Specify shell in workflows

Author: thomasleplus

.github/workflows/automerge.yml

@@ -30,8 +30,10 @@ jobs:
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         if: env.RELEASE_TOKEN != ''
+        shell: bash
         run: echo "${RELEASE_TOKEN}" | gh auth login --with-token
       - name: Enable auto-merge for Dependabot PRs
+        shell: bash
         run: |
           # Checking the PR title is a poor substitute for the actual PR changes
           # but as long as this is used only with dependabot PRs,

.github/workflows/maven-dependency-check.yml

@@ -55,6 +55,7 @@ jobs:
       - name: Dependency Check with Maven
         env:
           NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+        shell: bash
         run: |
           # shellcheck disable=SC2086
           ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.NVDApiKey=${NVD_API_KEY} dependency-check:aggregate
@@ -64,4 +65,5 @@ jobs:
           name: ${{ github.workflow }}
           path: target/
       - name: Clean up
+        shell: bash
         run: rm "${HOME}/.m2/settings.xml"

.github/workflows/maven.yml

@@ -58,6 +58,7 @@ jobs:
     name: Java ${{ matrix.java }}
     steps:
       - name: Set REPOSITORY
+        shell: bash
         run: echo "REPOSITORY=${GITHUB_REPOSITORY#*/}" >> "${GITHUB_ENV}"
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up JDK ${{ matrix.java }}
@@ -66,6 +67,7 @@ jobs:
           distribution: temurin
           java-version: ${{ matrix.java }}
       - name: Build with Maven
+        shell: bash
         run: |
           # shellcheck disable=SC2086
           ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.skip=true -Dgpg.skip=true verify
@@ -76,4 +78,5 @@ jobs:
           name: ${{ env.REPOSITORY }}
           path: target/
       - name: Clean up
+        shell: bash
         run: rm "${HOME}/.m2/settings.xml"

.github/workflows/publish.yml

@@ -48,6 +48,7 @@ jobs:
       MAVEN_GPG_PASSPHRASE: ${{ secrets.OSSRH_GPG_PASSPHRASE }}
     steps:
       - name: Set REPOSITORY
+        shell: bash
         run: echo "REPOSITORY=${GITHUB_REPOSITORY#*/}" >> "${GITHUB_ENV}"
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Maven Central Repository
@@ -61,17 +62,20 @@ jobs:
           gpg-private-key: ${{ secrets.OSSRH_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
       - name: Build
+        shell: bash
         run: |
           # shellcheck disable=SC2086
           ./mvnw ${MAVEN_CLI_OPTS} -DdependencyCheck.skip=true -Daether.layout.maven2.checksumAlgorithms=MD5,SHA-1,SHA-256,SHA-512 -Daether.checksums.omitChecksumsForExtensions=.asc,.sigstore.json package
       - name: Publish packages
+        shell: bash
         run: |
           # shellcheck disable=SC2086
           ./mvnw ${MAVEN_CLI_OPTS} --no-transfer-progress -DdependencyCheck.skip=true deploy
       - name: Publish site
         env:
           GITHUB_TOKEN: ${{ github.token }}
           SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        shell: bash
         run: |
           git config --global user.email \
             "${GITHUB_REPOSITORY_OWNER}@users.noreply.github.com"
@@ -88,5 +92,6 @@ jobs:
           name: ${{ env.REPOSITORY }}
           path: target/
       - name: Clean up
+        shell: bash
         run: |
           rm "${HOME}/.m2/settings.xml"

.github/workflows/sigstore-signature-check.yml

@@ -32,10 +32,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set REPOSITORY
+        shell: bash
         run: echo "REPOSITORY=${GITHUB_REPOSITORY#*/}" >> "${GITHUB_ENV}"
       - name: Set VERSION
+        shell: bash
         run: echo "VERSION=$(curl -s -S "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/releases/latest" | jq -r '.tag_name' | sed -e 's/^v//')" >> "${GITHUB_ENV}"
       - name: Download
+        shell: bash
         run: |
           curl -s -S "https://repo1.maven.org/maven2/org/leplus/${REPOSITORY}/${VERSION}/${REPOSITORY}-${VERSION}.jar" -o "${REPOSITORY}-${VERSION}.jar"
           curl -s -S "https://repo1.maven.org/maven2/org/leplus/${REPOSITORY}/${VERSION}/${REPOSITORY}-${VERSION}.jar.sigstore.json" -o "${REPOSITORY}-${VERSION}.jar.sigstore.json"
@@ -46,6 +49,7 @@ jobs:
           check-latest: true
         id: go
       - name: Cosign
+        shell: bash
         run: |
           go install github.com/sigstore/cosign/v2/cmd/cosign@latest
           cosign verify-blob --bundle "${REPOSITORY}-${VERSION}.jar.sigstore.json" --certificate-identity "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/.github/workflows/publish.yml@refs/tags/v${VERSION}" --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' "${REPOSITORY}-${VERSION}.jar"