ci(check-pr): use literal comparison

Author: thomasleplus

.github/workflows/check-pr.yml

@@ -58,16 +58,14 @@ jobs:
           for label in build chore ci docs feat fix perf refactor test style ; do
             if [[ "${label}" == "${type}" ]]; then
               echo "Label to add: ${label}"
-              # shellcheck disable=SC2076
-              if [[ "${PR_LABELS}" =~ "\"${label}\"" ]] ; then
+              if [[ "${PR_LABELS}" == *"${label}"* ]] ; then
                 echo "Label ${label} already present"
               else
                 add_labels+=("${label}")
               fi
             else
               echo "Label to remove: ${label}"
-              # shellcheck disable=SC2076
-              if [[ "${PR_LABELS}" =~ "\"${label}\"" ]] ; then
+              if [[ "${PR_LABELS}" == *"${label}"* ]] ; then
                 remove_labels+=("${label}")
               else
                 echo "Label ${label} not present"
@@ -78,8 +76,7 @@ jobs:
           regexp2='^[a-zA-Z0-9]+\([a-zA-Z0-9\-]*deps\)$'
           if [[ "${scoped_type}" =~ ${regexp2} ]] ; then
             echo "Label to add: dependencies"
-            # shellcheck disable=SC2076
-            if [[ "${PR_LABELS}" =~ "\"dependencies\"" ]] ; then
+            if [[ "${PR_LABELS}" == *"dependencies"* ]] ; then
               echo "Label dependencies already present"
             else
               add_labels+=('dependencies')
@@ -93,16 +90,14 @@ jobs:
                 || "${type}" == 'style' \
                 || "${type}" == 'test' ]] ; then
             echo "Label to add: no-release-notes"
-            # shellcheck disable=SC2076
-            if [[ "${PR_LABELS}" =~ "\"no-release-notes\"" ]] ; then
+            if [[ "${PR_LABELS}" == *"no-release-notes"* ]] ; then
               echo "Label no-release-notes already present"
             else
               add_labels+=('no-release-notes')
             fi
           else
             echo "Label to remove: no-release-notes"
-            # shellcheck disable=SC2076
-            if [[ "${PR_LABELS}" =~ "\"no-release-notes\"" ]] ; then
+            if [[ "${PR_LABELS}" == *"no-release-notes"* ]] ; then
               remove_labels+=('no-release-notes')
             else
               echo "Label no-release-notes not present"

openid-connect-provider-debugger/Dockerfile

@@ -1,5 +1,5 @@
-# checkov:skip=CKV_DOCKER_3
-# trivy:ignore:AVD-DS-0002
+# checkov:skip=CKV_DOCKER_3: [Missing USER]: inherited from parent image
+# trivy:ignore:AVD-DS-0002: [Missing USER]: inherited from parent image
 FROM openresty/openresty:1.27.1.2-3-alpine-fat@sha256:eb0d368d262cc82b867d88f48b49a93ad9247436b65d459a14940d28ccd0e67b
 
 ARG LUA_RESTY_OPENIDC_VERSION="1.8.0-1"
@@ -10,7 +10,6 @@ HEALTHCHECK CMD ["/usr/bin/curl", "-ifsSL", "http://localhost"]
 
 COPY nginx.conf.patch /usr/local/openresty/nginx/conf/
 
-# hadolint ignore=DL3019
 RUN apk upgrade --no-cache \
     && apk add --no-cache \
     curl=8.12.1-r1 \

openid-connect-provider-debugger/Dockerfile-test

@@ -11,7 +11,7 @@ ARG USER_GECOS=Default
 
 SHELL ["/bin/ash", "-euo", "pipefail", "-c"]
 
-# hadolint ignore=DL3018
+# hadolint ignore=DL3018 [Pin versions in apk add]: not required for testing
 RUN apk add --no-cache curl
 
 RUN adduser \