellcheck-py
+  rev: v0.11.0.1
+  hooks:
+  -   id: shellcheck
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.20.0
+  hooks:
+    - id: zizmor
+      args: [ --min-severity, low ]

deploy/docker/build.sh

@@ -1,4 +1,6 @@
-#/bin/bash
+#!/bin/bash
 
-export OPENVSX_VERSION=`curl -sSL https://api.github.com/repos/eclipse/openvsx/releases/latest | jq -r ".tag_name"`
-sudo docker build -t "openvsx:$OPENVSX_VERSION" --build-arg "OPENVSX_VERSION=$OPENVSX_VERSION" .
+OPENVSX_VERSION=$(curl -sSL https://api.github.com/repos/eclipse/openvsx/releases/latest | jq -r ".tag_name")
+export OPENVSX_VERSION
+
+sudo docker build -t "openvsx:$OPENVSX_VERSION" --build-arg "OPENVSX_VERSION=$OPENVSX_VERSION" .

server/scripts/callback-url.sh

@@ -3,7 +3,7 @@
 # This script prints the callback URL for the provider given as argument, e.g. github
 if command -v gp > /dev/null
 then
-    echo "`gp url 8080 | sed s/https:/http:/`/login/oauth2/code/$1"
+    echo "$(gp url 8080 | sed s/https:/http:/)/login/oauth2/code/$1"
 else
     echo "http://localhost:8080/login/oauth2/code/$1"
 fi

server/scripts/dependencies-check.sh

@@ -3,14 +3,14 @@
 # Clone and build license tool
 if [ ! -d "/workspace/dash-licenses" ] 
 then
-    cd /workspace
+    cd /workspace || exit
     git clone https://github.com/eclipse/dash-licenses.git
-    cd dash-licenses
+    cd dash-licenses || exit
     mvn package
 fi
 
 # Generate build/dependencies/list.txt
-cd /workspace/openvsx/server
+cd /workspace/openvsx/server || exit
 ./gradlew listDependencies
 
 # Generate DEPENDENCIES report