ci(check-pr): use literal comparison

Author: thomasleplus

.github/workflows/check-pr.yml

@@ -58,16 +58,14 @@ jobs:
           for label in build chore ci docs feat fix perf refactor test style ; do
             if [[ "${label}" == "${type}" ]]; then
               echo "Label to add: ${label}"
-              # shellcheck disable=SC2076
-              if [[ "${PR_LABELS}" =~ "\"${label}\"" ]] ; then
+              if [[ "${PR_LABELS}" == *"${label}"* ]] ; then
                 echo "Label ${label} already present"
               else
                 add_labels+=("${label}")
               fi
             else
               echo "Label to remove: ${label}"
-              # shellcheck disable=SC2076
-              if [[ "${PR_LABELS}" =~ "\"${label}\"" ]] ; then
+              if [[ "${PR_LABELS}" == *"${label}"* ]] ; then
                 remove_labels+=("${label}")
               else
                 echo "Label ${label} not present"
@@ -78,8 +76,7 @@ jobs:
           regexp2='^[a-zA-Z0-9]+\([a-zA-Z0-9\-]*deps\)$'
           if [[ "${scoped_type}" =~ ${regexp2} ]] ; then
             echo "Label to add: dependencies"
-            # shellcheck disable=SC2076
-            if [[ "${PR_LABELS}" =~ "\"dependencies\"" ]] ; then
+            if [[ "${PR_LABELS}" == *"dependencies"* ]] ; then
               echo "Label dependencies already present"
             else
               add_labels+=('dependencies')
@@ -93,16 +90,14 @@ jobs:
                 || "${type}" == 'style' \
                 || "${type}" == 'test' ]] ; then
             echo "Label to add: no-release-notes"
-            # shellcheck disable=SC2076
-            if [[ "${PR_LABELS}" =~ "\"no-release-notes\"" ]] ; then
+            if [[ "${PR_LABELS}" == *"no-release-notes"* ]] ; then
               echo "Label no-release-notes already present"
             else
               add_labels+=('no-release-notes')
             fi
           else
             echo "Label to remove: no-release-notes"
-            # shellcheck disable=SC2076
-            if [[ "${PR_LABELS}" =~ "\"no-release-notes\"" ]] ; then
+            if [[ "${PR_LABELS}" == *"no-release-notes"* ]] ; then
               remove_labels+=('no-release-notes')
             else
               echo "Label no-release-notes not present"

.github/workflows/maven-dependency-check.yml

@@ -43,7 +43,7 @@ jobs:
         run: |
           set -euo pipefail
           # Do not set IFS=$'\n\t', breaks ${MAVEN_CLI_OPTS}
-          # shellcheck disable=SC2086
+          # shellcheck disable=SC2086 # [Double quote to prevent globbing and word splitting]: splitting is desired for MAVEN_CLI_OPTS
           ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.NVDApiKey=${NVD_API_KEY} dependency-check:aggregate
       - name: Upload artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

xml/Dockerfile

@@ -10,7 +10,6 @@ ARG USER_GECOS=Default
 SHELL ["/bin/ash", "-euo", "pipefail", "-c"]
 
 # @TL FIXME: xml2rfc currently only in edge stream
-# hadolint ignore=DL3019
 RUN apk upgrade --no-cache \
     && apk add --no-cache \
     coreutils=9.7-r1 \